Amber Bennoui
AI Security Researcher
Jiffy Labs
Amber Bennoui is an AI and cybersecurity product leader with 15+ years of experience across companies including F5 Networks, Datadog, Chainguard and DataRobot. She co-founded the AI Security Alliance (AISECA), Middle Easterners and Africans Cybersecurity Syndicate and conducts ongoing research into AI supply chain security with Jiffy Labs.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Weapons of Mass Instruction: A Systematization of Knowledge (SoK) on Malicious Attacks on Agentic AI Systems
Agentic AI systems composed of LLMs extended with tools, memory, retrieval, code execution, browser control, and multi-agent coordination are being deployed faster than anyone can threat-model them. Every new capability is also an injection path: a deceptive MCP tool description, a booby-trapped skill file, or a corrupted memory entry can hijack planning, trigger unauthorized tool calls, exfiltrate data, or persist silently across sessions.This session presents the first cross-mechanism systematization of malicious attacks on agentic AI. Jiffy Labs screened 186 sources, peer-reviewed research, platform advisories, and in-the-wild incident reports, and coded 396 attack-evidence records and 349 safeguard records into 26 normalized attack vectors across eight classes: prompt injection and action hijacking; tool, MCP, and action-layer attacks; memory and RAG poisoning; multi-agent attacks; backdoors and persistent compromise; computer-use, browser, and coding-agent attacks; agent skills and supply chain; and cross-cutting goal manipulation.The session walks through the attack lifecycle from insertion to activation, persistence, and propagation, and the seven recurring patterns that make these attacks work: including instruction-data confusion, delayed activation, and metadata abuse. We then map eight defense families against the attack classes, showing where prompt guards, scanners, sandboxing, provenance, and least privilege actually hold, and where 25 high-priority gaps remain: sleeper triggers, mutable dependencies, multi-agent propagation, and post-compromise recovery.Attendees leave with a practical, evidence-graded taxonomy for threat-modeling agentic deployments and prioritizing defenses before attackers exploit the gaps.
- 17:20
- Tue
- 01 Dec
Stage:
Briefing Stage 1
Sessions Type:
Keynote