Breaking Models 🚨AI Security

Part 1 LLM02: Sensitive Information Disclosure (finishing it)

The stuff AI apps leak: API keys, customer records, system prompts, other people’s conversations. This category sat at #6 on the original OWASP Top 10 for LLMs. In the 2026 update it jumped to #2, right behind prompt injection. We’ll walk through how these leaks actually happen, most of them need no jailbreak, just normal usage, and what actually stops them.

Part 2 Live demo: removing safety, not bypassing it

Every jailbreak demo you’ve seen changes the prompt. This one changes the model.

We’ll take an open-weights model that refuses, then pull a variant off HuggingFace where the refusal behaviour has been stripped out at the weights level. Same prompt, same model family, different answer, zero prompt engineering. We’ll cover why this works (refusal is largely a single direction in activation space), and the harder question: if this is one ollama pull away, was alignment ever a security control?

Part 3 Design exercise: build a secure agentic system

The one we owe you from last time. Instead of only talking about broken systems, we design one that isn’t. Together we’ll threat model an agentic AI app, where it can leak, where it can be hijacked, and then sketch a secure architecture for it. You do the practical design, not just the listening.

Talk, then demo, then the exercise, then open floor. No vendor pitches. Beginners welcome!

📩 RSVP (or to present at a future session): aisecurityinbay@proton.me

📅 23 August · 2:30pm – 4:30pm

📍 Hacker Dojo, Mountain View