Red-Team Your Own AI Pipeline: A Hands-On Prompt-Injection & Supply-Chain Lab
Framing (10 min). The trust boundary: an autonomous agent with repo/CI access is a new privileged user that reads attacker-controlled text. The "assume the agent is compromised" premise.
Station 1 — Inject the reviewer (15 min). Plant a payload in a PR body and in an agent-instruction file; watch a review agent act on it. Then apply an injection-resistant prompt + input isolation and confirm the payload no longer fires.
Station 2 — Adversarial-validate a plan (15 min). Run an AI adversarial-review pass against a deliberately over-scoped sample supply-chain engagement and watch it surface the unsafe steps a human plan-author missed.
Station 3 — Bound the blast radius (15 min). Apply the defensive checklist — no-write tokens, action allowlists, spend/scope caps, monitoring — and re-run Station 1's attack against the hardened pipeline.
Debrief (5 min). Mapping the lab back to your real CI; what to do Monday morning.
Speakers: Gustavo Dutra
Track: Security
