ECS 2027

31/05/2027, Congress Center Düsseldorf
Düsseldorf, Germany

Security Thinking for RAG and AI Agents

A model that answers correctly is not necessarily a system that behaves safely. As we progress from chatbots to RAG, tool-using agents and multi-agent systems, every new input and capability expands the attack surface. Security depends on what the complete system can see, what it can do and who can influence either. In this architecture-focused session, you will learn to treat context as part of the control flow, distinguish direct from indirect prompt injection and use a practical SEE × DO model to find where untrusted content meets real-world capability. We will climb the capability ladder from chatbots through RAG, tools, memory and multi-agent communication, then threat-model an inbox assistant to trace an attack from a malicious message to a consequential action. Leave with six design principles and five questions for assessing any AI solution before it reaches production. Build systems that remain survivable when the model is misled, not systems that are safe only while the model behaves perfectly.