AI
Why Prompt Injection Overfocus Is a Failure Mode
McCoy said spending 90% of security budget on prompt injection is a mistake. Attackers can use valid emails with embedded payloads to bypass regex filters. He demonstrated a valid email that base64-encodes a “talk like a pirate” instruction. The email passed regex but triggered unintended LLM behavior. The solution: parameterize inputs, treat every variable as a separate typed object, and sanitize each field individually.
Guard Models: Free Input and Output Sanitization
Guard models are small classifiers that return yes/no on safety. Llama Guard (8B parameters), IBM Granite (8B), and GPT-Oss (120B) are free open-source models. They can enforce complex policy documents. Deploy them at the orchestrator to sanitize ingress and egress. They take text in, output only safe/dangerous, reducing attack surface. McCoy recommended using different guard models for input and output to catch injection on both directions.
Data Lakes: The Most Dangerous Spot in Agentic Systems
McCoy said data lakes are where worst breaches happen. He recommended treating every connection to the data lake as publicly exposed. Never allow direct access; use a DMZ for each business unit. Security engineers should write all queries and move data from production to development DMZ. Split data lakes into agentic vs. classic, active vs. static. He called data lake exposure 50% of the security problem for agentic futures.
Security Controls Need Owners and Lifecycles
McCoy advised assigning an owner to every security control (WAF, RAG sanitization, guard models) and planning their maintenance cost. A four-person team cannot maintain 30 controls. He recommended prescriptive controls, knowing when to retire them. Treat injection at the gateway as normal; injection at internal systems as active breach. Automate kill switches for attacks that should never reach backend layers.
Notable Quotes
It’s kind of a failure mode to spend 90% of your security just on prompt injection. Jon Mccoy · ▶ Watch (5:03)
This is your most dangerous spot from my years in security engineering. This is where you’re going to suffer one of your worst breaches. Jon Mccoy · ▶ Watch (23:14)
Encrypted key signing, encryption key material. If you encrypt something and it gets to the wrong agent, the agent can’t deep fake the key. Jon Mccoy · ▶ Watch (17:27)
I would say this is 50% of the security problems that I think I would prioritize as a security engineer going into this agentic future. Jon Mccoy · ▶ Watch (26:15)
Key Takeaways
- Overfocusing on prompt injection wastes resources; prioritize broader injection controls.
- Guard models like Llama Guard provide free, policy-based input/output sanitization.
- Data lake direct access is a top risk; use DMZs and let security write queries.
About the Speaker(s)
Jon Mccoy brings over 20 years of experience in software development and cybersecurity to the forefront. With a strong foundation in .NET development, Jon transitioned into security, driven by a passion for proactive defense strategies and secure coding practices.
A dedicated contributor to the OWASP community, Jon has shared his expertise at numerous industry events, including OWASP Global AppSec. His recent presentation on “Lessons Learned from Past Security Breaches” highlighted critical takeaways for strengthening AppSec efforts before and after incidents.
Jon’s extensive work spans traditional application security, AI, blockchain security, and developer education. His mission is to unite development and security teams, empowering organizations to build resilient systems from the ground up. Through his talks, Jon provides actionable insights and real-world examples, inspiring attendees to adopt a more proactive approach to security.
Jon McCoy is committed to advancing the field of application security and promoting collaboration between developers and security professionals.