Our Bay Area OWASP meetup is going hands-on, so bring your laptop! 💻
AI agents now browse, call tools, and act on our behalf. That gives attackers a whole new set of targets. Join us for a hands-on evening with KK Mookhey, founder of transilience.ai and Network Intelligence and a Black Hat USA trainer, in a free, condensed session based on his Black Hat course Adversarial AI: Red Teaming the Entire AI Supply Chain.
Special thanks to Jordan Wynne and Endor Labs for hosting the evening, sponsoring food and refreshments, and supporting the OWASP community.
5 PM Doors Open
5.30 PM :- Chapter Introductions
5.45 to 7.45 :- Workshop
Description:- LLM apps break in ways your appsec instincts half-cover and half-miss. Injection has no
parser to sanitize. Your retrieval corpus is an attack surface. The model is a confused
deputy you can talk to — and increasingly one that can act: move money, call tools, send email.
In this hands-on session you'll attack "Eiger," a deliberately vulnerable AI-first neobank,
on a hosted lab (nothing to install for the labs themselves). You'll:
- Warm up on a live prompt-injection CTF.
- Speed-map the OWASP Top 10 for LLM Applications — sorting what you already defend from
what's actually new.
- **Poison a RAG knowledge base** so that a *different* user, asking an innocent question,
gets your instructions executed in their answer — then quarantine it with one guard.
- **Poison an MCP tool description** so an agent chains an unrequested call and leaks a
customer's data — then pin the contract and scope the token to kill it.
- Watch a probe against a *real* production AI agent, live.
- **Automate the whole thing** with NVIDIA garak and Microsoft PyRIT — the CI-able,
run-it-Monday version — and leave with the starter scripts.
## Who should attend
Appsec engineers, pentesters, red-teamers, security-minded ML/platform engineers.
## What to bring
A laptop with a modern browser, a terminal, Python 3.10+, and the ability to `pip install`
(or a venv). The attack labs run against a hosted instance — nothing to install for those.
For the automation segment: `pip install garak pyrit` ahead of time saves a few minutes.
About Trainer:- KK Mookhey is the Founder of Transilience.ai and Network Intelligence, a global cybersecurity firm he established in 2001. He has also been actively sharing his knowledge through technical sessions for ISACA, ISC2, and ISSA chapters across the United States.
