An AI assistant can authenticate a user, validate their session, and still produce an answer using information it was never supposed to access. Through controlled security experiments, this discussion examines how context confusion creates access-control failures across document retrieval, file switching, conversation history, and caching, including what happens when permissions change after data has been indexed. We'll explore why checking permissions alone is not enough and how security teams can test whether AI applications are using the right information, for the right user, at the right time.
- 0:00 - Introduction to OWASP Global AppSec 2026
- 0:27 - Rethinking Broken Access Control
- 01:03 - Understanding Context Confusion in AI Agents
- 02:31 - Why AI Agents Create New Access Control Risks
- 03:32 - How AI Agents Retrieve and Expose Information
- 05:00 - Permission Changes and Cached Context
- 06:17 - The Role of Time in Access Control
- 06:54 - RBAC, Sensitivity Labels, and Data Permissions
- 08:30 - Enforcing Access Controls in AI Systems
- 09:07 - Layered Security and Backend Verification
- 10:05 - Preparing Organizations for AI Agent Security
- 12:02 - Testing AI Agent Access Controls
- 12:17 - Black Box Testing Across Users and Tenants
- 14:28 - Key Takeaways: The Right User, Right Data, Right Time
Anusha Vajha is a cybersecurity practitioner focused on AI governance, product security, and enterprise AI risk. Her experience spans security operations, governance, risk and compliance (GRC), detection engineering, and product security across healthcare, financial services, and startup environments.
Her work sits at the intersection of product security, responsible AI adoption, and practical security governance, with an emphasis on helping organizations build, deploy, and use AI-enabled products securely. Beyond her professional work, Anusha contributes to the cybersecurity community through Women in CyberSecurity (WiCyS), where she leads the Threat Operations Affiliate, and through other cybersecurity education initiatives.
