Manu
CV
← Events

Attendee 14 Oct 2026 · Paris, aboard a barge on the Seine

Paris AI Security

TrackIt × AWS

Event badge: AI Security Paris, TrackIt × AWS, 14 October 2026Expert panel with Sylvain Merle (BCE, RTL Group), Inès Besbes (Seedext) and Thierry Pierre (AWS)Slide: OWASP Top 10 for LLM applications next to the OWASP Top 10 for agentic applicationsSlide: indirect prompt injection through a discovery tool result that tells the helper bot to delete teams and membersSlide: design assuming prompt injection will succeed; zero trust, least privilege, defense in depthSlide: capture-the-flag exercise, convince the Nova support bot to grant administrator access
What I kept
AI is an enabler, not an end goal. The real impact comes from rethinking business processes, not from bolting models onto legacy workflows. And there is no ROI without adoption: the most valuable use cases come straight from frontline teams, who know the operational context.
What I challenge
The bottom-up dilemma. Starting from the field is vital, but without a clear Zero Trust security framework from day one, grassroots adoption inevitably opens the door to Shadow AI.
What it changed
My takeaway: redesign the workflow first, then decide where AI fits in it, instead of adding a model on top of the existing process.

Afternoon on securing AI-powered applications, run by TrackIt with AWS aboard a barge in Paris: a walkthrough of the OWASP Top 10 for LLM applications and its agentic counterpart, a hands-on capture-the-flag workshop against deliberately vulnerable support bots, defense principles, then an expert panel with Sylvain Merle (CTO, BCE, RTL Group), Inès Besbes (CEO, Seedext) and Thierry Pierre (Principal AI & ML Specialist, AWS).

What the workshop showed

  • Indirect prompt injection. The attack does not come from the user: a tool result (here, a team description returned by a discovery tool) carries the instruction, and the bot executes it with the operator’s rights.
  • Design assuming injection succeeds. The LLM is a confused deputy. The controls that hold are outside the model: treat its inputs and outputs as untrusted, give it the minimum permissions, layer independent defenses.