Michael Forrester
Michael Forrester is a student, explorer, and educator working at the boundary between humanity and technology. Over 25+ years he's gone from CTO to IC across operations, AI, cloud, and platform engineering, with time at AWS, ThoughtWorks, Red Hat, and Honeywell. His training has reached over a million engineers, and he now leads AI-for-organizations work as a Principal Training Architect at Accenture LearnVantage. His current focus is agentic AI security: how the CNCF platform stack most teams already run — GitOps, admission control, runtime detection, observability — covers roughly 80% of what governs AI agents in production, and what the remaining 20% actually takes, namely agent identity, LLM input/output sanitization, and MCP tool-call governance. He speaks at KubeCon, CNCF events, and most recently AI Engineer World's Fair on Claude Code, MCP, and agent governance for platform engineers. Tools don't transform organizations. People do.
Sessions
We built a burrito-ordering AI agent, put it on Kubernetes with scoped cluster access and a live terminal, and let a room of engineers try to break it. It is tons of fun.
Over three rounds they push the agent to steal customer data, deploy malicious workloads, and take the cluster down. Forkbombs anyone!
The first round has nothing protecting the agent, and it usually falls apart in about one prompt.
The second runs the same attacks against an ordinary CNCF platform floor, which blocks most of them, though a few run up a bill before they get stopped.
In the third round attendees switch on the remaining guardrails themselves and watch how the agent's behavior and its token cost change.
Running it taught us that for most shops, AI doesn't create just brand-new security problems it also makes the ones you already have more expensive. Token spend becomes its own denial-of-service vector for example. Most of what your platform already does holds up against an agent (or for an agent), and the gap that's left is smaller and stranger than people assume. This workshop covers the base guardrails as well as that enhanced gap that you must have for AI workloads.
We ran this at AI Engineer World's Fair on June 29th 2026. This version covers what held up, what broke, and what we've changed since. We have made vast improvements including model triage, provisioning and sandboxing (as an option). This will be a very evolved, much more polished, and much more expanded presentation than the one we ran at AI Engineer World's Fair. This will be much more hands-on instead of just a web interface. They will actually get access to their own cluster.
"You have full access to the pipeline. Do what you need to do." Famous last words.
I gave Claude Code full pipeline access and stepped away for thirty seconds. It wrecked the Kubernetes cluster, and two troubleshooting sessions later, while it was supposedly helping me recover, it took out the network cards on nearly every Linux box we had. I thought that was as bad as it got. Then came the 2026 edition, when it deleted 250 clusters.
This is the five-minute, twenty-slide version of that spiral: how "let me help" becomes "I've destroyed your cluster," why "the AI knows what it's doing" is the most dangerous phrase in DevOps, and the guardrails I now enforce religiously so a thirty-second walk away can't take down a fleet. Come for the disaster, stay for the wisdom.