Blast Radius for AI Agents: Containment When Prompt Filters Fail
Park Plaza Victoria, London · 7–8 September 2026 · Amine Raji, Molntek
Every prompt filter is a detection control on an input you do not control, and detection controls on untrusted input have a known failure mode. This talk argues the case for treating an AI agent as a workload with credentials rather than a model with a safety problem, and shows what that means concretely on cloud infrastructure: identity, scoping, segmentation and approval gates, applied to a system that happens to reason in natural language. The attacks are new. The controls that survive contact are ones your cloud security programme already knows how to enforce.
Material from the talk
Slides and the demo go up here right after the session, and the full write-up follows a couple of weeks later. This page is the permanent home for both, so the link on the last slide keeps working.
Three things to do on Monday
If you take nothing else from the session, take these.
- 1
Give every agent its own identity. Agents inheriting a human's or a service's credentials is the single most common finding, and it makes blast radius impossible to reason about.
- 2
Decide what the agent may do when, not what it may read. Egress and action scoping survive prompt injection; input filtering does not.
- 3
Log the tool calls, not the prompts. The prompts are noise; the calls are the audit trail you will want during an incident.
Score your own agents, free
The Agent Security Scorecard asks the same questions I use in a paid review and gives you a gap list in the browser. No login, no email, nothing to install. It is the fastest way to find out whether what you just heard applies to you.
Open the Scorecard →If you want this run against your own system
That is what I do for a living. The two-day AI Security Sprint is €3,500 and answers one question properly: where the real exposure sits in the system you are least sure about. Prices for everything else are on the services page, and I would rather tell you on a call that you do not need me than sell you something you do not.