Talks

Short Summary

Privacy-breaking pattern analysis isn't new - but AI has just made it accessible to everyone. Tools that were once complex, specialized, and limited to well-resourced actors are now available to anyone with access to large language models. Your carefully crafted privacy protections, designed to withstand traditional analysis, are about to face a wave of AI-powered pattern recognition that puts sophisticated privacy-breaking capabilities into everyone's hands.

Through live demonstrations, you'll watch as simple AI tools reconstruct user identities from "anonymous" chat data, rebuild social networks from encrypted messages, and expose organizational structures from metadata we thought was safe. What once required deep expertise in statistical analysis can now be done with a few prompts to an LLM.

We'll explore how traditional privacy approaches fail against these democratized threats, and examine modern defenses like differential privacy and federated learning. You'll leave understanding both the scale of this new challenge and practical steps to protect your systems. Whether you're building communication tools, handling sensitive data, or protecting user privacy, this talk will show you why yesterday's privacy tools won't survive in a world where sophisticated pattern analysis is available to all.

Key Takeaways:

• How traditional privacy and anonymization tools fail against basic AI analysis
• Understanding the new ways AI can reconstruct identities and relationships
• Practical architectures and techniques for building AI-resistant privacy systems

Description

I bought two security cameras. They work fine - through the manufacturer's cloud app. No local access. No RTSP stream. No way to integrate them with my own home automation. The cameras are on my network, in my house, and I can not talk to them. So I gave an AI agent a network probe, a web browser, and 15 iterations. On iteration 15, it pulled a 2560x1440 HEVC frame from both cameras.

Then I pointed a similar agent at a database engine's source code and told it to find data corruption bugs. It read the simulator source, ran 230 differential tests, reviewed 3,000 lines of WAL internals, generated its own attack ideas, and started writing crash-recovery tests - without supervision.

This talk is three stories about using AI to reverse engineer things you own, use, or depend on. Cracking a checksum algorithm on physical documents. Reclaiming local access to locked-down hardware. Turning an autonomous agent loose on a codebase to find bugs that traditional fuzzing misses. Reverse engineering has always been about freedom and understanding - from Compaq cloning the IBM BIOS in 1982 to farmers jailbreaking tractors at DEF CON. AI is compressing months of that work into hours. That changes the assumptions your systems are built on.

Description

A dark factory runs with the lights off. Nobody inspects each unit as it comes off the line, because the line itself is built to catch anything wrong before it ships. AI-written code needs the same line.

I run one, called Holodeck. An interviewer agent turns a problem into a versioned spec. A planner emits a validated issue graph from that spec. Sandboxed coding agents build each issue in isolated containers, behind an LLM code reviewer and deterministic tests and gates. In seven weeks it made 957 commits, 87% of them machine-authored, and shipped applications I never read.

What broke was never the model's code. It was always the machinery: containers, proxies, health checks, databases - including one issue that drew 4,485 review verdicts in three days because of a level-triggered loop. The failures are boring and operational, and they are also the entire difference between a demo and something you can trust.

This talk covers how to build the line and its gates: a spec precise enough that the model builds the right thing, and gates strict enough that the wrong thing never leaves the building, whoever or whatever wrote it. Tool-agnostic throughout. It is the advanced follow-on to The Spec Is the Hard Part.

LLMs power everything from chatbots to autonomous agents, but their non-deterministic nature exposes you to spoofing, privilege escalation, and compliance pitfalls. In this session, we'll draw on the social engineering experiments I undertook while building conversational AI systems, and we'll see how attackers could bypass security guardrails. We'll explore:

• Real-world injection attacks and the vulnerabilities that make them possible
• Emerging identity patterns, from W3C Verifiable Credentials to on-chain verification
• Methods to protect against prompt manipulation and the often-overlooked elements in audit logs
• A roadmap to LLM-aware identity ecosystems, including policy-as-code enforcement and federated governance models

You'll discover practical approaches to securing LLM workflows today while preparing for tomorrow's decentralised identity architectures. Through demos and case studies, you'll leave with actionable patterns for building trust into AI systems, and insight into where the ecosystem is heading.

Description

Building secure applications requires more than just adding encryption. Through live demos and real-world examples, we'll explore how to properly implement security features like end-to-end encryption, perfect forward secrecy, and secure device migration. You'll see how to protect both data and metadata, at rest and in transit, and learn about the common pitfalls that can compromise seemingly secure systems.

Using a chat application as our example, we'll walk through the evolution from basic encryption to a robust security system. We'll examine how real-world applications handle key management, protect against traffic analysis, and manage secure device enrolment. You'll learn the architectural patterns that make applications truly secure at scale.

Whether you're building a messenger, a document store, or any application that needs to protect user data, you'll leave with practical knowledge of how to implement encryption correctly and make informed security decisions in your own projects.

Elevator Pitch

JSON Web Tokens are great! Or are they? They're signed, and self-contained payloads of data, but what could go wrong? Come and find out. Live demos of hackery included.

Description

JWTs are secure; they're signed; they're the best thing since sliced bread! So you've adopted them into your applications, and feel much safer. The chances that things will go wrong are slim. Right?

This talk will introduce the ways in which JWT implementations can go wrong, together with live demos, and take you on a journey to understand how to make sure you can trust these handy payloads in your applications and APIs.

Description

Who can tag me in a post? If I move this file to another folder, who now has access? If my owner breaks up with his friend, will I still get a bone?

Whether you're a human, or a dog, let's face it, authorisation is hard. Role-based access control is a great starting point but hard to scale. Attribute-based access control scales better, but neither are much good at answering more complex conditions, like whether friends-of-friends can read your posts, or knowing if your dental hygiene is going to suffer. For such situations, we generally have to wrap this up into business logic.

This is where relationship-based access control (ReBAC) comes in, offering a nuanced approach to accessing resources without codifying that into the applications.

In this session, we'll look at how to define these relationships, experience live demos, and discover how we can deploy our own fine-grained authorisation service. Expect some tail-wagging insights and a few laughs as we explore access control from a canine's point of view.

An AI agent acting on behalf of a user is just one more relationship in the graph. The same model scopes what agents can reach without inventing a new authorisation system for them.

This talk was previously titled "Fine Grained Authorisation with Relationship-Based Access Control."

Description

Your agent finally remembers things. Congratulations, now it's a data leak with a personality.

In this session the entire room gets a link to one agent, and your job is to ruin it: feed it lies, leak someone else's context, make it hold a grudge. Live, on stage, we'll watch its memory fill up, then fix each failure with the boring, fast tools that have existed for years: streams, JSON, vector search, and the most underrated feature in AI right now, expiry.

You'll leave knowing which memory an agent needs, which it must forget, and why the forgetting is where production breaks. Bring a phone and bad intentions.

Description

Most web application security advice boils down to "don't do the bad thing." But knowing the OWASP Top 10 doesn't tell you where to start when you're staring at an existing codebase with no security headers, unvalidated inputs, and CORS set to *.

This talk is the prioritised checklist I wish I'd had. I'll walk through ten concrete steps - from preventing the common vulnerabilities and hardening authentication, through API, client-side and data protection, to CI/CD security, DDoS defence and staying current - showing what the vulnerabilities actually look like when exploited, and what the fixes look like in real code. No slides full of bullet points. The talk includes live demos of the attacks and fixes in real code.

Whether you're securing an existing application or building a new one, you'll leave with a clear, ordered plan for hardening your web app - starting with the changes that have the biggest impact for the least effort.

The Ten Steps

1. Prevent Common Vulnerabilities
2. Strengthen Authentication and Session Management
3. Secure APIs and Manage Shadow APIs
4. Client-side Security
5. Data Protection and Privacy
6. Avoid Security Misconfigurations
7. Monitor, Log, and Respond to Security Incidents
8. Implement Secure Development Practices in CI/CD
9. Defend Against DDoS and Bot Attacks
10. Continuous Learning and Staying Updated

Description

When regenerating an application costs hours instead of months, the code stops being the asset. The specification becomes the asset, and the code becomes a build artifact - something you produce on demand and throw away, the way nobody keeps the output of a compiler. Software stops being a product you buy and becomes an output you commission.

This keynote makes that case from first-hand evidence. I spent twelve years at a software agency, and later rebuilt the agency's structure by accident as a set of AI agents: an interviewer, a planner, builders, and a reviewer. From there the talk tests the thesis against what others have shipped, and is honest about what does not work yet.

It lands on encouragement rather than warning. Keynote format, 30 minutes.

Description

Stop pairing with your AI and start briefing it. I gave an agent a spec and walked away: 218 commits, 334 test files, zero reverts, and a finished project inside a week. It built the wrong thing exactly as often as my spec was vague, and never otherwise.

Most developers using AI coding tools are still writing code alongside the agent - guiding it, fixing its mistakes, re-prompting when it drifts. The autonomous loop pattern flips this: you write a specification, an AI plans the work, then implements, tests, and commits each task one at a time. Fresh context every iteration. Validation gates that enforce real test coverage. If it fails, it reverts and tries again. The human writes the what. The machine handles the how.

But this only works when the specs are good. Vague acceptance criteria produce vague code. Missing edge cases become missing tests. Ambiguous data models become implementation guesswork. The spec is where quality is won or lost, and most developers have never been taught to write one.

In this talk, I'll walk through real specs that worked and real specs that failed, and share the patterns that separate specs an AI can build from and specs that waste everyone's time. The talk builds one app live, four times, from four progressively better specs.

Description

This talk is about what happens when LLM responses drive your application's behaviour - when the output gets parsed, validated, and executed by your business logic.

While building BraidFlow, a conversation orchestration tool, I discovered that the industry's documented problems aren't solved by better models or bigger context windows. Context drift in multi-turn conversations isn't just a prompt engineering challenge. It's an architectural one. Structured output reliability doesn't need JSON mode - schema field ordering and validation-driven retry logic function as instruction. And cost optimisation isn't about getting the one-shot right with the best model. Informed retry prompts with cheap models can work just as well.

I'll share the benchmarking data that surprised me, the architectural patterns I tried along the way, and the decisions that finally worked. You'll see real code and real failures.

No theory. No hand-waving. Just lessons from shipping features that had to work.

Description

Even the most carefully crafted system prompts can "go rogue," reverting to generic assistant mode or leaking hidden instructions - undermining security, consistency, and user trust. Drawing on hard-earned lessons from building a goal-oriented AI group chat platform, this session delivers:

• Multiple prompt-leakage and prompt-reversion examples showcasing real-world LLM failures
• Live demos of evaluation workflows, detecting and analysing rogue or unexpected responses in real time
• Practical security patterns for prompt engineering to mitigate leakage and fallback risks
• Techniques for adding nondeterministic evaluation tests into your deployment pipeline

This no-fluff, demo-driven talk equips engineers and security practitioners with battle-tested patterns to keep LLM-powered applications on-brand and secure. You'll leave with open-source repos, threat-model templates, and actionable takeaways to implement immediately.