Javier Garza surveys risks including prompt injection, sensitive-data exposure, poisoned dependencies, unsafe outputs and excessive agency. A training chatbot illustrates how instructions can conflict, while indirect-injection examples show why outside content must not become trusted commands. Prompts and sanitization are presented as parts of a defense, not proof that injection has been eliminated.
Javier Garza describes shadow AI as organizational use that existing controls and inventories may not see. An AI bill of materials expands the inventory beyond conventional packages to models, datasets, agents and their connections. The narrated scan and dashboard demonstrate component discovery and issue triage, while education and usable approved alternatives are proposed to reduce workarounds.
Javier Garza applies threat modeling to architecture, data flows, assets and trust boundaries before moving into skills and MCP servers. He distinguishes scanning tool definitions for poisoning from examining executable code for defects such as command injection and path traversal. Popularity, a familiar publisher or a previously clean version is not presented as sufficient evidence that a dependency remains safe.
Javier Garza outlines a development workflow with security-focused requirements, separated environments, narrow permissions, monitoring and review before consequential actions. He discusses hallucinated package names and malicious lookalikes, and proposes scan-fix-rescan hooks for generated code. The final segment briefly addresses offensive use of similar agent tooling; the recording is an overview, not a validated security assessment or a complete hands-on red-team exercise.
Watch on YouTube
