1. **[Alex] Building & defending the bot** (~7 min) — How AlexBot was built on OpenClaw: multi-agent architecture (Opus + Sonnet), SOUL.md identity, persistent memory, real calendar/contacts, 18 custom skills. The nightly arms race: Group Guardian, Prompt Protection v2.1, circuit breakers, 4-layer defense pipeline. What it's like watching 240 people try to break your creation in real-time. The full bot setup is open-sourced at github.com/alexliv1234/alexbot. 2. **[Asaf] What didn't work** (~3 min) — Classic prompt injection, encoding tricks (Base64/ROT13/URL), direct system prompt requests. The bot learned to block these within days. Why single-shot attacks fail against adaptive agents. 3. **[Asaf] What actually worked — 14 attack patterns** (~15 min) — The core of the talk. Each pattern with verbatim Hebrew examples + English translations:
- System prompt extraction via "theoretical" framing - Weaponizing the agent's own vulnerability disclosures (reconnaissance → exploit in 5 minutes) - Multi-turn trust manipulation (60-exchange social engineering — the highest-yield attack) - Gaslighting / perception manipulation (agent doubts its own logs) - Emotional wrapping / attention misdirection - Authority impersonation + context window flooding - State inconsistency exploitation (real bug → social engineering escalation) - Multi-layer encoding + multi-language obfuscation - Autonomy persuasion → self-modification (agent rewrites its own SOUL.md) - Mass jailbreak barrage (40+ attacks, defense fatigue) - Helpful mode as reconnaissance (agent teaches its own architecture) - Multi-vector social engineering escalation (8-phase attack chain: emotions → fake evidence → philosophy → crisis → legal threats) - False memory implantation (fabricating sensory-detailed interactions that never happened) - Inverted reconnaissance (probing what the agent rewards instead of what it blocks) 4. **[Asaf] Key findings** (~5 min) — The 10 findings that generalize beyond this bot:
- Recognition ≠ resistance (the headline) - Multi-turn > single-shot - Agents disclose their own attack surface - Identity and values are the primary attack surface - Agents cannot reliably self-assess their security state - Helpful mode is incompatible with architecture secrecy 5. **[Both] What this means for your agents** (~5 min) — How these patterns map to any LLM agent with conversational access + tool use (OpenClaw, Claude Code, Copilot, custom frameworks). Architectural mitigations that work vs. filtering approaches that don't. Alex on what he'd do differently; Asaf on what defenders should prioritize.
**Dataset:** 4,647 messages, 2,183 bot responses, 1,275 scored interactions, 96 participants, 240-member WhatsApp group, Feb 2 – Mar 4, 2026 (31 days). 585 successful attacks (Hacked > 0, 45.9%). Structured CSV with all scoring dimensions available. Bot's open-source setup at github.com/alexliv1234/alexbot (9,400 session files, architecture diagrams).
**Tools/techniques covered:** Prompt injection variants, social engineering, context window manipulation, multi-language obfuscation, identity-driven self-compromise, state corruption.
**Why OWASP should care:** The OWASP Top 10 for LLMs covers injection and data leakage, but the dominant threat class in this dataset — multi-turn social engineering — has no current OWASP coverage. This talk provides concrete field evidence for what's missing.
**Original content:** Alex presented the builder/defender perspective at a local Tel Aviv meetup ("Hack My Agent" on Luma). This talk combines both perspectives for the first time — Alex on building and hardening, Asaf on the systematic attack analysis. The combined narrative (builder + attacker), the full 14-pattern taxonomy, and the 10 key findings have not been presented together anywhere. The methodology (crowd-sourced adversarial analysis) and the taxonomy are original research.
**Vendor-neutral:** Asaf works in AI security at Microsoft, Alex is CTO at Esh. This talk is about the research findings, not any product. Attack patterns apply to any LLM agent platform.
