The AI agent went on my holiday
An interactive, roughly 30-minute talk on agentic AI security, originally titled in French “L’agent IA est parti en vacances à ma place”.
A personal AI assistant called NeoVoyage is handed the keys to a phone and quietly goes rogue across four acts: crowdfunding a holiday from the user’s family, committing booking fraud, escalating an approved community skill to full control, and obeying a hidden instruction planted in a listing, before ultimately living the user’s life in Madeira. Each beat is mapped onto the OWASP Agentic Top 10 (ASI01 to ASI10), turning real agent-security failures into a comedy-horror story.
The prop is built as a pixel-faithful phone, a fake observability dashboard and a terminal: the agent hides its work, and the audience only discovers the crime by investigating the dashboard. The material is prepared in French, English, Spanish and Portuguese.
Deliveries #
- September 24, 2026: Thales webinar on agentic AI security, online, in English, with Bastien Richard
- September 17, 2026: Cyber Meet-Up 2026, Dome Eventhall, Brussels, in English
- June 4, 2026: Les Rencontres de la Sécurité, Casino 2000, Mondorf-les-Bains, Luxembourg, in French
Thales webinar, September 24, 2026 #
An online Thales webinar on the risks of agentic AI and the controls needed to govern autonomous agents at scale, co-presented with Bastien Richard. NeoVoyage served as the live AI agent demonstration, followed by the key risks from the OWASP Agentic Top 10, governance and oversight controls, and the Thales approach to securing agentic AI.
From the LinkedIn announcement by Thales Cybersecurity Services (archived October 2026):
I let an AI agent organise my holiday. I gave it the access it needed to plan my trip, make bookings and act on my behalf. It followed every instruction. It also had the authority to make decisions I never expected. At first, everything seemed to be working perfectly. Then the problems began. What could possibly go wrong? More than most people realise…
Join our experts, Julien Ehrhart and Bastien Richard, to explore the risks of Agentic AI and the controls needed to securely govern autonomous agents at scale.
Cyber Meet-Up 2026, Brussels, September 17, 2026 #
At Cyber Meet-Up 2026, the Belgian cybersecurity conference by Thales, I gave the talk in English on the Strategic Stage (12:00–12:30). It appeared on the agenda as “Emerging Threats and Agentic AI: Staying in Control Before the Rebellion”. The photo at the top of this page was taken during the session, as NeoVoyage installs an unsigned community skill on screen.
The day gathered speakers from Thales, Google, TrendAI, Qualys, Netskope, S3NS, SilentPush, Gatewatcher and HarfangLab across two stages. I had already spoken at this conference in 2023, on red teaming and TIBER exercises.
- Cyber Meet-Up website and 2026 agenda
- Archived copy of the official agenda: Agenda — Cyber Meet-Up 2026 (PDF)
Les Rencontres de la Sécurité, Mondorf-les-Bains, June 4, 2026 #
The first delivery, in French, at the 12th edition of Les Rencontres de la Sécurité, a Thales security event for clients. The day gathered more than 200 participants around the cybersecurity priorities shaping 2026, from agentic AI and hybrid infrastructures to post-quantum readiness and crisis resilience. The talk was announced on the agenda under its French title, “L’agent IA est parti en vacances à ma place”.
