Greetings,
Connecting AI to private data is fundamentally dangerous. But too few people really understand the depth of the problem. Some of us that have been in security for awhile are suspicious, probably, but many of us use these tools anyway. If you aren't, you'll be left behind. How you use them and what you connect them to is the hard part.
I just got back from talking at DEF CON and BSidesLV about a new and insidious kind of attack that poisons agent memory using what I call "prompt laundering." An attacker, just by sending emails (or any source of untrusted content that flows to an agentic system), can escalate from unprivileged text to a fully trusted context that can exfiltrate your data. And it isn't even that difficult (see my latest blog for details on how the attack works).
This is why it galls me that people aren't taking the data security side of AI and agentic systems seriously enough. The controls are overall too few and too feeble while the surface area for attacks is nearly infinite. That's why we created VectorLens: in part so people could better understand where they have sensitive data replicating in these systems.
BSides restored my faith in the security industry. At the RSA conference, AI baloney was overrunning the whole place, but very little of it was meaningful. BSides was refreshing by comparison with straightforward and meaningful talks.
As summer comes to an end, and planning for next year slowly comes into focus, it's worth thinking beyond AI-powered features and services to a critically important question: how will you secure your shiny new AI and the data that intersects with it?
Best wishes,
..Patrick
