{"id":3228,"date":"2026-05-21T01:33:14","date_gmt":"2026-05-20T23:33:14","guid":{"rendered":"https:\/\/tokyotestfest.com\/?page_id=3228"},"modified":"2026-05-15T21:42:22","modified_gmt":"2026-05-15T19:42:22","slug":"max_2026","status":"publish","type":"page","link":"https:\/\/tokyotestfest.com\/en\/max_2026\/","title":{"rendered":"Max_2026"},"content":{"rendered":"[vc_row type=”full_width_background” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” bg_color=”#bf3225″ scene_position=”center” top_padding=”50″ bottom_padding=”50″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_custom_heading text=”Speakers” font_container=”tag:h1|font_size:44|text_align:center|color:%23ffffff” use_theme_fonts=”yes”][\/vc_column][\/vc_row][vc_row type=”full_width_background” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” bg_image=”34″ bg_position=”left top” background_image_loading=”default” bg_repeat=”no-repeat” scene_position=”center” top_padding=”60px” constrain_group_1=”yes” bottom_padding=”60px” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/6″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][\/vc_column][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”2\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_custom_heading text=”Max Turner” font_container=”tag:h2|font_size:36|text_align:center|color:%23bf3225″ use_theme_fonts=”yes”][divider line_type=”No Line” custom_height=”32px”][image_with_animation image_url=”3233″ image_size=”medium” animation_type=”entrance” animation=”None” animation_movement_type=”transform_y” hover_animation=”none” alignment=”center” img_link_target=”_blank” border_radius=”none” box_shadow=”none” image_loading=”default” max_width=”100%” max_width_mobile=”default”][vc_custom_heading text=”Biography” font_container=”tag:h4|font_size:20|text_align:left|color:%23bf655d” use_theme_fonts=”yes”][vc_column_text text_direction=”default”]Max Turner is a cybersecurity leader at Red Sentry, where he focuses on turning complex security challenges into clear and actionable insights.\u00a0 He works closely with the Pentesting, Marketing, Sales, Engineers, and Leadership to foster knowledge sharing and career growth across the house. With a diverse background spanning everything from logging to teaching to window cleaning to logistics coordination, he began his IT career in network administration before discovering a love for cybersecurity and moving into penetration testing.\u00a0 He has a knack for leadership and has grown into a leadership role through a consistent, solutions-first mindset and a natural tendency to gather and nurture positive communities wherever he goes.<\/span><\/p>\n

Known for his ability to translate technical depth into real-world impact, Max works with both technical and non-technical audiences, whether advising clients, collaborating across teams, or speaking at industry events.\u00a0 He has the right mix of technical knowledge, curiosity, and approachability to close the gap between the deeply technical and business side of the house.\u00a0 Having worked for several years as a teacher, he centers his approach on making cybersecurity practical, understandable, and relevant beyond just the technical details.<\/span><\/p>\n

Originally from the United States and based in Japan since 2015. Max loves exploring new places and has a habit of finding like-minded friends wherever he goes. Outside of cybersecurity, he is a husband, father of three, runner, casual gamer, and avid rock climber who believes that storytelling and the occasional dad joke can make even the most complex topics interesting and approachable for anyone.<\/span><\/p>\n

Linkedin – Max<\/span><\/a>[\/vc_column_text][divider line_type=”No Line” custom_height=”42px”][vc_custom_heading text=”About the Lightning Talk” font_container=”tag:h4|font_size:20|text_align:left|color:%23bf655d” use_theme_fonts=”yes”][vc_column_text text_direction=”default”]\n

Why do hackers’ ears prick when they find out you code using AI?<\/strong><\/h3>\n

 <\/p>\n

Recently, our team heard about a case where an AI coding agent wiped a company’s entire production database, along with its backups, in seconds.\u00a0 This is not an AI going rogue story; it’s an access control failure at machine speed.\u00a0 We are starting to see versions of that same pattern show up regularly in real applications.\u00a0 In this talk, I am going to explain why these patterns excite our team as ethical hackers, and why less ethical hackers will be just as excited about them.<\/span><\/p>\n

Situations like the code-wiping agent signal a shallow implementation and build, likely shipped under a tight deadline, which is nothing new.\u00a0 The difference in this case is that the application’s architects did not have to build its code block by block. They didn’t have to research, test, fail, and repeat until they had a solid working product.\u00a0 The product they have works, but it is likely that few, if any, of the engineers have a solid working knowledge of it at the source code level.\u00a0 They were able to ship the code faster than it took them to understand it.<\/span><\/p>\n

In this talk I am going to give some examples of findings that our team has uncovered while testing applications built utilizing AI.\u00a0 These apps are all either AI-code-assisted, integrated with AI functionality, or completely vibe coded.<\/span><\/p>\n

Broken Access Control is something we have been writing on our reports for a long time and we see it often in apps built using AI.\u00a0 It can be accomplished in a number of ways.\u00a0 Recently, we did some work on an app that utilized the Supabase Backend-as-a-Service platform.\u00a0 Instead of using a low-privilege \u2018anon\u2019 key in its browser, the vibe-coded app initialized Supabase with the \u2018service\u2019 role key, buried in the front-end JavaScript. This key basically allows us to do whatever we want in the back-end of this app, access and act as whatever user or tenant we want, and see data that had never been exposed in the front-end UI.\u00a0 Big problem.<\/span><\/p>\n

Another common thing we see is exposed API keys.\u00a0 Recently we tested an AI-built app that revealed its Gemini api key. Using that key, we got access to our client\u2019s internal AI model.\u00a0 Not only could we use the model to browse and view internal files, but abuse of that vulnerability would put a severe financial strain on the client, as they would be responsible for the bill for all tokens used.<\/span><\/p>\n

There are some applications we test that are integrated directly with an LLM or MCP.\u00a0 The team can get wild with those.\u00a0 Very recently we tested such an environment, and it had a limited Sonnet 4.6 model.\u00a0 Our tester prompt-injected the model to run an assessment inside its own Firecracker microVM using its code_exec tool.\u00a0 It found a Claude user with CLI, but no exposed tools.\u00a0 The team then used the application\u2019s own MCP as a wrapper over the Claude CLI to run it with full system access.<\/span><\/p>\n

The above are good examples of Overexposed APIs and Overprivileged systems, including the 9-second database wipe we opened with.\u00a0 In addition to these we will explore some IDOR\/broken object-level authentication and missing guardrails like rate limiting\/logging.The recurring theme is that most of the time we aren\u2019t exploiting the AI, we are exploiting the access and assumptions behind it.<\/span>[\/vc_column_text][divider line_type=”No Line” custom_height=”32px”][\/vc_column][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/6″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"

[vc_row type=”full_width_background” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” bg_color=”#bf3225″ scene_position=”center” top_padding=”50″ bottom_padding=”50″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default”…<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"footnotes":""},"class_list":["post-3228","page","type-page","status-publish"],"yoast_head":"\nMax_2026 - Tokyo Test Fest - The Annual International Testing Conference in Japan<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/tokyotestfest.com\/en\/max_2026\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Max_2026 - Tokyo Test Fest - The Annual International Testing Conference in Japan\" \/>\n<meta property=\"og:description\" content=\"[vc_row type=”full_width_background” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” bg_color=”#bf3225″ scene_position=”center” top_padding=”50″ bottom_padding=”50″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default”...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/tokyotestfest.com\/en\/max_2026\/\" \/>\n<meta property=\"og:site_name\" content=\"Tokyo Test Fest - The Annual International Testing Conference in Japan\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/tokyotestfest\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@tokyotestfest\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"24 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/tokyotestfest.com\/en\/max_2026\/\",\"url\":\"https:\/\/tokyotestfest.com\/en\/max_2026\/\",\"name\":\"Max_2026 - Tokyo Test Fest - The Annual International Testing Conference in Japan\",\"isPartOf\":{\"@id\":\"https:\/\/tokyotestfest.com\/#website\"},\"datePublished\":\"2026-05-20T23:33:14+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/tokyotestfest.com\/en\/max_2026\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/tokyotestfest.com\/en\/max_2026\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/tokyotestfest.com\/en\/max_2026\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/tokyotestfest.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Max_2026\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/tokyotestfest.com\/#website\",\"url\":\"https:\/\/tokyotestfest.com\/\",\"name\":\"Tokyo Test Fest - The Annual International Testing Conference in Japan\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/tokyotestfest.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/tokyotestfest.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/tokyotestfest.com\/#organization\",\"name\":\"Tokyo Test Fest - \u65e5\u672c\u3067\u6bce\u5e74\u958b\u50ac\u3055\u308c\u308b\u3001\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u30c6\u30b9\u30c8\u306e\u56fd\u969b\u30ab\u30f3\u30d5\u30a1\u30ec\u30f3\u30b9\",\"url\":\"https:\/\/tokyotestfest.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/tokyotestfest.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/tokyotestfest.com\/wp-content\/uploads\/2025\/04\/Tokyo-Test-Fest-Organization-Logo.png\",\"contentUrl\":\"https:\/\/tokyotestfest.com\/wp-content\/uploads\/2025\/04\/Tokyo-Test-Fest-Organization-Logo.png\",\"width\":696,\"height\":696,\"caption\":\"Tokyo Test Fest - \u65e5\u672c\u3067\u6bce\u5e74\u958b\u50ac\u3055\u308c\u308b\u3001\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u30c6\u30b9\u30c8\u306e\u56fd\u969b\u30ab\u30f3\u30d5\u30a1\u30ec\u30f3\u30b9\"},\"image\":{\"@id\":\"https:\/\/tokyotestfest.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/tokyotestfest\",\"https:\/\/x.com\/tokyotestfest\",\"https:\/\/www.linkedin.com\/company\/tokyotestfest\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Max_2026 - Tokyo Test Fest - The Annual International Testing Conference in Japan","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/tokyotestfest.com\/en\/max_2026\/","og_locale":"en_US","og_type":"article","og_title":"Max_2026 - Tokyo Test Fest - The Annual International Testing Conference in Japan","og_description":"[vc_row type=”full_width_background” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” bg_color=”#bf3225″ scene_position=”center” top_padding=”50″ bottom_padding=”50″ text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default”...","og_url":"https:\/\/tokyotestfest.com\/en\/max_2026\/","og_site_name":"Tokyo Test Fest - The Annual International Testing Conference in Japan","article_publisher":"https:\/\/www.facebook.com\/tokyotestfest","twitter_card":"summary_large_image","twitter_site":"@tokyotestfest","twitter_misc":{"Est. reading time":"24 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/tokyotestfest.com\/en\/max_2026\/","url":"https:\/\/tokyotestfest.com\/en\/max_2026\/","name":"Max_2026 - Tokyo Test Fest - The Annual International Testing Conference in Japan","isPartOf":{"@id":"https:\/\/tokyotestfest.com\/#website"},"datePublished":"2026-05-20T23:33:14+00:00","breadcrumb":{"@id":"https:\/\/tokyotestfest.com\/en\/max_2026\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/tokyotestfest.com\/en\/max_2026\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/tokyotestfest.com\/en\/max_2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/tokyotestfest.com\/en\/"},{"@type":"ListItem","position":2,"name":"Max_2026"}]},{"@type":"WebSite","@id":"https:\/\/tokyotestfest.com\/#website","url":"https:\/\/tokyotestfest.com\/","name":"Tokyo Test Fest - The Annual International Testing Conference in Japan","description":"","publisher":{"@id":"https:\/\/tokyotestfest.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/tokyotestfest.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/tokyotestfest.com\/#organization","name":"Tokyo Test Fest - \u65e5\u672c\u3067\u6bce\u5e74\u958b\u50ac\u3055\u308c\u308b\u3001\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u30c6\u30b9\u30c8\u306e\u56fd\u969b\u30ab\u30f3\u30d5\u30a1\u30ec\u30f3\u30b9","url":"https:\/\/tokyotestfest.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/tokyotestfest.com\/#\/schema\/logo\/image\/","url":"https:\/\/tokyotestfest.com\/wp-content\/uploads\/2025\/04\/Tokyo-Test-Fest-Organization-Logo.png","contentUrl":"https:\/\/tokyotestfest.com\/wp-content\/uploads\/2025\/04\/Tokyo-Test-Fest-Organization-Logo.png","width":696,"height":696,"caption":"Tokyo Test Fest - \u65e5\u672c\u3067\u6bce\u5e74\u958b\u50ac\u3055\u308c\u308b\u3001\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u30c6\u30b9\u30c8\u306e\u56fd\u969b\u30ab\u30f3\u30d5\u30a1\u30ec\u30f3\u30b9"},"image":{"@id":"https:\/\/tokyotestfest.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/tokyotestfest","https:\/\/x.com\/tokyotestfest","https:\/\/www.linkedin.com\/company\/tokyotestfest\/"]}]}},"_links":{"self":[{"href":"https:\/\/tokyotestfest.com\/en\/wp-json\/wp\/v2\/pages\/3228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tokyotestfest.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/tokyotestfest.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/tokyotestfest.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/tokyotestfest.com\/en\/wp-json\/wp\/v2\/comments?post=3228"}],"version-history":[{"count":2,"href":"https:\/\/tokyotestfest.com\/en\/wp-json\/wp\/v2\/pages\/3228\/revisions"}],"predecessor-version":[{"id":3235,"href":"https:\/\/tokyotestfest.com\/en\/wp-json\/wp\/v2\/pages\/3228\/revisions\/3235"}],"wp:attachment":[{"href":"https:\/\/tokyotestfest.com\/en\/wp-json\/wp\/v2\/media?parent=3228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}