We spent thirty years building security around a simple assumption: code does what it was written to do, and people do what they're authorized to do. AI agents break both halves at once. They're software that improvises, running with a human's credentials, taking instructions from whatever text happens to land in their context — a retrieved document, an API response, a ticket a stranger filed. That's not a new kind of bug. It's an old one: the insider threat, except the insider is fast, tireless, and can be convinced by a paragraph of text hidden in documents. This talk teaches the framework and then makes it concrete. We'll walk through how a real attack unfolds: untrusted content in, privileged action out. We'll also cover why the industry's instinct to filter the prompt doesn't survive contact with production. Then the useful part: the four questions that separate agent deployments that fail safely from ones that fail expensively. Who is the agent acting as? What is it allowed to touch? What happens between the decision to act and the action landing? And how would you know afterward?
Jyotirmoy Sundi is CTO and Founding Engineer at Votal AI, a runtime security platform for enterprise AI agents. He spends his time on what agents do after they leave the eval harness — agent identity, tool authorization, and the failure modes that only show up in production. Previously Principal Data Scientist at Walmart and Director of AI at Ipsy, he was selected by OpenAI for model safety red teaming and by NVIDIA for its secure AI alliance, and was named to Tradeflock's 40 Under 40 USA 2025.
