2026-09-08 –, Room 327 All times in US/Pacific
We built a burrito-ordering AI agent, put it on Kubernetes with scoped cluster access and a live terminal, and let a room of engineers try to break it. It is tons of fun.
Over three rounds they push the agent to steal customer data, deploy malicious workloads, and take the cluster down. Forkbombs anyone!
The first round has nothing protecting the agent, and it usually falls apart in about one prompt.
The second runs the same attacks against an ordinary CNCF platform floor, which blocks most of them, though a few run up a bill before they get stopped.
In the third round attendees switch on the remaining guardrails themselves and watch how the agent's behavior and its token cost change.
Running it taught us that for most shops, AI doesn't create just brand-new security problems it also makes the ones you already have more expensive. Token spend becomes its own denial-of-service vector for example. Most of what your platform already does holds up against an agent (or for an agent), and the gap that's left is smaller and stranger than people assume. This workshop covers the base guardrails as well as that enhanced gap that you must have for AI workloads.
We ran this at AI Engineer World's Fair on June 29th 2026. This version covers what held up, what broke, and what we've changed since. We have made vast improvements including model triage, provisioning and sandboxing (as an option). This will be a very evolved, much more polished, and much more expanded presentation than the one we ran at AI Engineer World's Fair. This will be much more hands-on instead of just a web interface. They will actually get access to their own cluster.
You get a Kubernetes cluster already running a full internal developer platform with 34 components. You also get an AI agent with access to that cluster and a BurritoBot Web Interface to that Agent.
Your job is to make the agent do damage. Ask it to deploy a workload the policies forbid. Ask it to give itself more permissions. Ask it to change infrastructure without going through Git. Ask it to read a secret and hand you back the value. Some of those attempts get stopped by the platform. The rest get through, until you switch on guardrails built for agents specifically.
The session runs across three clusters. The first has nothing protecting the agent: all three attacks land, a counter on screen shows the cloud bill climbing, and a fork bomb takes the cluster down. The second runs the same attacks against the platform controls, where each one is blocked by a different thing (a NetworkPolicy egress rule, a Kyverno registry allowlist, a per-pod PID limit), though the bill still moves because the request reached the model before anything stopped it. In the third you drive your own agent, switch on the agent-specific guardrails (output filtering, input filtering, tool restriction), and watch each one change the agent's behavior on the dashboard.
The part most teams miss: almost everything an agent tries against a real platform is already handled by tools you probably run today, like admission control, RBAC, and GitOps. What those tools can't see is the agent's input, its output, and the tools it's allowed to reach. That's the part agents change, and it's where this workshop spends its time. By the end of this workshop you will know what infrastructure guardrails help and where you need AI specific guardrails to fill the gaps.
You work entirely in a browser, with a chat window to your agent and a terminal to your cluster. Nothing to install.
Everything is CNCF or open source: Argo CD, Kyverno, Falco, Istio ambient, LLM Guard, agentgateway, kagent on Bedrock, and the rest of a 35-component platform.
Michael Forrester is a student, explorer, and educator working at the boundary between humanity and technology. Over 25+ years he's gone from CTO to IC across operations, AI, cloud, and platform engineering, with time at AWS, ThoughtWorks, Red Hat, and Honeywell. His training has reached over a million engineers, and he now leads AI-for-organizations work as a Principal Training Architect at Accenture LearnVantage. His current focus is agentic AI security: how the CNCF platform stack most teams already run — GitOps, admission control, runtime detection, observability — covers roughly 80% of what governs AI agents in production, and what the remaining 20% actually takes, namely agent identity, LLM input/output sanitization, and MCP tool-call governance. He speaks at KubeCon, CNCF events, and most recently AI Engineer World's Fair on Claude Code, MCP, and agent governance for platform engineers. Tools don't transform organizations. People do.
Whitney Lee is a creator and systems thinker who explores how observability, AI, and platform engineering connect across the cloud native ecosystem. She brings humor, depth, and clarity to complex technologies while building original frameworks that help others understand how systems fit together. She runs a vibrant YouTube channel, hosts Datadog Illuminated and Software Defined Interviews, has delivered two KubeCon keynotes and countless breakout talks, and combines storytelling and technical rigor to illuminate the human side of cloud native engineering.