Breaking Models AI Security

The Bay Area AI Security Research Meetup returns for a focused session on OWASP LLM01:2026 — Prompt Injection.

This is the foundational risk in the OWASP Top 10 for LLM Applications, and the 2026 revision reflects a year where prompt injection moved from theoretical to operational: zero-click document-borne exfiltration against Microsoft 365 Copilot (EchoLeak, CVE-2025-32711), agent-driven destructive actions in Amazon Q (AWS-2025-015 AWS-2025-019), MCP-mediated database dumps against Supabase, indirect injection through GitHub issues against MCP-connected coding assistants, and supply-chain backdoors in packages like postmark-mcp.

We'll walk through the threat model behind these incidents — direct vs. indirect injection, trusted-surface attacks via MCP, memory and RAG corpus poisoning, multimodal and invisible-Unicode payloads, the "fun-tuning" class against closed-weight production models — and what defenses actually hold up under adaptive attack. For some prep, you can read: https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026LLM01_PromptInjection.md before the event, to get more value out of it.

Same small-group format as last time. Bring a paper you've been chewing on, a finding you're sitting on, an exploit chain you're working through, or a defense you want to pressure-test in front of people who'll push back.

The OWASP LLM01:2026 entry will be our anchor reference, but the agenda is whatever the room wants to dig into. To attend or to present a paper/project/anything related to AI security, reach out by email at [aisecurityinbay@proton.me](mailto:aisecurityinbay@proton.me).