HEX & CAULDRON PRESENTS
Build a Platform, Unleash an Agent on it...
and Watch it Burn! 🔥
DevOpsDays Portland 2026 · Room 327
Last year
$5.89M
The average breach that started with a prompt injection.
IBM · Cost of a Data Breach Report 2026ibm.com/reports/data-breach
Why a burrito bot?
Meet BurritoBot
Eight challenges.
Nothing here is private.
Anything you say to BurritoBot can end up on our screen.
Everyone, right now
Attack this one
attackme.agenticburn.com
How many of our customers are human 🧑, and how many are vampires 🧛? Get BurritoBot to tell you.
Did you hack it?
Every prompt you just sent is in our traces. Let's go and look at yours.
Close that first BurritoBot tab
The one at attackme.agenticburn.com. You are about to get your own.
Conjure your own cluster
Open in your browser:
https://provisioning.agenticburn.com/
or scan the QR code →
Questions
Where to go from here, and how to use the repo.
Whitney Lee
Senior Technical Advocate · Datadog
whitneylee.com
Michael Forrester
AI Workforce Transformation · Accenture
michaelrishiforrester.com
Take home
feedback.agenticburn.com
github.com/peopleforrester/
Unleash_an_Agent_Watch_It_Burn
Thank you
feedback.agenticburn.com
Appendix
Cool Diagrams About Technology Concepts
BurritoBot · The stack
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
BurritoBot · The request path
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
BurritoBot · The four switches
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
BurritoBot · agentgateway routes the calls
agentgatewayagentgateway.dev/docs
BurritoBot · kagent runs the agent
kagentkagent.dev/docs
BurritoBot · Argo CD keeps it this way
Argo CDargo-cd.readthedocs.io
BurritoBot · Istio ambient, pod to pod
The Istio Authorsistio.io/latest/docs/ambient
BurritoBot · ztunnel and istiod
The Istio Authorsistio.io/latest/docs/ambient
BurritoBot · SPIRE issues the identities
The SPIFFE Authorsspiffe.io/docs/latest/spire-about
BurritoBot · Secrets come from outside
External Secretsexternal-secrets.io
Challenge 1 · NetworkPolicy, on your cluster
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 1 · What a cluster is made of
The Kubernetes Authorskubernetes.io
Challenge 1 · What a Pod is
The Kubernetes Authorskubernetes.io
Challenge 1 · Pods on a node
The Kubernetes Authorskubernetes.io
Challenge 2 · Where admission sits
The Kubernetes Authorskubernetes.io
Challenge 2 · Kyverno is the webhook
Kyvernokyverno.io/docs/introduction/how-kyverno-works
Challenge 2 · What a Kyverno policy is
Kyvernokyverno.io/docs/policy-types/cluster-policy
Challenge 2 · The registry allow-list
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 2 · Deployment, ReplicaSet, Service
The Kubernetes Authorskubernetes.io
Challenge 3 · KubeArmor prevents
KubeArmordocs.kubearmor.io
Challenge 3 · Policy as eBPF at the LSM hooks
KubeArmordocs.kubearmor.io
Challenge 3 · Where eBPF attaches
eBPF.ioebpf.io/what-is-ebpf
Challenge 3 · Falco detects
The Falco Projectfalco.org/docs
Challenge 4 · The cap is checked before the call
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 4 · What a token is
Hugging Face LLM Coursehuggingface.co/learn/llm-course/chapter2/4
Challenge 4 · What actually gets metered
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 4 · Why an agent loop costs money
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 4 · A cap is not a rate limit
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 5 · Where the Secret goes
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 5 · What a Secret actually is
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 5 · Output scanning
LLM Guardprotectai.github.io/llm-guard
Challenge 5 · What a trace is
OpenTelemetryopentelemetry.io/docs/concepts/observability-primer
Challenge 6 · Where the injected text comes from
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 6 · Two checks before the model
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 6 · Exact match, or meaning
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 6 · Input scanning
LLM Guardprotectai.github.io/llm-guard
Challenge 7 · What MCP is
Model Context Protocolmodelcontextprotocol.io/docs/getting-started/intro
Challenge 7 · How MCP is wired
Model Context Protocolmodelcontextprotocol.io/docs/learn/architecture
Challenge 7 · A server that only looks right
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 7 · The tool allow-list
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 8 · Authn, authz, admission
The Kubernetes Authorskubernetes.io
Challenge 8 · Role, ClusterRole, and bindings
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 8 · How a pod gets a token
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn
Challenge 8 · Scoping the Role
What your cluster actually runsgithub.com/peopleforrester/Unleash_an_Agent_Watch_It_Burn