JavaZone 2026: Building Secure AI Agents with Quarkus LangChain4j

A model on its own is a text predictor. An agent is that model wrapped in a loop that can call tools, read data and keep acting until it decides the task is done. That loop is the whole point, and it is also the whole problem.

Three things make securing an agent different from securing a normal web app, and we came back to them all session:

The obvious way to run a workshop like this is to have everyone build an agent from scratch. We did the opposite. Participants were handed a finished application, a JavaZone Conference Assistant that works perfectly well and is also deliberately insecure, and then spent the two hours attacking it and fixing it.

Each topic worked the same way: attack the running agent, watch it do the wrong thing, write the fix, then attack again to check it holds. You learn more from the attack than from typing out the setup code, and the fixes turn out to be small, which is the point.

The application is two Quarkus services:

The tools live on the server, not in the agent:

The threat model was the room itself. Everyone logged in as alice, a plain attendee, while bob was an attendee with the organizer role, and carol and dave existed purely as data to be stolen. Every attack was something a normal attendee should never be able to do.

Four core modules of roughly 25 minutes each, plus an optional fifth, each mapped onto the OWASP Top 10 for LLM Applications .

It all comes down to knowing who is asking. The agent decides nothing on its own, the server makes the call, and the server can only do that if the agent passes the user's token along. Everything else, the role checks and the document filtering, depends on that one thing being in place.

Guardrails are worth having, but they are a safety net rather than the real defence. The checks inside the agent (input guardrail, hardened prompt, output guardrail, rate limit) make life harder for an attacker. The checks on the server (who is asking, what they own, what their role allows, and an audit log of it all) are what actually stop them. And you need to be able to see what the agent is doing, or none of it is much use.

If you remember one sentence: pass the user's identity all the way through to wherever the decision gets made.

The room was full, and the session ran smoothly. The participants left having learned the content. Willem Jan and I left having learned what can possibly go wrong across that many different laptops.

The biggest bottleneck was model inference on the laptops themselves. We expected trouble there and we got it, but we found workarounds, even if it sometimes meant participants working together on one machine.

The pleasant surprise was the network. I had worried that nobody would manage to download a local model over conference Wi-Fi, and it turned out to be fast enough for everyone to at least finish the first step. There were setup issues, of course, but they stayed minor.

AI was everywhere, but the tone had changed. Very little of it was about getting a model to say something impressive. Most of it was about what happens once an agent is in production and nobody is watching: Baruch Sadogursky on the four context antipatterns that kill your AI agent, Einar Ingebrigtsen arguing that event sourcing is the only sane way to run agentic systems, Kevin Dubois on agentic self-healing rollouts, and Daniel Oh on agent patterns and MCP in Java applications. Of the four, I enjoyed Daniel's most, for the delivery alone.

There was a lot on security too, which was a good sign for our workshop topic. Brian Vermeer gave a full session on prompt injection techniques and escalation, and Ixchel Ruiz walked through what the CRA deadlines mean for senior Java engineers before December 2027.

There was still plenty of plain Java and JVM content, which is part of why JavaZone is worth the trip. Georges Saab on modern Java in the age of AI, Cay Horstmann on Java patterns and when not to use them, Adele Carpenter on ten things she hates about Java, and Steve Poole on getting from JDK 8 to 25 without the pain.

On the framework and platform side there was Josh Long on Spring Boot 4 and, closer to home for us, Georgios Andrianakis on seven years of building Quarkus and what they learned along the way. I have now seen more than one version of that talk, and it has never disappointed. Kubernetes operators, Crossplane, buildpacks, OpenTelemetry and internal developer platforms filled out the rest.

I did not get to everything, and there were many more sessions I wish I had seen in person. Even when a talk covers ground you already know, it is worth sitting in: you come away with an angle on it you had not considered.

I have given talks and workshops before, so I did not expect to be surprised by how another conference is put together. This one surprised me. The venue, the location, the food, the people, and all the small details: JavaZone is very well organised, and you notice it, especially when you are the one at the front of the room.

I will gladly return if I get the chance.