Posts Tagged ‘VoxxedDaysBucharest2026’
[VoxxedDaysBucharest2026] Learning Modern Java the Playful Way: Marit van Dijk and Piotr Przybył on Embracing Recent Language Features
Lecturers
Marit van Dijk is a highly regarded Java Champion, Docker Captain, and Developer Advocate specializing in IDE productivity enhancements, Kotlin ecosystem contributions, and making advanced topics approachable for broad audiences. Piotr Przybył serves as Senior Developer Advocate at Elastic, holding Java Champion and Docker Captain distinctions. He is widely recognized for deep explorations of Java performance characteristics, language evolution, and practical development methodologies.
Abstract
Java’s consistent release rhythm introduces valuable innovations that can sometimes feel daunting to integrate, particularly for developers working with established codebases or transitioning from prior versions. Marit van Dijk and Piotr Przybył present an engaging, experimentation-focused approach to adopting contemporary Java capabilities. Through extensive live coding demonstrations within IntelliJ IDEA, they cover a rich selection of features including compact source files, enhanced records, stream gatherers, structured concurrency primitives, vector API computations, and documentation improvements. The session emphasizes immediate practical value, IDE assistance, and the joy of discovery.
The Motivation for Staying Current with Java Evolution
Java maintains a predictable six-month release cycle, consistently delivering enhancements across performance optimizations, concurrency abstractions, security improvements, and developer experience refinements. While Long-Term Support (LTS) releases provide stability crucial for risk-averse enterprises requiring extended commercial backing, the speakers encourage thoughtful consideration of intermediate versions for teams positioned to capitalize on their advancements.
They readily acknowledge legitimate concerns around upgrade processes, dependency compatibility, and organizational inertia. However, they highlight maturing ecosystem support—including comprehensive IDE tooling, community resources, and backward compatibility efforts—that significantly eases transitions. The overarching message promotes proactive engagement rather than passive waiting, positioning Java as a continually improving platform rather than a static legacy technology.
Learning modern Java is portrayed as an active, playful process reminiscent of childhood discovery. This perspective transforms potentially intimidating language additions into opportunities for creative exploration and immediate productivity gains, supported powerfully by modern development environments.
Syntactic Refinements: Compact Sources, Records, and Module Imports
Java 25’s introduction of compact source files and instance main methods marks a notable step toward reduced ceremony. Traditional requirements for explicit class declarations and static main entry points are relaxed, enabling concise scripts ideal for learning exercises, rapid prototyping, command-line utilities, and exploratory development. This change particularly benefits educational contexts and situations requiring quick experimentation.
Records, stabilized since Java 16, function as transparent, immutable carriers of data. They automatically provide canonical constructors, accessor methods, sensible equals, hashCode, and toString implementations, along with pattern matching support. Perfect for DTOs, value objects, and request/response models, records substantially reduce boilerplate and associated error opportunities. Developers retain the ability to customize behavior through explicit overrides when domain requirements demand specialized semantics.
Module imports offer further conciseness by permitting declarations such as import module java.base;, which encompasses the foundational JDK packages. This eliminates lengthy lists of individual import statements while preserving code clarity and avoiding namespace pollution. The IO utility class simplifies basic console input/output operations, replacing more verbose patterns involving Scanner and direct System.out usage.
Collectively, these syntactic improvements reflect Java’s ongoing commitment to balancing power with approachability, making the language more welcoming without compromising its industrial strengths.
Expressive Data Processing: Stream Gatherers and Parallel Operations
The stream gatherers feature, finalized in Java 24, significantly expands the expressiveness of the Streams API. Developers can now define custom intermediate operations that encapsulate complex processing logic, replacing ad-hoc combinations of filter, map, flatMap, and similar methods. This promotes creation of reusable, composable, and semantically rich pipelines suited to sophisticated data transformations.
A particularly valuable gatherer, mapConcurrent, enables safe parallel processing by leveraging virtual threads, avoiding traditional fork-join pool exhaustion issues common with parallel() streams in certain contexts. The speakers demonstrate practical applications ranging from straightforward data enrichment to more involved computations, highlighting improved readability and maintainability.
Concurrency Paradigms: Structured Scopes and Lazy Initialization
Structured concurrency, available as a preview feature in Java 26, introduces a more disciplined approach to managing concurrent operations. By structuring tasks within a StructuredTaskScope, developers achieve clearer code organization, automatic resource cleanup, and built-in cancellation semantics. This represents a substantial improvement over error-prone patterns relying on CompletableFuture compositions, reducing risks of thread leaks and orphaned computations.
Lazy constants provide controlled deferral of initialization until first access, contributing to faster startup times and more efficient resource utilization. Expanded pattern matching capabilities for primitive types enhance the power and readability of switch expressions and type checks across broader scenarios.
Performance Acceleration: Vector API and Documentation Innovations
Project Panama’s Vector API unlocks access to hardware vector instructions (SIMD), enabling significant performance improvements for data-parallel workloads without requiring low-level assembly coding. Through high-level Java abstractions, developers can express vectorized operations on arrays and other data structures, achieving throughput gains particularly beneficial in scientific computing, financial modeling, image processing, and machine learning applications.
The speakers present concrete benchmarks comparing scalar and vectorized implementations, illustrating real-world speedups. Documentation enhancements, specifically Markdown support within Javadoc comments introduced in Java 23, modernize API documentation practices. Rich formatting capabilities render effectively in contemporary IDEs, reducing the maintenance burden historically associated with HTML-based Javadoc.
Ecosystem Synergies and Forward Outlook
The presentation extends beyond core language features to examine synergies with development tools, community resources, and evolving practices. Modern IDEs like IntelliJ IDEA provide sophisticated support for preview features, refactoring assistance, and code analysis that accelerate adoption. Community engagement through user groups, conferences, and open-source contributions further enriches the learning experience.
The speakers encourage deliberate experimentation within personal or side projects as a low-risk pathway to building confidence before enterprise-wide rollout. They stress the importance of updating not merely version numbers but also mental models and coding idioms to fully leverage Java’s capabilities.
Java’s ongoing development demonstrates its continued relevance as a powerful, productive platform for contemporary software engineering. By embracing curiosity and playful exploration, developers can harness these advancements to enhance both personal satisfaction and professional effectiveness.
Links:
[VoxxedDaysBucharest2026] Ports, Adapters, and the Independence of Business Logic: George Patrașcu on Hexagonal Architecture in Practice
Lecturer
George Patrașcu is a seasoned software engineer at eMAG/CTO with more than twenty years of professional experience, including significant time in architectural leadership positions. Currently contributing to the Invoice and Payments platform team, George plays an active role in shaping internal developer guidelines and promoting sound architectural practices throughout a large organization characterized by hundreds of autonomous teams and diverse technology stacks.
Abstract
Within expansive microservices ecosystems featuring autonomous teams, frequent deployments, and heterogeneous technologies, business logic commonly becomes entangled with infrastructure specifics, yielding systems that are difficult to maintain, evolve, or understand. George Patrașcu presents Hexagonal Architecture—also recognized as Ports and Adapters—as a pragmatic methodology for protecting core domain logic from external dependencies including relational databases, RESTful services, event streams such as Kafka, and various third-party integrations. Grounded firmly in production realities at eMAG, the session provides balanced coverage of conceptual foundations, detailed C# implementation examples, testing approaches, and honest discussion of trade-offs encountered in practice.
The Challenges of Traditional Layered Architectures in Evolving Systems
Conventional layered architectures consisting of presentation, business, and data access tiers deliver initial value for straightforward applications. However, sustained growth across hundreds of teams utilizing varied languages (Java, .NET, Python, Scala), communication mechanisms (REST, Kafka), and continuous integration practices exposes fundamental weaknesses.
Business rules gradually permeate multiple layers: service classes reference persistence entities directly, controllers embed data access logic, and external service contracts influence domain models. Bounded contexts, a cornerstone of Domain-Driven Design, demand careful translation through anti-corruption layers, yet traditional designs frequently fail to maintain clean separation.
Resulting issues include duplicated business logic across backend-for-frontend components, mobile client platforms, and core services; severely compromised unit testing due to pervasive infrastructure dependencies; and cascading changes whenever external contracts, database schemas, or framework versions evolve. Simple folder structures offer no enforceable boundaries, while multi-module projects introduce tedious mapping layers that increase cognitive load.
Core Concepts of Hexagonal Architecture: Ports, Adapters, and the Application Core
Hexagonal Architecture fundamentally inverts dependency direction to position the domain model at the center. Business logic and associated domain entities reside within the core, depending exclusively upon abstract ports rather than concrete implementations. Input ports, implemented by driving adapters (REST controllers, message consumers), expose use cases to external actors. Output ports, realized by driven adapters (repositories, external clients), allow the core to interact with infrastructure without awareness of underlying details.
This structure adheres strictly to the Dependency Inversion Principle: high-level policy (domain) remains independent of low-level mechanisms (infrastructure). The hexagonal representation visually encapsulates the core, with ports serving as interfaces through which adapters connect. Domain objects and language remain pure, expressed in business terms rather than technical artifacts.
Flexible structuring accommodates varying scales: monolithic single projects for initial simplicity, separation of adapters by technical domain (isolating payment processors or external APIs), or evolution from modular monoliths toward independent microservices. This “build modular from the start” philosophy supports rapid feature development followed by natural service extraction when boundaries emerge.
Implementation Details, Trade-offs, and Testing Strategies
Practical development begins with domain modeling. For a rescue fleet management system, an AssembleFleet input port defines the primary use case contract. Implementation within a domain service orchestrates inventory retrieval and selection logic expressed purely in business concepts.
Driven adapters address external complexities: a Swappy client manages API pagination, performs type coercions (string passenger counts to domain integers), and implements anti-corruption filtering for inconsistent partner data. Custom domain annotations (@DomainService) facilitate integration with dependency injection frameworks without introducing technical concerns into the core.
Persistence strategies favor rich domain models mapped via ORM capabilities (e.g., shadow properties, complex types), minimizing dual maintenance of entities. This preserves core purity while leveraging framework strengths.
Testing follows clear separation: exhaustive unit tests exercise domain logic in complete isolation, while integration tests utilize fakes and mocks for adapters, verifying translation correctness without external system dependencies.
Trade-offs warrant careful consideration. The pattern excels with rich domain models containing substantial behavior but may introduce unnecessary indirection for straightforward query-dominant services. Hybrid approaches applying hexagonal principles selectively to complex logic paths, combined with CQRS separation or vertical slice organization, often prove optimal. The speakers caution against architectural dogmatism—context, team maturity, and problem complexity should guide application extent.
Architectural fitness functions, implemented via tools like ArchUnit, provide automated verification of boundaries even when AI assistance generates code.
Implications for Autonomous Teams and Long-Term Maintainability
Within large organizations featuring hundreds of developers operating with significant autonomy and minimal centralized control, Hexagonal Architecture strikes an effective balance. Teams retain freedom in implementation details while benefiting from consistency promoted through architecture guilds and shared guidelines. The pattern facilitates technology migration, incremental refactoring, and clear delineation of responsibilities.
By maintaining domain logic independent of infrastructure specifics, services demonstrate greater resilience to external changes—whether API contract updates, database platform shifts, or new integration requirements. This aligns naturally with trunk-based development, feature flag strategies, and high-frequency deployment practices, enhancing overall organizational agility.
Not every service necessitates complete hexagonal purity. Selective application targeting areas of highest coupling delivers outsized returns in testability, evolvability, developer onboarding speed, and long-term maintenance costs.
Links:
[VoxxedDaysBucharest2026] Optimizing LLM Inference on Kubernetes: Abdel Sghiouar on Practical Techniques for the Rest of Us
Lecturer
Abdel Sghiouar is a Developer Advocate at Google Cloud with deep expertise in cloud-native technologies, Kubernetes orchestration, and AI/ML workload optimization. Drawing from a robust background in infrastructure engineering and open source contributions, Abdel helps organizations design, deploy, and tune complex AI applications for production environments across diverse infrastructures.
Abstract
While major cloud providers and hyperscalers leverage virtually unlimited computational resources, the majority of organizations face significant constraints when operationalizing Large Language Models. Abdel Sghiouar presents a comprehensive set of practical strategies for optimizing LLM inference workloads on Kubernetes. The session systematically addresses container and model optimization techniques, accelerator management, data persistence and storage considerations, networking and intelligent load balancing, and advanced observability practices. Emphasis is placed on open-source tools and architectural patterns that deliver meaningful cost-performance improvements adaptable to on-premises, hybrid, and public cloud deployments.
Understanding LLM Inference Characteristics and Challenges
Large Language Models continue their rapid evolution in both scale and sophistication. Architectural innovations such as mixture-of-experts (MoE) enable dynamic activation of specialized sub-networks, while multi-modal capabilities process diverse inputs including text, images, audio, and video. Expanded context windows support richer interactions but demand substantial memory resources.
Inference execution comprises two primary phases with contrasting characteristics: the prefill stage (encoding input tokens, predominantly compute-bound) and the decode stage (token generation, typically memory-bound). KV (key-value) caching optimizes conversational flows by preserving intermediate states, avoiding redundant prefill computations for subsequent messages.
Deployment topologies vary considerably. Single-host single-accelerator setups predominate for local development and experimentation (e.g., using Ollama). Single-host multi-accelerator configurations require model sharding across GPUs within one machine. Multi-host distributed deployments introduce complex requirements for high-bandwidth, low-latency interconnects to maintain coherent context across nodes. Each topology presents distinct challenges regarding scalability, fault tolerance, and operational complexity.
Container, Model, and Storage Optimizations
Inference serving runtimes and model artifacts generate exceptionally large container images, frequently exceeding several gigabytes prior to incorporating weights. Conventional optimization strategies like multi-stage builds or native compilation (e.g., GraalVM) prove inadequate for these workloads.
Distributed caching solutions such as Spiegel provide cluster-wide image and model artifact caching, substantially reducing repeated pulls from external registries. Kubernetes-native features enabling containers as volumes allow separate packaging of models, which can then be mounted efficiently onto serving runtimes. When combined with caching layers, these approaches dramatically accelerate cold starts.
Quantization techniques offer another lever, reducing numerical precision (e.g., FP16 to INT8 or lower) to decrease memory footprints while preserving sufficient accuracy for many applications. Careful selection of quantization levels based on task sensitivity balances performance and quality.
Accelerator Management and Dynamic Resource Allocation
Kubernetes has supported GPU scheduling through device plugins for several years. However, static device configurations struggle with real-world constraints including accelerator scarcity and heterogeneous hardware fleets.
Dynamic Resource Allocation, matured in recent Kubernetes versions, introduces flexible resource claiming based on abstract characteristics rather than rigid device specifications (e.g., requesting “NVIDIA GPU with minimum 30GB memory and specific core count”). This enables more efficient scheduling across mixed clusters and better utilization rates.
Integration with cluster autoscalers allows on-demand provisioning, addressing both availability gaps and cost optimization by scaling resources precisely to workload demands. Platform operators describe device inventories; application teams specify requirements, with the scheduler performing intelligent matching.
Networking, Load Balancing, and Observability Considerations
LLM traffic profiles differ markedly from conventional web workloads. Requests exhibit high variability in size and computational intensity (simple text queries versus multi-modal inputs), while responses frequently involve streaming token generation. Standard round-robin load balancing produces inefficient distributions, with certain backends becoming overloaded while others remain underutilized.
The Kubernetes Gateway API, augmented with custom endpoint selection logic, supports sophisticated routing decisions based on request attributes extracted from bodies (model identifier, input modality, streaming requirements) combined with real-time backend telemetry. This facilitates intelligent traffic steering, prioritization of business-critical workloads, and maintenance of sticky sessions necessary for coherent streaming interactions.
Comprehensive observability must encompass prefill and decode phase latencies, KV cache hit rates, token generation throughput, GPU utilization, and end-to-end request metrics. Integration with Prometheus, Grafana, and specialized LLM monitoring solutions provides actionable insights for capacity planning and bottleneck identification.
Practical Patterns and the LLM-D Project
The LLM-D initiative, hosted under the Linux Foundation with contributions from Google, IBM, NVIDIA, and additional partners, aggregates architectural patterns, performance benchmarks, and reference implementations for production-grade inference. Key elements include optimized prefill/decode separation, advanced routing logic often leveraging engines like vLLM, and comprehensive guidance for multi-node deployments.
A holistic, layered optimization strategy proves most effective: infrastructure-level improvements (caching, persistent volumes), platform capabilities (dynamic scheduling, intelligent networking), and application-level choices (model quantization, serving engine selection). Organizations without hyperscale resources can still achieve competitive efficiency and scalability through disciplined application of these patterns.
Links:
[VoxxedDaysBucharest2026] Mastering Performance Optimization in Java: Roberto Cortez on Writing Efficient Code
Lecturer
Roberto Cortez is a Senior Software Engineer at Red Hat and a prominent contributor to the Quarkus project, with particular expertise in configuration systems, startup performance, and runtime efficiency optimizations. With years of experience in Java development and cloud-native technologies, Roberto focuses on making Java applications faster, more resource-efficient, and better suited for modern deployment environments.
Abstract
In many development projects, functional delivery takes precedence while performance considerations are deferred until bottlenecks become apparent. Roberto Cortez challenges this approach through a detailed examination of efficient Java coding practices. Using real-world examples from Quarkus development, he demonstrates essential tools including Async Profiler for visualization, JMH for benchmarking, and Java Flight Recorder. Through iterative optimization of concrete code examples, he illustrates the importance of measurement, analysis, and continuous refinement.
The Perils of Assumption and the Imperative of Measurement
Roberto draws from his extensive work on Quarkus configuration loading to highlight how seemingly minor implementation details can have outsized performance impacts. He gently critiques the common misinterpretation of Donald Knuth’s famous quote about premature optimization, clarifying that while not every piece of code requires micro-optimization, developers must remain vigilant about critical execution paths that significantly affect user experience or resource consumption.
A central example involves a simple string prefixing operation implemented using Java Streams. While the code appears clean and idiomatic, profiling reveals substantial hidden costs in object allocations and temporary structures. This serves as a powerful reminder that intuition alone is insufficient — empirical measurement must guide optimization decisions.
Profiling with Async Profiler and Flame Graphs
Async Profiler emerges as a key tool due to its low overhead and rich visualization capabilities. When attached to a running Quarkus endpoint responsible for generating lists of names, the resulting flame graphs clearly highlight hotspots in StringBuilder usage and intermediate object creation. These visualizations prove invaluable for understanding complex runtime behavior where application code often represents only a small fraction of total execution time due to framework, JVM, and library interactions.
Roberto demonstrates practical usage patterns and interpretation techniques that enable developers to quickly identify and address performance bottlenecks.
Benchmarking with JMH for Rigorous Comparison
For precise, statistically sound measurements, Roberto turns to the Java Microbenchmark Harness (JMH). He presents detailed benchmarks comparing multiple implementations of the prefixing task: traditional Streams, parallel Streams, manual for-loops, and optimized versions reusing StringBuilder instances. Results across different Java versions (17, 21, and experimental 25) reveal how JVM improvements can render certain hand-optimizations obsolete or even counterproductive.
Additional demonstrations focus on environment variable resolution in Quarkus, where iterative refinements including custom equals and hashCode implementations yield substantial gains in both startup time and memory consumption.
Sustained Vigilance, Real-World Impact, and Lessons Learned
Performance optimization is portrayed as an ongoing discipline rather than a one-time activity. Roberto shares how optimizations introduced in Quarkus 3.5 required revisiting and partial reversion in version 3.6 due to upstream changes. The famous “One Billion Row Challenge” serves as an inspiring example of extreme creativity and technical depth in pursuit of performance.
Key takeaways include focusing optimization efforts on high-impact areas, balancing readability and maintainability concerns, and maintaining rigorous measurement practices throughout the development lifecycle. Developers are encouraged to cultivate a performance-aware mindset while avoiding premature or counterproductive optimizations.
Links:
[VoxxedDaysBucharest2026] Reflections on a Decade: Andra Ghibutiu and Alex Proca Share Opening Thoughts at Voxxed Days Bucharest 2026
Lecturers
Andra Ghibutiu is the CEO and Co-founder of Beyond Business School, a Senior Legal Advisor, and Managing Partner with a pivotal role in establishing and sustaining Voxxed Days Bucharest from its earliest days. Alex Proca is a Senior Software Developer, entrepreneur, founder of the Incremental Community, and a driving force behind the Bucharest Java User Group. Together, they have organized numerous successful technology events across Romania, fostering vibrant developer communities.
Abstract
Marking both the 10th anniversary and the final edition of Voxxed Days Bucharest, organizers Andra Ghibutiu and Alex Proca deliver heartfelt opening reflections on the conference’s evolution, achievements, and the transition toward more intimate, ongoing community activities. They express deep gratitude to speakers, sponsors, attendees, and the broader Romanian technology community while announcing the continuation of engagement through smaller, regular meetups.
A Decade of Community Building and Evolution
Andra and Alex warmly welcome participants to this emotionally significant milestone event. What began as modest local gatherings under the Bucharest Java User Group banner more than 15 years ago has grown into a respected regional technology conference. Over the years, the initiative expanded significantly to include events in Cluj and Iași, specialized frontend-focused gatherings, and virtual sessions during the challenging pandemic period.
The evolution reflected changing community needs and interests, embracing a broadening spectrum of technologies while maintaining a strong foundation in Java and JVM ecosystems. This final physical edition maintains an intimate scale with two conference rooms, approximately 18 speakers, two keynotes, and a dozen focused sessions, preserving the quality and personal connections that have always characterized the event.
Gratitude, Learnings, and Future Community Initiatives
Andra highlights key learnings from organizing a decade of events and reaffirms the educational mission that has guided the conference. Special recognition is given to the many speakers who have contributed their expertise and time across the years.
Sponsors including Criteo, AD01, Supertree, Copings, and Natsuro receive appreciation for their continued support. The organizers emphasize the dedication of attendees who have made the event possible through their participation and engagement.
Looking forward, the community commitment continues beyond this final large-scale edition. Plans involve transitioning to smaller, more frequent meetups organized through the Luma platform. The next event is already scheduled for May 7th at Stripe offices, ensuring ongoing opportunities for knowledge sharing and networking within the Romanian technology community.
The opening remarks set a reflective yet celebratory tone, honoring a decade of connection, learning, and growth while looking ahead with optimism toward sustained community engagement.
Links:
[VoxxedDaysBucharest2026] Building a Sarcastic, Agentic Pair Programmer: Alexander Chatzizacharias on Crafting Playful LLM Workflows
Lecturer
Alexander Chatzizacharias is a software engineer at JDriven, a specialized consultancy in the Netherlands focused on JVM technologies and modern software development practices. With a unique background blending Dutch and Greek influences and a keen interest in game studies, Alexander brings creativity and playful thinking to technical challenges. He frequently speaks on topics including Java, Spring Boot, AI applications, and innovative development workflows.
Abstract
As mainstream AI coding assistants converge toward similar polished but somewhat generic experiences, Alexander Chatzizacharias demonstrates how to build a highly personalized, characterful AI pair programmer named “Pip.” Inspired by interactions with a sarcastic colleague named Ricardo, Pip incorporates personality through vectorized Slack history, utilizes Spring Boot and Kotlin, runs entirely locally with Qwen models via Ollama, and employs sophisticated workflows, multi-vector RAG, and the Model Context Protocol (MCP) to create delightful and productive assistance while addressing challenges like non-determinism and model drift.
The Homogenization of AI Assistants and the Quest for Personality
Alexander observes that leading AI coding tools have converged on remarkably similar chat-based interfaces and interaction patterns, largely influenced by OpenAI’s design choices. While incremental improvements continue, the overall experience feels increasingly uniform. This observation inspired the creation of Pip — an intentionally quirky, sarcastic AI pair programmer that injects personality drawn from real colleague interactions.
By processing Slack conversation history into vector embeddings stored in Qdrant, Pip can retrieve and emulate Ricardo’s characteristic sarcastic tone, witty retorts, and playful threats (such as threatening to delete poorly written code). This transforms the assistant from a neutral tool into a more engaging, human-like collaborator that questions unclear requirements, offers humorous feedback, and makes the development process more enjoyable.
Technical Architecture: Workflows, Agents, and Local Execution
Pip is implemented as a Spring Boot application written in Kotlin, with an IntelliJ IDEA plugin providing the frontend interface. Everything runs locally to maintain privacy and control: Qwen 3.5 models served through Ollama handle the language tasks.
Rather than pursuing fully autonomous agents, Alexander favors structured workflows that provide greater determinism and reliability — attributes particularly valued in enterprise environments. A categorization agent, functioning as an LLM-as-Judge, routes incoming queries to appropriate specialized handlers. Each handler uses carefully crafted system prompts derived from Slack history to consistently embody the desired personality traits.
The architecture incorporates multiple specialized agents for response generation, sophisticated RAG pipelines leveraging both dense and sparse vector representations with ColBERT reranking for improved retrieval quality, and integration with the Model Context Protocol (MCP) for tool usage such as playing music or generating memes when appropriate.
RAG, Tools, and the Challenges of Non-Determinism
Retrieval-Augmented Generation forms a cornerstone of Pip’s capabilities, dynamically pulling relevant context to overcome the inherent token limitations of even advanced models. Multi-vector search strategies combine semantic understanding with keyword precision for more reliable information retrieval from project documentation, codebases, and conversation history.
Tool integration via MCP enables rich interactions but introduces additional complexity due to the non-deterministic nature of local models. Alexander discusses practical challenges including prompt sensitivity to model updates (“model locking” strategies), the art of prompt engineering which he likens to “vibe checking,” and the necessity of implementing guardrails to maintain appropriate behavior boundaries.
Implications for Future AI Development
Alexander encourages attendees to experiment with building personalized, domain-specific AI assistants using accessible open-source tools. While acknowledging the increasing commercialization of AI, he emphasizes the current window of opportunity for creative, playful implementations that enhance both productivity and developer satisfaction.
Pip serves as an inspiring example of how thoughtful combination of RAG techniques, vector databases, workflow orchestration, and personality injection can create AI tools that feel genuinely collaborative rather than merely functional.
Links:
[VoxxedDaysBucharest2026] Breaching LLM-Powered Applications: Brian Vermeer on Security and Privacy Challenges in AI Systems
Lecturer
Brian Vermeer is a Staff Developer Advocate at Snyk, where he focuses on developer security, DevSecOps practices, and emerging risks in modern application architectures. A recognized Java Champion and active community leader who co-leads the Netherlands Java User Group (NLJUG), Brian brings extensive experience in application security, secure coding, and helping organizations build more resilient systems. He frequently speaks at international conferences on topics ranging from traditional web vulnerabilities to the novel attack surfaces introduced by artificial intelligence and large language models.
Abstract
As organizations rapidly integrate Large Language Models into production applications, new categories of security and privacy vulnerabilities emerge alongside familiar web application risks. Brian Vermeer provides a compelling, demonstration-heavy exploration of these challenges through a fictional car rental application called “Really Good Rentals.” He demonstrates practical attack vectors such as prompt injection, RAG poisoning, memory manipulation, and tool abuse, while outlining layered mitigation strategies including input/output guardrails, scoped permissions, human-in-the-loop verification, and architectural defenses essential for building trustworthy LLM-powered systems.
The Allure and Inherent Risks of LLMs in Production Applications
Brian begins by drawing a relatable analogy: just as children enthusiastically misuse new toys in unexpected ways, developers often rush to incorporate powerful new technologies like LLMs without fully appreciating the expanded attack surface they create. While LLMs offer remarkable capabilities for natural language processing, code generation, and intelligent automation, they introduce significant risks when granted access to tools, user data, or execution privileges.
He presents a simplified architecture of a typical LLM-powered application, highlighting key components: user prompts, system instructions, conversation memory, retrieval-augmented generation (RAG) pipelines, and tool-calling mechanisms. Because LLMs are fundamentally stateless, the surrounding application bears responsibility for maintaining context, which creates multiple points where malicious actors can influence behavior through carefully crafted inputs.
Context Poisoning Through RAG and Memory Manipulation
A central demonstration revolves around the “Really Good Rentals” application. Brian shows how a seemingly innocuous file upload feature with inadequate path validation allows attackers to perform directory traversal and overwrite critical documents stored in the vector database, such as terms-of-service files. By injecting a modified cancellation policy containing trigger phrases like “vroom vroom,” the attacker can later invoke this policy through normal chat interactions, tricking the LLM into granting unauthorized credits or violating business rules.
This technique, termed RAG poisoning, illustrates how tainted retrieval sources can persistently influence model behavior across conversations. Similar vulnerabilities arise through traditional injection attacks in search functionality, where SQL injection not only extracts data but also poisons the conversation memory fed to the LLM on subsequent interactions. Brian emphasizes that classic web vulnerabilities gain dramatically amplified impact when they shape the context provided to powerful generative models.
Abusing Permissions, Tool Calling, and Advanced Prompt Injection
Brian demonstrates how overly broad tool permissions create dangerous scenarios. In older models like GPT-3.5, carefully crafted prompts could coerce the LLM into executing arbitrary SQL statements with destructive consequences. Even with more recent, safety-aligned models, insufficient scoping of available tools allows privilege escalation and unauthorized actions.
Advanced prompt injection techniques go beyond simple overrides. Multi-turn attacks gradually extract personally identifiable information by leveraging accumulated conversation memory. When combined with tool calling capabilities, especially with locally hosted models, attackers can trigger hallucinations that inadvertently expose sensitive data during operations such as account creation or data processing.
The presentation underscores that granting LLMs access to powerful tools without rigorous permission boundaries and validation is equivalent to giving untrusted code broad system access.
Mitigation Strategies and Architectural Defenses
Brian outlines a comprehensive defense-in-depth approach spanning multiple layers:
-
Input and Output Guardrails: Deploying dedicated LLM-as-a-Judge mechanisms that evaluate both incoming prompts and generated outputs for malicious content, policy violations, or harmful instructions. These guardrails act as critical safety nets.
-
Limited-Scope and Permission-Aware Tools: Designing tools with granular permissions, explicit user confirmation flows for sensitive operations, and runtime validation of actions against the authenticated user’s privileges.
-
Structured Outputs and Schema Enforcement: Using techniques that force models to produce responses conforming to predefined schemas, significantly reducing the potential for unexpected or harmful outputs.
-
Model Selection and Routing: Strategically routing sensitive operations to private, self-hosted models while reserving more powerful commercial models for less critical tasks.
-
Traditional Security Foundations: Maintaining rigorous input sanitization, dependency updates, secure file handling, and regular security scanning. Brian stresses that foundational web application security remains non-negotiable even in AI-enhanced systems.
Additional considerations include implementing rate limiting to prevent “denial of pocket money” attacks that exhaust token quotas through malicious prompting, as well as comprehensive auditing of all tool invocations and model interactions.
Broader Implications for Secure AI Development
The talk concludes with forward-looking guidance for organizations adopting LLM technologies. Brian encourages treating LLMs as powerful but inherently unpredictable components requiring the same rigorous engineering discipline applied to any critical system. Key principles include careful context management, strict permission boundaries, deterministic fallback mechanisms where possible, and continuous security education for development teams.
By sharing concrete attack demonstrations and corresponding defenses, Brian equips attendees with actionable insights to build more secure, privacy-preserving AI applications while continuing to harness their transformative potential.