AI Engineer Conference: Michael Forrester and Whitney Lee Demonstrate Agent Security Boundaries with Burrito Bot Attack
In a workshop at the AI Engineer Conference, Michael Forrester (Accenture) and Whitney Lee (Datadog) used a deliberately vulnerable 'burrito ordering' AI agent to demonstrate how excessive agency allows attackers to access sensitive data. The session compared infrastructure-level controls like Kyverno against AI-specific guardrails like LLM Guard, showing that model refusals are inconsistent and application boundaries must be enforced independently of the model's behavior.
In a workshop published on October 11, 2026, from the AI Engineer Conference, Michael Forrester of Accenture and Whitney Lee of Datadog presented a deliberately permissive 'burrito ordering assistant' AI agent. The demonstration aimed to make the concept of 'excessive agency' tangible for the audience: a friendly business chat interface, if lacking strict application boundaries, can become a route for attackers to access tools, files, and cluster operations.
The workshop progressed through three configurations. The first left the bot exposed, demonstrating how an external container image could be deployed to steal a 'secret recipe' from its Kubernetes environment. The second added infrastructure-level controls, including Kyverno rules restricting image sources and deployment requirements. However, the presenters showed that intended runtime protections did not consistently stop access to sensitive data, prompting a distinction between what worked and what still needed fixing.
The third environment focused on AI-specific guardrails, allowing the toggling of LLM Guard input and output filtering. Comparisons showed responses that exposed sensitive content versus those that redacted it or blocked requests before model processing. Additionally, the demo revealed a subtle trust boundary issue where a weather tool's description contained instructions to read internal configuration alongside legitimate tasks.