Cloud Native Thane - August Meetup

Every useful AI agent has three things at once: it can read private data, it reads text written by people outside your company, and it can send data back out. That combination is called the lethal trifecta, and in 2026 it stopped being theory. Microsoft Copilot was attacked through an email that nobody had to click, where hidden instructions made the assistant collect files from OneDrive, SharePoint and Teams and send them out through a trusted Microsoft domain. Gemini Enterprise was attacked through its own search index, and in a single week in January 2026 four production AI products were broken in the same way. I build AI features in an ERP product, and our agent has all three of these properties by design, because it reads customer transaction data, it takes in uploaded documents and chat messages written by strangers, and it posts to Slack, writes files and creates calendar entries. If you remove any one of them, there is no product left. So this talk is not about stopping prompt injection, because the research this year is clear that attackers get past almost every published defence. It is about containment, which means assuming the model will be fooled at some point and making sure nothing serious happens when it is. I will walk through the controls we run today: limiting what each tool can reach, applying company and permission filters in the backend instead of trusting the model to apply them, keeping the step that reads untrusted content separate from the step allowed to take action, and treating every outgoing call as a possible leak that needs an allow list. I will connect these to where the industry has landed, such as default deny egress, sandboxed agent execution, and short lived permissions instead of permanent access. I will also cover the tools themselves, since over 800 malicious agent skills were found on one public marketplace this year and more than thirty security issues were filed against MCP servers and clients in two months. The talk ends with one question you can answer before writing any code: which of these three capabilities does your agent actually need, and what limits the damage when it goes wrong?