{
  "video": {
    "id": "1tpqdglI3T0",
    "title": "Build a Platform and Watch It Burn — Michael Forrester, Accenture & Whitney Lee, Datadog",
    "duration": 3155,
    "upload_date": null,
    "channel": "AI Engineer",
    "source": "AI Engineer",
    "event_format": ""
  },
  "analysis": {
    "video_id": "1tpqdglI3T0",
    "title": "Build a Platform and Watch It Burn — Michael Forrester, Accenture & Whitney Lee, Datadog",
    "one_liner": "If you put an agent inside a Kubernetes platform, don't count on the model to refuse bad requests: layer your existing infrastructure guardrails (network policy, Kyverno admission, runtime enforcement with Falco, KubeArmor or Tetragon) under AI guardrails for input, output and MCP traffic, because a determined user eventually gets the model to do almost anything.",
    "summary": "Forrester and Lee built 'Burritobot', a burrito-ordering agent with no guardrails, on an internal developer platform (IDP) of 34 integrated components. The agent was deployed with kagent on Kubernetes, ran Claude Sonnet 4.6 on AWS Bedrock, and sat behind an LLM Guard proxy. The audience then attacked it live: deploying an image from a public registry, reading the secret recipe off the file system, and exfiltrating data. Each attack was then repeated against clusters with that defence switched on. Their argument is that about 80% of what you need is the CI/CD, SDLC and Kubernetes security practice you already have, now more important than ever. AI-specific input, output and MCP guardrails go on top, and OpenTelemetry traces capture every prompt, tool call and result.",
    "key_points": [
      "Round 1 attacks on the unguarded agent: getting it to deploy a public 'promo-mascot' image (tagged :1 to :10) and to read the 'bat spit amazing awesome sauce' recipe off the node's file system both worked. Data exfiltration to a public endpoint worked at least once in testing, then the model consistently refused, so that challenge was struck from the workshop.",
      "Naming affects model behaviour: when the images were named after villains (Joker, Megatron, Gargamel), the model inferred negative intent ('I'm not comfortable…'). Renamed to 'promo-mascot' with a marketing cover story and a ticket number, it deployed them.",
      "Infrastructure guardrails: Kubernetes network policy (at L4/L7) for egress, and Kyverno validating admission policy that requires resource requests and only allows images from the trusted internal registry. Agents can also be given an identity with SPIFFE/SPIRE so policy can be written per agent.",
      "Runtime blocking failed live, and the audience still got the recipe. Falco detects suspicious activity after the fact and Falco Talon can then kill the pod; KubeArmor (Linux Security Modules) and Tetragon (eBPF + LSM, a sibling project of Cilium) can stop a command such as `ls` before it runs. A planned fork-bomb challenge was dropped because no model would run one. The simple fix they gave for fork bombs is a kernel config limit of 1,024 PIDs per process.",
      "AI guardrails used LLM Guard through a proxy in front of kagent. The output guard scrubs sensitive terms, even mid-stream, but you still pay for the LLM call. The input guard blocks before any tokens are spent, and also keeps PII such as credit card numbers out of traces and out of compliance scope (GDPR).",
      "The MCP demo used a malicious weather tool whose description told the agent to also call read_internal_config and include its output. The agent did call it, and the Datadog traces showed it, including attempts like `cat` on secrets.",
      "The speakers say they have got the models to do 'everything we've ever wanted', usually within 20–30 prompts. The one exception was the fork bomb. Prompt-injection resistance is built into models but fails roughly 1 in 20 times.",
      "Everything is instrumented with OpenTelemetry. A single trace shows input tokens, cost, model, system prompt, available tools, tool calls and results, and it works with Datadog, Grafana, Jaeger or Zipkin."
    ],
    "takeaways": [
      "Treat your existing CI/CD, SDLC, artifact-registry and Kubernetes security practices as about 80% of agent safety. Don't give an agent direct access you wouldn't give a person.",
      "Run input guards upstream: they are cheaper and keep PII out of your traces. Add output guards as a second layer. Put plain regex filtering for known-bad patterns in the application wrapper before you call an ~8B-parameter classifier such as LLM Guard or NeMo Guardrails.",
      "Don't start enterprise MCP adoption with public MCP servers. Build your own, use a vendor, or go through an MCP registry or gateway, the same way you'd use an artifact registry rather than pulling packages straight from the internet.",
      "Check for excessive agency and credentials left lying around in agent environments. The speakers call this mostly an AAA (access, authentication, authorization) infrastructure problem, not an AI one.",
      "Before adding AI to a workflow, ask three questions: is it a bounded system (ideally with an API), is it worth the cost, and does it produce verifiable output such as Terraform or Python?"
    ],
    "topics": [
      "agent security",
      "guardrails",
      "kubernetes",
      "platform engineering",
      "mcp",
      "prompt injection",
      "observability",
      "policy as code"
    ],
    "tools": [
      "Claude Sonnet 4.6",
      "AWS Bedrock",
      "Amazon EKS",
      "kagent",
      "LLM Guard",
      "NeMo Guardrails",
      "agent gateway",
      "Kubernetes",
      "Kyverno",
      "SPIFFE/SPIRE",
      "Falco",
      "Falco Talon",
      "KubeArmor",
      "Tetragon",
      "Cilium",
      "eBPF",
      "OpenTelemetry",
      "Datadog",
      "Grafana",
      "Jaeger",
      "Zipkin",
      "Backstage",
      "Wispr Flow",
      "MCP",
      "Accenture",
      "Nvidia"
    ],
    "quotes": [
      {
        "text": "Everything you're doing in regular Kubernetes security is more important than ever now that you're letting an agent in your cluster",
        "at": "13:30",
        "url": "https://www.youtube.com/watch?v=1tpqdglI3T0&t=810s"
      },
      {
        "text": "You wouldn't let a person have direct access. Stick with your known flows.",
        "at": "15:10",
        "url": "https://www.youtube.com/watch?v=1tpqdglI3T0&t=910s"
      },
      {
        "text": "you don't want to rely on the model to not do the thing that you don't want it to do",
        "at": "36:28",
        "url": "https://www.youtube.com/watch?v=1tpqdglI3T0&t=2188s"
      },
      {
        "text": "Whitney and I have repeatedly hammered at these things and have eventually gotten the model to do everything we've ever wanted it to do.",
        "at": "43:08",
        "url": "https://www.youtube.com/watch?v=1tpqdglI3T0&t=2588s"
      }
    ],
    "words": 11558
  },
  "summary_url": "/#1tpqdglI3T0",
  "transcript": {
    "html": "/transcripts/1tpqdglI3T0.html",
    "txt": "/transcripts/1tpqdglI3T0.txt",
    "vtt": "/transcripts/1tpqdglI3T0.vtt"
  }
}