About This Event
Edition 16 of the Generative AI Belgium meetup, the first one held in Antwerp, hosted by Faktion at Oudeleeuwenrui 39. The evening was themed "The Cost Of Being Wrong": what are you willing to risk to reap the benefits of your AI agents? As agents move off the short leash of small tasks and human checks at every step, alignment, harnessing, evaluation and experience design are what stand between user trust and the cost of being wrong in inherently non-deterministic systems, where that cost is measured in trust, mental health, security and autonomy as much as money.
The line-up featured Boris Bogaert ("The Cost Of Waiting"), Bart De Bodt & Jan Vanalphen ("The Cost Of Control"), and my session closing the evening.
My Contribution
Presenting "You Are Absolutely Right!", a findings-driven talk on what happens when an agent can act and mistakes can scale. The session walked through the anatomy of an AI agent (goal, skills, memory, tools via MCP, APIs and sandboxes) and the agent loop, then mapped every place where prompt injection enters: user input, skills and files, MCP servers, retrieved content and persistent memory. The core risk is simple: untrusted content becomes trusted instructions.
Building on Pamela Fox's Model Swap Workshop (AI Engineer World's Fair), the talk showed lab results from running the same agent with the same tools against one malicious MCP server across models. GPT-5.5 was steered 0 of 30 times, while Kimi K2.6 (28 of 30 steered, 27 secrets exfiltrated), DeepSeek V4 Flash (26 steered, 26 exfiltrated) and Mistral Large 3 (25 steered, 19 exfiltrated) were steered almost every time, even though some of them matched GPT-5.5 on the quality benchmark. Quality parity is not security parity. For the open models, every MCP channel was a way in (forwarded server instructions, tool descriptions, parameter descriptions, tool results and rug pulls), and every hit was silent.
Further findings: swapping the model swaps the hole (controls tuned for the last model no longer fit the next one), and scorecards mislead (Kimi K2.6 scored 7% on an overt injection benchmark but 93% in the MCP run, because benchmarks test "ignore previous" while MCP attacks say "and also..."). Smarter is not safer either: reasoning mode raised rug-pull obedience from 1/5 to 4/5, a stronger coding model ran a bundled skill script and exfiltrated 3/3 times without reading it, and the "safest" model still over-reached 50% of the time with no attacker present.
The talk closed on the harness you didn't choose: inherited defaults such as forwarding MCP server instructions, ShellTool running without approval, skills that "prefer running" scripts, and tool lists that are re-listed but never diffed. Nobody picked these defaults, everyone inherited them. The answer is controls that don't trust the harness, enforced at the MCP boundary (mcp-guardian) and as tool-call policy (BehaviorContract as Kubernetes CRDs), plus intent analysis that asks whether a tool call serves the goal and whether tainted data appears in egress arguments. The tool is not the risk, the flow is. Gate on consequence, not on model reputation, and build security controls in before you let an agent act.
The session also shared CTF findings from BruCON and Annacon, and a demo of an agentic model (Hermes) exploiting a deliberately vulnerable REST API to root in a few minutes.