About the session
As Large Language Models (LLMs) evolve from isolated chat interfaces into autonomous agents capable of interacting with external systems, the attack surface has dramatically expanded. We are no longer just trying to prevent an AI from generating toxic text; we are defending highly privileged, transactional pipelines against systemic exploitation.
This session explores the Full Stack of LLM application security. We will begin by demystifying the modern threat landscape, exploring how inherent training biases and mathematical generation methods can be actively weaponized to trigger targeted hallucinations and supply-chain vulnerabilities. From there, we will demonstrate how attackers utilize sophisticated direct and indirect prompt injections to reliably bypass standard semantic guardrails.
Crucially, attendees will see how these front-door exploits pivot directly into the transaction layer, hijacking agent tool access to exfiltrate private data or execute unauthorized actions.
Finally, the session will shift from Red Team to Blue Team. We will deconstruct why traditional heuristic guardrails fail and showcase a multi-layered architectural defense blueprint designed to ring-fence agent workflows across four rigid security boundaries. We will demonstrate how to:
• Isolate untrusted data using toolless, quarantined LLMs.
• Restrict dynamic agent capabilities through a strict plan-then-execute flow.
• Enforce strict control over tools using robust egress allowlists.
• Neutralize the underlying runtime blast radius using severed, rootless Docker sandboxes.
Attendees will leave with actionable, framework-agnostic strategies to stress-test their environments using the open-source Spikee tool and automate the defense of their evolving LLM applications.
