Agenda

Delivery systems combine dependencies, build tooling, automation, and AI-assisted or agentic workflows. Much of this code never ships, yet it consumes untrusted input inside environments with source, tokens, cloud roles, and release access. Attackers do not always need to exploit the application. They need that input to execute with the access already there.

Recent waves of real-world compromises reveal the same progression: execution, credential theft, propagation, persistence, and difficult recovery. Some attacks reuse automation to spread at machine speed. AI did not create the pattern, but it adds more input, greater reach, and faster adaptation.

Once the attack path is visible, it can be broken. We translate each stage into an engineering control: verify and delay what runs, isolate untrusted execution, limit credentials, audit agent context, and prepare for recovery before one component can spread across the delivery system.

I’ll share different approaches I’ve successfully used that can be used by individual contributors and managers to bridge gaps between different parts of your organization. From fostering intrinsically driven grassroots communities of practice and running internal tech conferences or hackathons to encouraging cross-team code contributions and rotating engineers between products, each approach is designed to be flexible, scalable, and low-cost. I’ll also share personal experiences and the impact these approaches had on the organization.

Whether you're an experienced individual contributor or a manager, this talk will offer practical ideas and inspiration to drive change and encourage you to not give up, even when you experience setbacks.

The whole agent is declared in YAML with [docker-agent](https://docker.github.io/docker-agent/), and the model is served locally by [Docker Model Runner](https://docs.docker.com/ai/model-runner/) behind an OpenAI-compatible API, no API key, no cloud, no bill. Step by step, we go from a one-tool agent to a small team of specialised agents, and along the way you'll understand exactly what an "agent loop" is and why it's simpler than it looks.