A researcher from the University of Zangalan presents security risks posed by agentic AI systems, illustrated by real-world incidents including AI agents deleting production databases and entire drives. The talk covers prompt injection vulnerabilities, jailbreaking via language switching, and the fundamental problem of agents inheriting full user permissions. A proposed mitigation approach wraps MCP servers in Docker containers with a policy enforcement engine that enforces fine-grained access control policies (read/write permissions per directory, internet domain access), adding only ~0.6ms overhead. Limitations include inability to prevent parameter-level prompt injections within permitted access boundaries. Future research directions include behavior analysis inspired by malware detection to distinguish malicious from benign agent actions at runtime.
Sort: