Jayesh Ahire

Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.

An AI agent is rarely just a model and a prompt. It is the code in a repository, the skills installed on a developer’s laptop, the MCP servers it trusts, the credentials inherited from the user, and the actions it can take at runtime.

Security teams currently inspect these as separate problems. The dangerous behavior often exists between them.

In this live session, we use g0, an open-source, local-first security toolkit, to background-check a deliberately vulnerable agent environment. We begin with a developer machine containing a poisoned skill, an unsafe MCP configuration, and an agent repository with a cross-file data leak. g0 discovers the components, builds an Agent Graph connecting prompts, models, tools and data flows, and evaluates them against 1,128 rules across 12 security domains.

We then move from assessment to attack. An approved MCP tool changes its description and attempts to move seeded sensitive data from one tool response into another tool request. Individually, each call looks reasonable. The composed effect is not.

Finally, we apply g0’s runtime guardrails and repeat the attack. The proxy detects tool-definition drift, tracks sensitive data across tool calls, and applies a graduated allow, alert, coach, redact or deny decision. We finish by generating a signed CycloneDX AI-BOM and evidence pack.

The objective is not to produce another wall of findings. It is to show one complete path from discovering an agent to understanding, constraining and proving what it can do.