Secrets, Sandboxes and Untrusted Tool Calls

Proposed by Marcus Lindgren · Ironvale

Pending

Decision

This proposal is waiting on you.

Proposal

A threat model for agent tooling, with concrete isolation techniques and a live demonstration of three ways the naive design leaks credentials.

Agents & ToolingTalkAdvanced

Security

Speaker

People attached to this proposal. Accepting copies them onto the session and assigns their onboarding tasks.

Marcus LindgrenSpeakerPrimary contact

Marcus does application security for AI systems: untrusted tool calls, sandbox escapes, and the prompt injection you have not thought of yet.

Application answers

Everything the speaker filled in on the call-for-papers form.

Talk title: Secrets, Sandboxes and Untrusted Tool Calls
Abstract: A threat model for agent tooling, with concrete isolation techniques and a live demonstration of three ways the naive design leaks credentials.
Track(s): Agents & Tooling
Session format: Talk (25 min)
Audience level: Advanced
Have you presented this talk before?: Yes
Where and when did you present it, and what changed since?: Presented an earlier version at a regional meetup last autumn. This version adds nine months of production data and drops the speculative section.
Do you need travel support to attend?: No
Speaker biography: Marcus does application security for AI systems: untrusted tool calls, sandbox escapes, and the prompt injection you have not thought of yet.

Reviewers

Assign this proposal to a specific reviewer, on top of whoever already gets it through their tracks.

Reviews

2 reviews from the programme committee.

2.5 / 5average from 2 scores

Tomas Kalb2.0 / 5Deny4 Aug 2026
Too close to a product pitch for this track, and the outline has no specifics.
Ada Nwosu3.0 / 5Maybe21 Jul 2026
Overlaps with two other proposals in this track. Good talk, question is whether we need all three.

Details

FormatTalk

Audience levelAdvanced

Submitted19 Jun 2026 at 22:30

Decision recorded—

FormDevFlow Conf 2027 — Call for Speakers