--- schema: 1 type: video title: 'AI Security Engineer Foundations + Certificate — Javier Garza, Snyk' description: >- An AI bill of materials turns a repository into a searchable inventory of models, datasets and agents. Javier Garza demonstrates the workflow from a CLI scan to a visual dashboard, then asks it which models the project uses. That inventory anchors a broader security problem: teams cannot assess the AI components they do not know are there. The workshop connects shadow AI to prompt injection, supply chain risk, sensitive information disclosure and excessive agency, using Gandalf challenges and malicious instructions embedded in external content to show how an application's intended rules can be bypassed. Garza works through defenses at several layers. A database view can restrict what an assistant is allowed to retrieve; limited permissions, output validation and human approval constrain what it can do next. Threat modeling maps assets, trust boundaries and possible attacks before deployment, with an intentionally vulnerable student assistant offered for practice. For skills and MCP servers, he separates scanning tool definitions for hidden instructions from scanning the underlying code for vulnerabilities, then explains a scan, fix and rescan loop driven by coding agent rules and hooks. The final sections examine secure prompting, dependency verification, separate development and production environments, IDE configuration and developer review. Governance depends on explaining guardrails as well as enforcing them, because unexplained restrictions invite workarounds. He closes with offensive agent workflows, training resources and challenges that let participants test these ideas themselves. Speaker info: - https://www.linkedin.com/in/jjgarza - https://twitter.com/jjaviergarza - https://snyk.io/lp/ai-sec-eng-foundations/ - https://github.com/snyk-workshops/vulnerable-student-assistant Timestamps: 0:00 - Workshop overview 2:16 - Meet Javier Garza 5:30 - OWASP risks for LLM applications 6:42 - Prompt injection and Gandalf 9:01 - Indirect injection through external content 12:02 - Sensitive information disclosure 15:32 - Restrict database access 18:18 - Supply chain risks 23:14 - Poisoning and AI component inventories 24:11 - Output handling and excessive agency 27:26 - Prompt leakage and vector weaknesses 29:04 - Resource consumption and training modules 31:07 - Shadow AI and unsanctioned tools 36:06 - AI bills of materials 38:32 - Inventory a repository from the CLI 41:30 - Explore the inventory dashboard 44:57 - Threat modeling foundations 49:35 - Probabilistic systems and new boundaries 53:03 - MITRE ATLAS and AI threat mapping 56:16 - Discover assets and prioritize threats 59:12 - Vulnerable student assistant practice app 1:00:11 - Bring threat modeling into development 1:04:17 - Securing agent skills and MCP servers 1:09:12 - Tool poisoning and hidden instructions 1:11:24 - Agent scans and code scans 1:14:59 - Command injection and input validation 1:16:24 - Scan, fix, and rescan with rules and hooks 1:21:10 - Secure vibe coding 1:30:19 - Prompting and technology choices 1:40:32 - Secure prompts and environment boundaries 1:43:19 - Hallucinated dependencies and supply chains 1:47:39 - Harden IDE and CLI configuration 1:49:02 - Developer review and security culture 1:51:15 - Organization policies and governance 1:53:22 - Offensive agent workflows 1:55:38 - Training, certificates, and challenges --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/ZyC56eV8sVw-youtube-3a82806d7ece19b16be2 Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- canonical: 'https://liquidgold.cc/watch/ZyC56eV8sVw' markdown: 'https://liquidgold.cc/watch/ZyC56eV8sVw.md' llms: 'https://liquidgold.cc/watch/ZyC56eV8sVw/llms.txt' parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-23T22:19:09.942Z' language: null children: [] videoId: ZyC56eV8sVw durationSeconds: 7054 publishedAt: '2026-10-11T19:30:16.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 350 endSeconds: 407 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=350' heldReason: rights - ordinal: 1 text: null startSeconds: 418 endSeconds: 543 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=418' heldReason: rights - ordinal: 2 text: null startSeconds: 555 endSeconds: 722 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=555' heldReason: rights - ordinal: 3 text: null startSeconds: 555 endSeconds: 722 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=555' heldReason: rights - ordinal: 4 text: null startSeconds: 948 endSeconds: 1105 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=948' heldReason: rights - ordinal: 5 text: null startSeconds: 1115 endSeconds: 1394 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=1115' heldReason: rights - ordinal: 6 text: null startSeconds: 1115 endSeconds: 1394 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=1115' heldReason: rights - ordinal: 7 text: null startSeconds: 1405 endSeconds: 1454 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=1405' heldReason: rights - ordinal: 8 text: null startSeconds: 1465 endSeconds: 1652 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=1465' heldReason: rights - ordinal: 9 text: null startSeconds: 1879 endSeconds: 2007 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=1879' heldReason: rights - ordinal: 10 text: null startSeconds: 2140 endSeconds: 2151 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=2140' heldReason: rights - ordinal: 11 text: null startSeconds: 2189 endSeconds: 2321 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=2189' heldReason: rights - ordinal: 12 text: null startSeconds: 2341 endSeconds: 2497 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=2341' heldReason: rights - ordinal: 13 text: null startSeconds: 2508 endSeconds: 2697 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=2508' heldReason: rights - ordinal: 14 text: null startSeconds: 2709 endSeconds: 2984 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=2709' heldReason: rights - ordinal: 15 text: null startSeconds: 2994 endSeconds: 3194 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=2994' heldReason: rights - ordinal: 16 text: null startSeconds: 3204 endSeconds: 3382 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=3204' heldReason: rights - ordinal: 17 text: null startSeconds: 3392 endSeconds: 3556 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=3392' heldReason: rights - ordinal: 18 text: null startSeconds: 3627 endSeconds: 3857 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=3627' heldReason: rights - ordinal: 19 text: null startSeconds: 3868 endSeconds: 4155 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=3868' heldReason: rights - ordinal: 20 text: null startSeconds: 4167 endSeconds: 4284 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=4167' heldReason: rights - ordinal: 21 text: null startSeconds: 4516 endSeconds: 4588 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=4516' heldReason: rights - ordinal: 22 text: null startSeconds: 4588 endSeconds: 4598 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=4588' heldReason: rights - ordinal: 23 text: null startSeconds: 4598 endSeconds: 4876 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=4598' heldReason: rights - ordinal: 24 text: null startSeconds: 4886 endSeconds: 4990 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=4886' heldReason: rights - ordinal: 25 text: null startSeconds: 5003 endSeconds: 5095 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=5003' heldReason: rights - ordinal: 26 text: null startSeconds: 5106 endSeconds: 5208 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=5106' heldReason: rights - ordinal: 27 text: null startSeconds: 5219 endSeconds: 5304 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=5219' heldReason: rights - ordinal: 28 text: null startSeconds: 5316 endSeconds: 5429 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=5316' heldReason: rights - ordinal: 29 text: null startSeconds: 5440 endSeconds: 5553 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=5440' heldReason: rights - ordinal: 30 text: null startSeconds: 5565 endSeconds: 5650 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=5565' heldReason: rights - ordinal: 31 text: null startSeconds: 5663 endSeconds: 5770 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=5663' heldReason: rights - ordinal: 32 text: null startSeconds: 5885 endSeconds: 5896 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=5885' heldReason: rights - ordinal: 33 text: null startSeconds: 6046 endSeconds: 6209 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=6046' heldReason: rights - ordinal: 34 text: null startSeconds: 6220 endSeconds: 6465 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=6220' heldReason: rights - ordinal: 35 text: null startSeconds: 6476 endSeconds: 6542 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=6476' heldReason: rights - ordinal: 36 text: null startSeconds: 6554 endSeconds: 6675 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=6554' heldReason: rights - ordinal: 37 text: null startSeconds: 6688 endSeconds: 6804 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=6688' heldReason: rights - ordinal: 38 text: null startSeconds: 6815 endSeconds: 6938 watch: 'https://liquidgold.cc/watch/ZyC56eV8sVw?t=6815' heldReason: rights --- # AI Security Engineer Foundations + Certificate — Javier Garza, Snyk An AI bill of materials turns a repository into a searchable inventory of models, datasets and agents. Javier Garza demonstrates the workflow from a CLI scan to a visual dashboard, then asks it which models the project uses. That inventory anchors a broader security problem: teams cannot assess the AI components they do not know are there. The workshop connects shadow AI to prompt injection, supply chain risk, sensitive information disclosure and excessive agency, using Gandalf challenges and malicious instructions embedded in external content to show how an application's intended rules can be bypassed. Garza works through defenses at several layers. A database view can restrict what an assistant is allowed to retrieve; limited permissions, output validation and human approval constrain what it can do next. Threat modeling maps assets, trust boundaries and possible attacks before deployment, with an intentionally vulnerable student assistant offered for practice. For skills and MCP servers, he separates scanning tool definitions for hidden instructions from scanning the underlying code for vulnerabilities, then explains a scan, fix and rescan loop driven by coding agent rules and hooks. The final sections examine secure prompting, dependency verification, separate development and production environments, IDE configuration and developer review. Governance depends on explaining guardrails as well as enforcing them, because unexplained restrictions invite workarounds. He closes with offensive agent workflows, training resources and challenges that let participants test these ideas themselves. Speaker info: - https://www.linkedin.com/in/jjgarza - https://twitter.com/jjaviergarza - https://snyk.io/lp/ai-sec-eng-foundations/ - https://github.com/snyk-workshops/vulnerable-student-assistant Timestamps: 0:00 - Workshop overview 2:16 - Meet Javier Garza 5:30 - OWASP risks for LLM applications 6:42 - Prompt injection and Gandalf 9:01 - Indirect injection through external content 12:02 - Sensitive information disclosure 15:32 - Restrict database access 18:18 - Supply chain risks 23:14 - Poisoning and AI component inventories 24:11 - Output handling and excessive agency 27:26 - Prompt leakage and vector weaknesses 29:04 - Resource consumption and training modules 31:07 - Shadow AI and unsanctioned tools 36:06 - AI bills of materials 38:32 - Inventory a repository from the CLI 41:30 - Explore the inventory dashboard 44:57 - Threat modeling foundations 49:35 - Probabilistic systems and new boundaries 53:03 - MITRE ATLAS and AI threat mapping 56:16 - Discover assets and prioritize threats 59:12 - Vulnerable student assistant practice app 1:00:11 - Bring threat modeling into development 1:04:17 - Securing agent skills and MCP servers 1:09:12 - Tool poisoning and hidden instructions 1:11:24 - Agent scans and code scans 1:14:59 - Command injection and input validation 1:16:24 - Scan, fix, and rescan with rules and hooks 1:21:10 - Secure vibe coding 1:30:19 - Prompting and technology choices 1:40:32 - Secure prompts and environment boundaries 1:43:19 - Hallucinated dependencies and supply chains 1:47:39 - Harden IDE and CLI configuration 1:49:02 - Developer review and security culture 1:51:15 - Organization policies and governance 1:53:22 - Offensive agent workflows 1:55:38 - Training, certificates, and challenges --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/ZyC56eV8sVw-youtube-3a82806d7ece19b16be2 Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- Canonical: https://liquidgold.cc/watch/ZyC56eV8sVw · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.