Picture a price-monitoring agent doing exactly what it was built to do: scraping a competitor's product page every night to keep your pricing model current. Nothing about that job description sounds dangerous. Then one night, the page it's reading contains a single line of fine print planted specifically for it, and your own cost basis and floor price walk straight back to the competitor.
No exploit. No broken rule. No misconfigured permission. Just an agent reading content it was told to read, and doing what any well-behaved agent does with instructions it finds along the way.
That live demo is the centerpiece of the next Zyte Developer Community Meetup, co-hosted with us at Humanbound, and if you're building or shipping agents that touch the open web, it's worth carving out an hour for.
The boundary moved, and most pipelines haven't caught up
Agents don't just answer questions anymore. They browse, scrape, call tools, and increasingly act on whatever they read, often unattended. That quietly moves the security boundary: untrusted input is no longer only what a user types into a chat box. It's every page your agent fetches, every document it's handed, every tool result it ingests.
The OWASP Top 10 for Agentic Applications 2026 puts Agent Goal Hijack (ASI01) first on the list, and the shortest path in is exactly this: content the model reads that the person operating it never sees. If your agent's data source is the open web, that's not a hypothetical, it's the default condition.
What we're showing live: AISecOps, not slideware
Our co-founder and co-CEO, Demetris Gerogiannis, is running the first talk: "AISecOps for the Agentic Age: Model, Test, Monitor." Rather than talk about the problem in the abstract, he'll walk through the price-monitoring scenario above end to end, then close the loop live:
- Model where untrusted content can enter your agent, and what it can reach once it's in.
- Test by turning that entry point into an adversarial test that runs on every change.
- Monitor, because a new tool, a new model, or just a new page can quietly reopen what you already closed, without anyone touching your code.
You'll watch a failing security test become an exported guardrail, dropped into a stock LangChain agent in two lines with no new dependency, and watch the same attack fail on the re-run. It's a useful pattern even if you're not using Humanbound day to day: the gap between "we found the problem" and "the problem stays fixed" is where most agent security work quietly stalls, and this shows one way to close it.
(Worth noting: closing that loop isn't something only Humanbound does. If you're evaluating options, Promptfoo's Adaptive Guardrails does something similar in its Enterprise tier. What we think is different is that this comes from the same open-source engine you can run yourself, with a fast, terminal-first workflow.)
Also on the agenda: Zyte open-sources its coding agent infrastructure
Right after, Zyte's Head of R&D, Konstantin Lopukhin, is opening up a new library for running coding agents as declarative, swappable background jobs, local or in the cloud, across harnesses like Claude Code and Codex, without locking into one LLM provider. He'll show it powering Zyte's own spider-writing agents in production, plus how the team evaluates the code those agents produce before it ships. The repo goes public alongside the talk.
What you'll leave with
- A concrete way to map your own agent's attack surface to the OWASP Agentic Top 10
- Why the content your agent reads, not just what a user types, is the primary injection point, and how to start testing for it
- A look at Zyte's harness- and provider-agnostic remote agent infrastructure, ready to clone
- Free Humanbound usage keys and the one-line command to scan your own agent the same day
Details
Zyte Developer Community Meetup #2 x Humanbound.ai
Thursday, September 24 · 17:00–18:00 EEST · live on Zoom
Registration is free and spots are limited: Register here
If your agents scrape, call tools, or ship code on their own, this is built for you. See you there.
Top comments (0)