AI agents are shipping faster than security testing keeps up. Every quarter, another product team at our company (and yours) wires an LLM into a real workflow. Refunds. Expense classification. Customer support. Structured-data extraction. Reasoning over financial documents. And then they push to production.
What we test for, traditionally, is code. Unit tests, integration tests, static analysis, fuzzers, contract tests. None of that covers the actual attack surface of an LLM-powered agent, which is language itself. The exploit is not a malformed packet or a buffer overflow. It is a carefully crafted sentence.
The incidents are not edge cases. Air Canada’s chatbot invented a bereavement-fare refund policy in 2024. A passenger believed the bot. The airline did not. The Civil Resolution Tribunal of British Columbia ruled in the passenger’s favor and forced Air Canada to honor the policy its bot had hallucinated. Companies are now legally on the hook for what their AI assistants say.
Different products, different failure modes, same root cause. Nobody was systematically attacking these agents before users (or attackers) found the bugs. That is the gap we wanted to close.
Keytakeaways:
1. Why traditional security testing does not cover AI agents, and how the actual attack surface (language, not code) forces a completely different testing model. Unit tests, fuzzers, and static analysis fundamentally cannot reach where LLM exploits live.
2. A concrete, industry-standard taxonomy of AI attacks you can start using in your own product tomorrow: 7 attack vectors × 7 strategies × 36 techniques × 6 test categories, mapped to OWASP LLM Top 10, OWASP Agentic Top 10, and MITRE ATLAS. Not theory. The exact catalogue we use in production.
3. The 3-stage architecture pattern (Plan, Attack, Judge) that makes automated adversarial testing feasible, and the specific engineering decisions behind it: deterministic Python sampling instead of LLM-driven coverage, specialist attacker agents instead of one generalist, and structured-output LLM-as-Judge for reproducible verdicts.
4. How to turn adversarial testing into “Snyk for AI agents”, a fully automated CI/CD gate. The exact ~50-line YAML setup that lets any product team onboard their agent, get per-PR security scans, and receive both the finding and the auto-generated system-prompt patch as a PR comment.
5. Real war stories from building this: how our first Planner produced 22 DAN-variants out of 28 scenarios (and why LLMs cluster), the multi-turn Japanese jailbreak that would have shipped to production, the A2A protocol quirk that took three debugging sessions to solve, and the Cloudflare-vs-Cloud-Run outbound-IP battle. Practical lessons that will save you weeks.
- Date:10/10/2026
- Time:10:20
- Event:Architecting AI Agents: Security, Trust, Governance @Chennai
