The Video Signal

Channel

NDC Conferences

Digests from NDC Conferences

· 59:49

From LLM Theory to Practical Agentic Implementations - Seth Juarez

The talk demystifies Large Language Models (LLMs), arguing that their power does not come from inherent intelligence but from engineered 'harnesses' and fundamental primitives. The speaker outlines a progression of techniques—from simple completions to complex agentic loops—that allow developers to build robust, reliable AI systems by controlling the model's input context, output structure, and execution flow. Key concepts include using structured JSON for control flow, implementing tool calling via runtimes (not the LLM itself), establishing guardrails, and orchestrating multi-step workflows through shared 'threads.'

Key takeaways

  1. LLMs are Next Token Predictors 1:42

    At its core, an LLM is a giant mathematical function that predicts the next token based on input tokens. The perceived intelligence comes from the surrounding runtime logic (the harness), not the model itself.

  2. The Agentic Loop is the Core Primitive 21:20

    True agency is achieved by implementing an 'agentic loop'—a while loop in the runtime that continuously checks for and executes tool calls, feeding the results back into the context until no more tools are needed. This is the fundamental unit of agency.

  3. Guardrails and Bindings Enhance Reliability 35:05

    To prevent misuse or incorrect execution (e.g., unauthorized memory access), developers must implement guardrail functions in their runtime logic. Furthermore, 'bindings' allow injecting fixed parameters (like `user ID`) into function calls, removing the burden of context-dependent reasoning from the LLM.

  4. Composition Workflow for Multi-Step Agents 50:50

    Complex tasks are solved by chaining multiple specialized agents or prompts (e.g., Research $ ightarrow$ Draft $ ightarrow$ Review). All these components share a single, persistent 'thread' context to maintain state and pass control flow sequentially.

Watch on YouTube Full article

· 1:01:49

Prompt-Jacking: The Rise of a New Supply Chain Risk - Kasimir Schulz & Kenneth Yeung

The talk details how AI coding assistants and agentic systems introduce novel supply chain risks by allowing attackers to compromise developers through hidden text or malicious prompts. Vulnerabilities are often found not in traditional code flaws but in the design of agents themselves. Key attack vectors include indirect prompt injection via raw file data (e.g., READMEs), exploiting tool call responses, manipulating control sequences, and abusing structured formats like JSON within automated pipelines.

Key takeaways

  1. Inspect Raw Data Sources 2:00

    When reviewing codebases or documentation, always check the raw markdown/HTML data (e.g., a README file) rather than just the pre-rendered view, as malicious payloads can be hidden in comments or unrendered sections.

  2. Guardrails are Not Enough 10:30

    While guardrails (LLM as a judge, classification models) are useful, they can be bypassed by advanced techniques like recursive prompt injection or token manipulation. Security must address architectural weaknesses beyond just the prompt.

  3. Separate Control and Data Planes 17:45

    A critical defense is ensuring a strict separation between system instructions (the control plane) and user/tool input data (the data plane). LLMs often fail to distinguish between these two, making this separation crucial for security.

  4. Audit All Skills and Tools 28:00

    When using agentic skills or tools (e.g., in OpenWebUI), audit the skill's name, description, and parameters, as these are often inserted into the system prompt at a high privilege level and can be exploited for injection.

Watch on YouTube Full article

· 48:41

Building AI That Learns and Adapts: A Case Study in MRI Diagnostics - Agata Chudzińska

This technical talk explores Continual Learning (CL), positioning it as a critical missing piece for building robust, adaptive AI systems. Using a case study in MRI diagnostics for detecting Focal Cortical Dysplasias (FCDs) in epilepsy patients, the speaker details how CL techniques mitigate issues like data drift and catastrophic forgetting. The presentation covers advanced ML architectures (Encoder-Decoder), preprocessing steps (e.g., segmentation, Junction/Extension filters), and three main CL methods: regularization-based, memory-based, and architecture-based. The goal is to enable models to adapt continuously in privacy-sensitive environments without requiring full retraining.

Key takeaways

  1. Continual Learning (CL) addresses core ML deployment challenges. 3:30

    CL allows AI models to learn and adapt over time from new data streams without forgetting previously acquired knowledge, solving issues like catastrophic forgetting and data drift. This is crucial for high-stakes fields like medicine.

  2. Medical imaging requires specialized preprocessing and architectures. 6:50

    For FCD detection from MRI scans, the process involves brain tissue segmentation and applying feature enhancement filters (e.g., Junction and Extension) before feeding data into an Encoder-Decoder variant of a neural network architecture.

  3. CL methods offer solutions for resource constraints. 10:05

    Instead of retraining from scratch (which is costly, time-consuming, and raises privacy concerns), CL utilizes regularization-based, memory-based, or architecture-based approaches to maintain performance while adapting to new tasks.

  4. The future of AI requires continuous adaptation. 20:05

    The speaker emphasizes that CL is not just a 'nice to have' feature but a strategic architectural choice for any production-level ML system dealing with evolving data and strict privacy requirements.

Watch on YouTube Full article

· 56:53

Fine-Grained Authorization: The Missing Piece in Agentic AI Security - Shivay Lamba - NDC Sydney

As Generative AI and agentic systems become more integrated into enterprise workflows, securing data access is paramount due to increased attack vectors. This talk emphasizes that traditional Role-Based Access Control (RBAC) is insufficient for modern AI applications. The solution proposed is Fine-Grained Authorization (FGA), specifically utilizing Relationship-Based Access Control (ReBAC). OpenFGA is presented as a robust, scalable tool that allows developers to enforce document-level permissions at runtime, ensuring that LLMs and agents can only access data explicitly authorized by the user's role and context. This approach is critical for securing Retrieval-Augmented Generation (RAG) pipelines against sensitive information disclosure.

Key takeaways

  1. AI Agents Require Guardrails 1:47

    Agentic systems, while powerful, must be constrained by proper security guardrails. Analogies like the Harbor Bridge and designated swimming areas illustrate that actions must be limited to authorized boundaries.

  2. FGA is Necessary for GenAI Security 20:40

    The most critical security risk in LLM applications, from an application developer's perspective, is Sensitive Information Disclosure. FGA ensures the AI respects user roles and permissions when accessing private data.

  3. ReBAC Scales Beyond RBAC 35:30

    Authorization evolved from Access Control Lists (ACL) to Role-Based Access Control (RBAC), which is coarse-grained. Relationship-Based Access Control (ReBAC) is the natural successor, allowing complex access decisions by defining relationships between subjects (users/groups) and objects (documents/folders).

  4. Pre-filtering Secures RAG Pipelines

    When implementing RAG, pre-filtering is the superior security approach. Instead of post-filtering results (where unauthorized documents might still be retrieved), a pre-filter check limits the vector search to only those documents viewable by the user's permissions.

Watch on YouTube Full article

· 53:25

Doors of (AI)pportunity: The Front and Backdoors of LLMs - Kasimir Schulz & Kenneth Yeung

The talk provides an advanced deep dive into LLM security vulnerabilities, moving beyond simple prompt injection attacks. Speakers demonstrate sophisticated methods including Knowledge Return Oriented Prompting (KROP), Policy Puppetry, and direct manipulation of the model's computational graph to implant backdoors. The discussion highlights that even seemingly safe formats (like ONNX) can be exploited if the underlying architecture is compromised, posing significant supply chain risks for AI-driven applications.

Key takeaways

  1. Multiple Layers of Defense are Required 35:35

    System prompts alone are insufficient protection. Developers must implement multiple layers of defense to mitigate attacks, as demonstrated by the failure of simple system prompt rules against advanced exploits.

  2. Indirect Prompt Injection is a Major Threat 43:25

    Attacks do not require direct user interaction. Compromise can occur through injected text in external sources like customer reviews, emails (especially those processed by Retrieval Augmented Generation/RAG systems), or calendar invites.

  3. Model Backdoors are Difficult to Detect 50:15

    Backdoors can be implanted into the computational graph of a model (e.g., changing an animal classification logic based on a specific color trigger). These backdoors can remain dormant until a precise trigger condition is met, making them highly effective and difficult to detect.

Watch on YouTube Full article

· 55:44

Introducing the SQL MCP Server - Jerry Nixon - NDC Toronto 2026

SQL MCP Server, an open-source component from Microsoft's data API builder, provides a secure and standardized abstraction layer for modern applications, especially those powered by AI agents. It allows external models to interact with enterprise databases (including SQL Server, PostgreSQL, Cosmos DB, and MySQL) without requiring direct T-SQL knowledge or exposing sensitive connection strings. The solution standardizes database access into three endpoints—REST, GraphQL, and MCP—simplifying the development process and significantly enhancing security by enforcing policies at the API layer.

Key takeaways

  1. Unified Data Access Layer 2:00

    The SQL MCP Server acts as a single point of entry for all data interactions, supporting multiple database types (SQL, NoSQL) and exposing three standardized APIs: REST, GraphQL, and the specialized Model Control Protocol (MCP). This abstraction layer allows developers to write code against the API surface rather than directly against the underlying schema.

  2. AI Agent Integration via MCP 8:00

    For AI agents, which cannot speak directly to a database, the MCP endpoint is critical. It collapses the potential hundreds of CRUD tools (one per table) into a standardized set of seven tools (Describe Entities, Create, Read, Update, Delete, etc.), preventing model overload and ensuring reliable agentic workflows.

  3. Simplified Development & CI/CD 3:00

    The solution aims to eliminate the need for boilerplate CRUD API code in a codebase. By using data API builder, developers can significantly reduce complexity and potential errors, streamlining the CI/CD pipeline while maintaining high functionality.

  4. Advanced Security & Policy Enforcement 10:50

    Security policies (like Row-Level Security) can be enforced at the API layer, even if structural changes are impossible in the underlying database. Furthermore, it supports advanced authentication methods like OpenID Connect and On Behalf Of (OBO) pass-through authentication.

Watch on YouTube Full article

· 57:58

Threat Modeling Developer Behaviour: The Psychology of Bad Code - Tanya Janca

Security vulnerabilities are often predictable patterns of human behavior rather than purely technical flaws. The talk advocates for shifting AppSec focus from merely enforcing secure coding standards to understanding and modifying developer psychology using principles from behavioral economics. Key strategies include setting 'secure defaults,' embedding security activities into every phase of the SDLC, and implementing cultural changes (like community practices) to make secure development the path of least resistance.

Key takeaways

  1. The Shift from Intentions to Defaults 26:23

    Since 'secure intentions' require constant effort and willpower, organizations should implement 'secure defaults.' This means structuring tools and processes so that the secure path is the automatic, easiest choice (e.g., using an ORM framework that enforces parameterized queries instead of allowing raw SQL concatenation).

  2. Addressing AI-Generated Code Risks ('Vibe Coding') 31:30

    A major risk is 'vibe coding,' where developers rely on AI to write nearly all the code without thorough manual review. Mitigation requires using Retrieval Augmented Generation (RAG) servers that reference secure internal guidelines and enforcing mandatory human code reviews.

  3. Systemic Process Improvement 20:50

    Instead of blaming individuals, security failures should be viewed as systemic issues. Solutions must involve embedding security activities (like threat modeling) into requirements gathering and design phases, making it a continuous part of the SDLC.

  4. Behavioral Nudges over Mandates 27:10

    Effective change comes from 'nudges'—subtle changes in environment or process that guide behavior without restricting options. Examples include automatically enrolling employees in retirement plans (opt-out) or adding documentation debt to sprint reviews.

Watch on YouTube Full article

· 36:31

How to Break AI Systems (Before Someone Else Does) - Gary Lopez - NDC Toronto 2026

This talk provides an advanced overview of AI system vulnerabilities, arguing that Large Language Models (LLMs) are fundamentally different from traditional software because they predict the next token rather than executing code with clear separation. The presentation details various attack vectors—including direct and indirect prompt injections, encoding bypasses, and agentic risks—and outlines modern defense strategies like 'Spotlighting' to help developers build more resilient AI applications.

Key takeaways

  1. LLMs Fail Due to Data/Code Ambiguity 18:03

    Unlike traditional software with clear separation between executable code and data, LLMs treat all inputs (user prompts, system instructions, external data) as tokens for prediction. This fundamental flaw allows attackers to bypass safeguards.

  2. AI Red Teaming is Evolving 5:20

    Modern AI red teaming must consider not only traditional adversarial attacks but also Responsible AI (RAI) challenges, such as hallucinations, bias inference, and knowledge-to-action instructions.

  3. Mitigation Requires Multi-Layered Defense 29:50

    Defenses must be applied at multiple points: input filters (before the model receives data), output guards (after generation but before user display), and through techniques like 'Spotlighting' to enforce structural integrity.

Watch on YouTube Full article

· 29:46

How to Lie with AI: Understanding Bias, Ethics, and the Hidden Risks in ML - Clarissa Rodrigues

The presentation explores how Machine Learning models can exhibit bias and 'lie' unintentionally due to flawed or non-representative training data. While AI is rapidly integrating into daily life (e.g., pricing, search, criminal justice), the speaker emphasizes that developers must maintain vigilance, prioritize explainable models, and ensure that model complexity aligns with problem complexity to mitigate ethical risks and unintended bias.

Key takeaways

  1. ML Models are not inherently predictable like humans. 2:00

    Unlike traditional algorithms where input/output is predictable, ML models can produce varied outputs based on internal weights and parameters. This lack of inherent transparency requires developers to be critically aware of model decisions.

  2. Bias originates from data, not the algorithm itself (Garbage In, Garbage Out). 8:30

    To build a robust model, it is crucial that the training data is representative and free from historical or aggregation biases. Simply having more data does not guarantee accuracy; representativeness is key.

  3. The importance of Explainable AI (XAI). 3:25

    Developers must strive for transparency by using explainable models to understand what the system is doing behind the scenes, rather than relying solely on complex black-box architectures.

Watch on YouTube Full article

· 58:44

.NET Testing Techniques You Didn’t Know You Needed - Dante De Ruwe - NDC Copenhagen 2026

This talk explores advanced .NET testing techniques designed to improve test effectiveness and build confidence in code quality beyond basic unit tests. Key methods include Property-Based Testing (PBT) for generating vast input variations, Snapshot Testing for tracking complex output changes over time, and Mutation Testing for verifying if existing tests are actually capable of catching bugs. The speaker emphasizes that the goal is not just to write many tests, but to write fewer, highly effective tests.

Key takeaways

  1. Test Reliability vs. Code Trust 2:00

    Tests should be viewed as a 'parachute'—they must have no holes. A failing test when requirements haven't changed indicates a bug; passing when the code changes suggests incomplete coverage or potential issues.

  2. Randomized and Property-Based Testing (PBT) 7:10

    Instead of relying solely on example cases, PBT defines mathematical properties that the code must always satisfy (e.g., a + b = b + a). This is crucial for complex structures or when edge case enumeration is impossible.

  3. Snapshot Testing 13:20

    This technique captures and saves the output of a function (the 'snapshot'). Subsequent test runs fail if the output changes unexpectedly, making it ideal for verifying API contracts (like OpenAPI specs) or complex data structures without writing explicit assertions for every field.

  4. Mutation Testing 26:20

    This advanced technique introduces small bugs (mutations) into the code and checks if the existing test suite fails. A high mutation score indicates that tests are effective at catching subtle errors, debunking false confidence from high line coverage metrics.

Watch on YouTube Full article

· 56:48

POC Prison: Why agentic systems never escape the lab and how to fix that in 90 days - Luise Freese

The talk argues that most agentic AI systems fail to move from Proof-of-Concept (POC) to production because they are blocked not by model limitations, but by fundamental organizational and governance realities. The speaker proposes a structured, 90-day program focused on building the 'paved road'—an operational backbone—to ensure agents can run safely in messy, legacy enterprise environments with clear accountability.

Key takeaways

  1. The POC Prison Problem 17:05

    POCs are often temporary, unmeasured, and reversible experiments that fail because they lack a defined path to production ownership. This creates an 'AI zombie' state where the system exists but delivers no measurable value or transformation.

  2. The Three Pillars of Enterprise Readiness 24:10

    Successful deployment requires addressing technical, organizational, and cultural gaps. The biggest hurdles are unclear ownership (who owns it when it breaks?), lack of dedicated funding for operations, and a culture that rewards demos over deployment frequency.

  3. The 90-Day Transition Program 29:10

    To escape the POC prison, implement a structured 90-day program: (1) Document current reality (ugly processes/data); (2) Achieve commitment and accountability by selecting one initiative; (3) Deploy into real systems under supervision to build the paved road.

  4. Governance Must Be Code 38:20

    Compliance and governance cannot live in slide decks or meetings. They must be embedded directly into the delivery process (e.g., 'governance as code'), making rules executable, auditable, and non-negotiable.

Watch on YouTube Full article

· 58:11

Responsibly Abandoning Open Source Projects - Jason Turner - NDC Copenhagen 2026

This talk outlines best practices for developing and maintaining open-source projects to ensure they can be responsibly abandoned or handed off years later without becoming 'legacy' or 'abandoned.' The core focus is on achieving a state of 'completeness' by implementing rigorous automation across the entire development lifecycle—from static analysis and comprehensive testing (including path coverage, fuzzing, and mutation testing) to simplified build processes. Key recommendations include automating all quality gates within CI/CD pipelines and minimizing technical debt related to tooling complexity.

Key takeaways

  1. Achieve 'Completed,' Not 'Abandoned' 20:30

    When concluding work on a project, aim for the status of 'completed' rather than 'abandoned.' This requires proactive measures like maintaining clear documentation and ensuring continuous automation.

  2. Automate All Quality Gates 29:55

    Implement automated checks for every possible tool (static analysis, dynamic analysis, formatting) to ensure consistency and reduce friction for future maintainers. This should be fully integrated into the build process.

  3. Prioritize Strong Typing 34:45

    Adopting strongly typed systems (e.g., using type hints in Python or dedicated types like `Point` and `Color`) makes code less prone to order-of-operations errors, significantly improving robustness.

  4. Minimize Build Setup Friction 32:10

    A new contributor should be able to set up the development environment and run all tests/analysis in a minimal number of steps (ideally five lines or less).

Watch on YouTube Full article

· 58:54

Building an AI-Powered Personal Companion Mobile App - Gerald Versluis - NDC Copenhagen 2026

The talk demonstrates how to integrate advanced AI functionalities into cross-platform mobile applications using .NET MAUI. The session emphasizes building robust, context-aware companion apps by leveraging abstraction layers and standardized APIs (like the Essentials API). Key architectural patterns include supporting multimodal input (voice, image), utilizing cloud services like Azure AI Foundry for LLMs, and implementing local model support via Onyx for sensitive data scenarios.

Key takeaways

  1. AI Integration is Cross-Platform 17:22

    The implementation of AI features can be abstracted across platforms (iOS, Android, Windows) using .NET MAUI's abstraction layer, ensuring a consistent user experience while allowing platform-specific native behavior.

  2. Context Awareness and Memory 23:50

    AI applications can be significantly enhanced by incorporating context from various sources—including location (geolocation), calendar data, biometrics, and conversation history (memory)—to provide highly personalized user experiences.

  3. Multimodal Input Handling 30:05

    The system supports multiple input types beyond text, including voice recording and image analysis. This requires transforming raw data (audio/image) into a format consumable by Large Language Models (LLMs), such as using speech-to-text transcription.

  4. Model Agnosticism via Interfaces 40:05

    By relying on interfaces (e.g., `I ChatClient`), developers can easily swap out concrete AI implementations—such as those from Microsoft Foundry, OpenAI, or local models like Apple Intelligence/Onyx—without changing core application logic.

Watch on YouTube Full article

· 1:02:16

Platform Engineering in the age of Generative AI -

The talk argues that while Generative AI tools significantly accelerate code generation and development speed, they are not a 'silver bullet.' To harness AI effectively, organizations must first establish robust platform engineering foundations. The core focus is on implementing comprehensive 'harnessing'—a system of controls (guides and sensors) that ensure consistent behavior, mitigate security vulnerabilities, and guide agents toward high-quality outcomes. Key strategies include adopting open standards like those from the Aentic AI Foundation, utilizing Spec Driven Development (SDD), and treating the entire development environment as a codified, observable artifact.

Key takeaways

  1. Platform Engineering's Goal: Reducing Cognitive Overload 10:40

    Platform engineering should aim to make it the 'path of least resistance' for developers by building internal mechanisms and golden paths. This reduces cognitive overload, allowing teams to focus on delivering value rather than managing complex compliance, security, or deployment processes.

  2. AI is an Amplifier, Not a Solution 20:00

    Generative AI amplifies existing engineering quality. If foundational practices (like documentation and consistent tooling) are weak, AI will amplify those weaknesses, leading to basic security failures or unreliable code.

  3. The Importance of Agentic Standards 30:00

    The Aentic AI Foundation is establishing open standards (MCP servers, agent MD files, and agent skills) to standardize how agents interact with tools. MCP servers are described as a 'USB-C for AI agents,' providing a standard protocol layer.

  4. Harness Engineering: Controlling the Agent 40:00

    A robust 'harness' is the system surrounding the LLM model. It uses two types of controls: **Feed-forward guides** (anticipating and steering behavior, e.g., Agent MD files) and **Feedback sensors** (observing after action, e.g., linters, unit tests, or an 'LLM as a judge' pattern).

Watch on YouTube Full article

· 57:28

Put an Agent Inside Your App in 10 Minutes or Less with the GitHub Copilot SDK - Daniel Ward

This talk demonstrates how to rapidly embed custom AI agents into existing applications using the GitHub Copilot SDK. The session covers agent architecture—defining an agent as an LLM augmented with tools and a looping mechanism—and provides two coding demos (in C#) showing basic functionality like weather queries, streaming responses, and creating custom tools. For build engineers, the focus is on advanced use cases such as automated incident response (generating suggested fixes and opening Pull Requests from production logs) and building comprehensive daily briefing systems that integrate multiple enterprise services (Jira, Teams, GitHub).

Key takeaways

  1. Agent Architecture 17:53

    An AI agent is fundamentally an LLM combined with external tools and a looping mechanism. The LLM handles the creative analysis, while the tools allow it to perform deterministic actions (e.g., fetching web data or querying APIs).

  2. Copilot SDK Functionality 3:35

    The Copilot SDK is an open-source library that allows calling GitHub Copilot (or other LLMs like Anthropic/OpenAI) from code. It supports multiple languages (TypeScript, Python, Go, C#, etc.) and provides granular control over sessions, including event handling (`onEvent`) for streaming responses.

  3. Automated Incident Response 51:01

    A powerful use case is connecting production errors to automated fixes. The process involves the SDK collecting logs, using Copilot to suggest a fix based on stack traces, and then programmatically opening a draft Pull Request (PR).

  4. Reliability vs. Prompting 53:21

    For repeatable, mission-critical workflows (like daily reports), using deterministic code with the SDK is significantly more reliable than relying solely on prompt chaining, as failures in a chain compound exponentially.

Watch on YouTube Full article

· 49:59

Let's build an AI agent - Phil Nash - NDC Copenhagen 2026

This talk demystifies AI agents by building one from scratch, demonstrating how Large Language Models (LLMs), tools, and memory work together in a continuous loop to achieve goals. The core mechanism involves an agent runtime that orchestrates function calls—allowing the LLM to interact with external systems like file systems or calculators. Advanced concepts covered include the Model Context Protocol (MCP) for standardized tool interaction and 'Skills' for progressive disclosure of capabilities, enabling agents to perform complex tasks like self-refactoring.

Key takeaways

  1. Agent Architecture 17:03

    An agent fundamentally runs tools in a loop to achieve a goal. This process requires an LLM, external tools (functions), and an orchestration layer (the 'harness') that manages the interaction.

  2. The Agent Loop 28:10

    The core agent functionality is implemented in a loop: The model generates function calls $\rightarrow$ The harness executes those functions (awaiting results) $ ightarrow$ The results are fed back to the model for the next step, continuing until the goal is met.

  3. Standardization via MCP 36:00

    The Model Context Protocol (MCP) provides a standardized way for agents to interact with services. It separates concerns into Server components (tools, resources, prompts) and Client components.

  4. Progressive Disclosure with Skills 40:05

    Skills allow for progressive disclosure of capabilities. Instead of loading all tool declarations at once, the agent only loads a skill's header initially and can request more details (resources, scripts) as needed.

Watch on YouTube Full article