AI
Speed of AI Adoption and the Fear It Creates
ChatGPT hit 100 million US users in one year. The printing press took 60 years to reach mainstream adoption; electricity and the automobile each took a few decades. That speed gap is the source of fear. Gupta compared it to the shift from horse-drawn buggies, which covered 10 to 30 miles a day, to automobiles. Nobody has a crystal ball on whether AI is a bubble or the next century-defining shift.
AI Benefits by the Numbers
Walmart projects $20 billion in added earnings from AI-optimized supply chain and inventory management. Mayo Clinic detects heart conditions without invasive procedures. MIT’s model identifies breast cancer cells five years ahead of clinical diagnosis, with a 90% survival rate at that stage. Pfizer cut one of its slowest supply chain steps by 67%, making 20,000 more vaccine doses. Blue River reduced herbicide use by 90%, which is why John Deere acquired the company.
The GenAI Agent Architecture and Where Attacks Land
GenAI agents share a common architecture: a user-facing layer, an inference mechanism (where RAG, system prompts, and web grounding run), a model layer hosting LLMs and SLMs, and an ethical/safety layer underneath. The inference mechanism holds the widest attack surface. XPIA (cross-inference prompt injection) lets attackers inject into grounding data, bypassing access controls. Inference attacks extract sensitive data the model was trained on. LLMs treat trusted and untrusted input identically, which is the core reason prompt injection remains unsolved.
Mitigating Prompt Injection and Feedback Attacks
XPIA has no complete fix today. Gupta compared the situation to XSS in the early internet: mow one patch, new grass grows next week. Mitigations include input validation, output filtering, rate limiting queries, and RBAC set strictly to user context, never root or system permissions. For feedback manipulation (attackers sending adversarial ratings to corrupt the fine-tuning loop), validate feedback before applying it, run anomaly detection on IP patterns, and put humans in the loop on model updates.
Using AI for Defense and What Comes Next
At Microsoft, when a SOC alert fires, AI pre-runs the relevant queries across 50,000 data sources so analysts arrive with data already pulled and focus on threat eviction. Just-in-time access grants the right data sources at alert time. Looking ahead: NPUs will shift inference to device edges, and SLMs will adapt with minimal training data. Agentic AI, already operating in San Francisco’s driverless cars, will act on behalf of users, which means the trust and security models being built now matter.
Notable Quotes
chat GPT in one year and that makes us Aanchal Gupta · ▶ Watch (8:01)
we were mowing lawn we would mow lawn Aanchal Gupta · ▶ Watch (21:00)
AI understands so please stop worrying Aanchal Gupta · ▶ Watch (36:59)
Key Takeaways
- ChatGPT reached 100 million users in one year, faster than any prior technology in history.
- Prompt injection (XPIA) has no complete fix; LLMs cannot distinguish trusted from untrusted input.
- Run all GenAI agents under user-level permissions only, never root or system context.
- AI pre-queries reduce SOC analyst work on 50,000-source environments before alerts reach the queue.
- Agentic AI and on-device NPUs will require entirely new trust models from security teams.
About the Speaker(s)
Aanchal Gupta is Corporate VP at Microsoft responsible for building core features for M365. Prior to that role, as Deputy CISO and CVP, she led the Microsoft Security Response Center (MSRC), a team of security experts working around the clock to protect one of the world’s largest technology platforms.