AI x Cyber: Hardening Agentic Workflows and Infrastructure

Description

Description As AI systems evolve from static models into agentic workflows capable of modifying infrastructure, traditional security perimeters are no longer sufficient. This session convenes security engineers and technical architects to examine the intersection of AI and cybersecurity through practical, reproducible attack vectors. Attendees will explore the limitations and mechanics of stateful prompt guardrails, review architectural blueprints for isolating untrusted execution via microVMs and MCP servers, and analyze the forensic realities of machine-speed autonomous intrusions to understand how detection stacks must adapt for production environments. ​Agenda Nat Natraj will focus on the Input Layer (Prompt injection and guardrails). This establishes the initial vulnerability point where untrusted data interacts with the model. Christian Nicholson then will follow with System Architecture (Containment and secure tooling). Once the input layer is breached or an agent is deployed, this covers the structural design required to isolate the execution environment. To conclude, Roman Trigubenko will explain about Runtime Detection and Forensics (Breach at scale), by examining what happens when systems are actively compromised by agents at machine-speed, closing the loop from prevention to active response. 18:00 Doors open 18:30 - 19:00 AI Security: The Subtle Art of Prompt Guardrails (Nat Natraj) 19:00 - 19:30 Contain the Chaos: A Crash Course in Secure AI Tooling & Architecture (Christian Nicholson) 19:30 - 20:00 17,600 Actions in Five Days: What Machine-Speed Intrusion Does to Your Detection Stack (Roman Trigubenko) 20:00 - 21:00 Networking 21:00 Doors close Talks Talk 1 - AI Security: The Subtle Art of Prompt Guardrails Speaker: Nat Natraj (CEO & Co-founder, AccuKnox) Abstract: Prompt injection is OWASP's #1 risk for LLM applications, and for good reason: language models cannot reliably distinguish trusted instructions from untrusted data. This talk breaks down what prompt guardrails actually do, why they matter, and — more importantly — why they aren't a silver bullet. We'll walk through the mechanics of guardrail policy handling, the tradeoffs between stateless (single-prompt) and stateful (session-aware, multi-turn) detection, and the real-world constraints — latency, coverage, deployment mode — that determine whether a guardrail survives contact with production traffic. Then we'll break them. Live demos will show AWS Bedrock guardrails bypassed via character injection and prompt restructuring, indirect prompt injection through a maliciously crafted "skill" in an agentic AI workflow, and multi-turn jailbreaks (including the Crescendo attack) that exploit the gap between how guardrails are evaluated (single-turn) and how conversations actually happen (multi-turn, drifting intent over many exchanges). The throughline: guardrails built on ML/LLM detection are probabilistic, not deterministic — they will be breached, and effective AI security means planning for that rather than treating a guardrail as a firewall. Attendees will leave with a practical framework for evaluating and layering prompt guardrails — stateful vs. stateless, policy actions, compliance alignment (ISO/IEC 42001), and defense-in-depth — grounded in live, reproducible attacks rather than theory. Bio: Nat Natraj is the Co-founder and CEO of AccuKnox, a Zero Trust CNAPP and AI Security platform incubated in partnership with SRI International (Stanford Research Institute). AccuKnox holds a growing patent portfolio in AI security, including a stateful prompt firewall for detecting multi-turn prompt injection attacks, and serves enterprise and government clients. Under Nat's leadership, AccuKnox has been named the top AI security startup at Security BSides Bangalore for two consecutive years and has built a growing global presence. Before AccuKnox, Nat co-founded and served as President of Acalvio Technologies, a pioneer in cyber deception technology. His earlier career includes senior leadership roles at Apigee (acquired by Google), and Arcot Systems (acquired by CA Technologies), spanning more than three decades in enterprise software and cybersecurity. Nat holds a B.Tech in Chemical Engineering from IIT Bombay and an M.S. from the University of Virginia. He is a frequent speaker and writer on Zero Trust architecture, AI and agentic security, and the evolving offense-defense balance in cybersecurity, and mentors early-stage founders through IIT Startups. Talk 2 - Contain the Chaos: A Crash Course in Secure AI Tooling & Architecture Speaker: Christian Nicholson (Lead Consultant and Partner, Indelible) Abstract: As AI models transition away from simple chat interfaces into empowered agents capable of using tools and modifying both local and remote resources, we must re-evaluate our security boundaries and principles to build a secure modern infrastructure that balances rapid innovation with ever-evolving security needs. This talk presents a high-level blueprint breaking down the core components of modern AI architecture, demystifying principal controls, how they work, and why they are critical. We will explore high-level concepts surrounding Model Context Protocol (MCP) tooling servers across local vs. remote deployment paradigms, examine the role of deterministic policy engines in authorization and tool use, and discuss how architectural choices like containers and ephemeral microVMs (e.g., Firecracker) isolate untrusted execution. In this fast-paced 20-minute crash course, we will unlock the practical blueprint for secure AI infrastructure in the modern era. Bio: Christian is a recognized technology leader specializing in secure architecture and secure-by-design principles. With a background ranging over both technical and policy across multiple security, architecture, and development technology domains, Christian bridges the gap between developers, engineers, security professionals, business users, and executives. A global speaker, advisor, and organizer for major IT and security conferences across the globe, and a contributor to international policy, Christian is always looking for ways to make new technology secure, accessible, and understandable to all. Talk 3 - 17,600 Actions in Five Days: What Machine-Speed Intrusion Does to Your Detection Stack Speaker: Roman Trigubenko (Technical PM, Wallarm) Abstract: The July 2026 Hugging Face intrusion was reported as the first fully autonomous AI-driven breach of a major platform — and it was. But read the forensic timeline and the exploits are strikingly familiar: server-side template injection in a config renderer, an arbitrary file read that dumped proc/selfenviron, a static database password sitting in a pod environment variable, an exposed cloud metadata endpoint, over-scoped service tokens, and a privileged pod with a host mount. Every one of these has been in the OWASP canon for a decade or more. What was new was the multiplier. An autonomous agent executed roughly 17,600 actions in five days — thousands of low-signal probes, failed paths abandoned in seconds, tooling rebuilt across ephemeral sandboxes — sustaining a breadth of coverage no human operator can. The attack didn't succeed through sophistication. It succeeded by testing every ordinary gap, exhaustively, faster than defenders could correlate. This session walks the real kill chain, names each classic weakness behind it, and examines what changes when attack volume becomes the variable: which controls still hold at the input layer, and which have to move to runtime observation and connection-level enforcement of agent behavior. Bio: TBC ​Organizers Ilya Kulyatin is an entrepreneur with work and academic experience in the US, Netherlands, Singapore, UK, and Japan. He holds a BA in Economics, an MA in Finance, and an MSc in Machine Learning. He's a 3x founder, now helping Japan grow the local AI ecosystem through a not-for-profit community, Tokyo AI (TAI), while building an AI-native system integrator and solutions provider, Foundry Labs株式会社. John Kirch is Senior Director for Japan at AccuKnox, with over 35 years of experience in Japan’s high-technology industry across enterprise sales, channel development, and marketing. He has held senior positions at leading cybersecurity companies including Darktrace, Nominum, Penta Security Systems, CyberGuard, and WatchGuard Technologies. He holds an A.B. in Economics from Duke University, with minors in Computer Science and Finance, and completed graduate studies in Japan through a METI scholarship. ​Supporters Foundry Labs K.K. is a Tokyo-based AI systems integrator and solutions provider, delivering end-to-end support for enterprises: from strategy design through implementation, deployment, and operations. They tailor AI to each client's operational, regulatory, and security requirements, with hands-on experience across finance, government, and industry, and a track record of shipping production systems in secure and regulated environments. Antler is the world's most active early-stage investor — cited as the #1 most active AI investor globally in 2024 by Dealroom — with a community of 12,000+ founders across 27 cities worldwide. Antler Japan is now accepting applications for its 7th Inception Program. About TAI Tokyo AI (TAI) is the largest international AI community in Japan, with 5,000+ members mainly based in Tokyo: engineers, researchers, investors, product managers, and corporate innovation leaders. Through 80+ events a year and 300+ speakers spanning startups, enterprises, and academia, TAI connects the people building AI in Japan with the global ecosystem, working to transform Tokyo into a global AI hub. ​​Privacy Policy We will process your email address for the purposes of event-related communications and ongoing newsletter communications. You may unsubscribe from the newsletter at any time. Further details on how we process personal data are available in our Privacy Policy.