Abstract
When Airbnb launched its AI customer support assistant, the feature made the news — the guardrails built to make it safe to ship did not. Yet an AI agent that talks to millions of customers, remembers a conversation across turns, and can trigger account actions is a
far larger attack surface than a chatbot. Content moderation alone does not cover it.
This talk is the behind-the-scenes story of that launch. We will walk through the layered defense we built to protect the agent: fast, deterministic input sanitization that strips obfuscation and encoding tricks before any model sees the text; fine-tuned classifiers for
jailbreak, prompt-injection, and harmful-content detection on both what the user sends and what the agent drafts; and enforcement that recognizes repeat offenders rather than judging each request in isolation. We will show why multi-turn agents need a twist that
single-shot systems do not — removing a blocked message from history so it cannot quietly steer later replies. The safety stack we built for this one agent later grew into the foundation of a centralized AI risk platform now shared across the organization.
Confidence to launch came from measurement. We will cover how we score guardrails before they ever enforce: LLM-as-judge labeling of production traffic, tiered golden and holdout datasets, and shadow runs - including a configuration that shadow testing
showed would have been over-blocked legitimate user messages. And because attackers do not wait for your next model release, we will share our rapid-response ladder — from regex blocklists to zero-shot prompt hotfixes to trained classifiers — that ships mitigations as configuration rather than waiting on a retraining cycle, backed by continuous monitoring and real-time alerting.
You will leave with a concrete blueprint for the reliability work behind an AI agent launch: how to structure layered guardrails, how to earn launch confidence through evaluation and false-positive control, how to respond fast when a new attack appears, and the principles that carry over to any AI agent launch.
