Edison Plaku

This session delivers a live attack-chain demonstration that starts with session hijacking and ends with unauthorized cross-tenant data access through an AI agent.

Using a deliberately vulnerable application and synthetic financial data, we will walk through the attack in real time from compromising a valid user session, to interacting with an AI assistant, abusing its access to backend tools, and ultimately crossing the application's authorization boundary to access data belonging to another tenant.

The session will break down the security boundaries between the user, session, AI agent, tool-calling layer and backend, showing where trust is established and where it breaks. The live demonstration will then reproduce the complete attack chain and trace how an apparently legitimate AI interaction can turn into a data leak.

The final part focuses on the defensive perspective: where authorization must actually be enforced, why a valid authenticated session does not guarantee secure AI interactions, and how AI-powered applications can maintain strong security boundaries when LLMs are given access to application functionality.

The entire demonstration is performed in an isolated, intentionally vulnerable environment using synthetic data.