2026-10-30 –, Main Hall
Getting an LLM to spill its secrets is a subtle artform, part social engineering of the application, and part social engineering of the humans (and other LLMs) who built it. It's witchy magic that's both gentle and assertive: you ask nicely to stay under the abuse radar, then tell the bot to step outside its role entirely.
In this talk I'll walk through what I've learned testing LLMs across chatbots, lifestyle assistants, and enterprise tools - from leaking system prompts and hunting indirect, no-authentication prompt injection, to chaining an AI's own "legitimate" tools into something destructive. I'll cover real attacks like using the AI's own tools to ransom a company, turning connected integrations into exfiltration channels, and the crossover where this all starts to look a lot like traditional web application testing. They told us SQL injection was dead, and we just reimagined it, gave it a new name, and pointed it at the model.
Expect practical techniques, a healthy respect for how confidently these systems lie, and a reminder that organisations need people who think this way because people with worse intentions are already doing it.
Modern LLM deployments aren't risky because of the model - they're risky because of what the model is connected to and how we try to put guardrails around them. You no longer have to imagine a machine with agency over your emails, calendars, Slack, Jira, Confluence, and GitHub because we already live in that reality. I explore how these systems delight users with unexpected solutions, and how users become comfortable (or fatigued) with giving more and more access. The moment a system can read untrusted content, access private data, and communicate externally, you've got indirect prompt injection as a feature no matter how well-aligned the model is. I'll walk through how malicious instructions get in and how stolen data gets out through those same integrations.
Then we'll get to the part I find most interesting: you often don't need to make the model do anything obviously malicious. Each legitimate tool an LLM has like a code execution sandbox, file access, crypto functions, and web requests become the capabilities we take advantage of. Chain them in the right order and you get outcomes the developers never imagined. I'll cover sequential tool-chaining attacks, where individually harmless steps add up to data held hostage.
I'll also spend time on the things that make this work in practice. Why a prompt that fails ninety-nine times succeeds on the hundredth, is still a vulnerability. And why you should treat everything a bot tells you about itself as a lead, never a fact, because LLMs "hallucinate" information about themselves, and lie with total confidence.
You'll leave with concrete testing and design techniques you can use the next time you're handed an AI-powered application and asked whether it's safe.
Yianna Paris is an Australian-born security researcher now causing trouble as a Senior Offensive Security Consultant at Xebia in the Netherlands. She recently founded her training and research consultancy, Luda Hex. Her experience has spanned from deeply technical, high performing engineering companies to working for checkbox-compliance leadership. She breaks things professionally, from web apps, infrastructure, the architecture behind them, and increasingly the AI-powered systems everyone's bolting on without reading the manual. Her work spans penetration testing, secure coding, hardware and RF hacking, and the OSINT legwork of figuring out what an organisation actually runs versus what it thinks it runs (the two are rarely the same).
She's a DEFCON and Xebia Academy trainer, volunteer teaching kids to code, crafter and loves spending time in her garden. Having made the move from apologetic Aussie to we-say-what-we-mean Dutch directness, she's well-practised at pushing back, both on systems, and on the humans who built them.