Open Source Summit Korea 2026

As LLM-based agents gain access to tools - APIs, databases, file systems, and internal services, the security model changes. The model is no longer only generating text; it is selecting actions and invoking capabilities across systems.

Prompt injection attacks exploit this boundary. between model reasoning & external execution.

This talk examines how tool-enabled agents built on open LLM frameworks expand the attack surface and why traditional input validation approaches are insufficient.

We will analyze concrete failure modes such as:
- Prompt injection vs classical injection: control of model reasoning rather than query structure
- Tool outputs as secondary injection vector in multi-step workflows
- Why system prompts & guardrails are not reliable isolation boundaries
- Capability scoping & least-privilege design for tool access
- Isolation patterns for tool execution (sandboxing, mediated execution layers)
- Structured tool interfaces vs free-form prompting
- Observability patterns for tracing agent decisions and tool calls
- Adversarial testing of agent pipelines

Examples draw from patterns emerging in open-source LLM and agent ecosystems.