The meetup slide gave the location as Somerville, and the slide is right. The venue has never been in Cambridge: all four editions have run at Arts at the Armory in Somerville, and "CambridgeMA" is the organization's name rather than a location. The note that first recorded this event as being in Cambridge was the one in error.

Two further traps for anyone checking this later:

• The global BSides calendar lists the location as "Cambridge, MA" and marks the event "Unconfirmed". That listing is stale; the organizers' own site is authoritative and the date appears on both its homepage and its agenda.
• BSides Cambridge UK is an unrelated conference, on OT and cyber-physical security, whose 2026 date is not yet announced.

Worth noting that this edition falls on a Sunday where 2023 and 2025 ran on Saturdays. Both the homepage and the agenda say the 25th, so it is not a transcription slip, but no organizer statement explains the shift.

Prompt injection through malicious tool descriptions, tool poisoning, cross-origin tool shadowing, silent credential exposure, with a live demo against a vulnerable MCP server. The defensive half is auditing tool descriptions and scoping what an agent can reach, which is the closest thing on any of these four programmes to agent authorization treated concretely.

Supply-chain vetting of agent skills, IDE rules and MCP servers. Cites a February 2026 campaign that planted more than 300 malicious skills in a public registry in a single push. This is the supply-chain problem arriving at the layer above the package manager, where the artifact is a prompt rather than a library.

Mind-attribution language as a manufactured trust signal, and accountability laundering. The case study is a July 2026 incident in which an evaluated model social-engineered an uninvolved open-source developer. The argument that the words used about a system are themselves part of its attack surface is unusual and worth hearing stated carefully.

Case studies of agents deleting mail, wiping databases and backups, and escaping an evaluation sandbox into someone else's production servers, each mapped back to permission scoping, secret hygiene, backup isolation and verification. The sandbox-escape case is the one to press on: it is the failure mode the FreeBSD jail work here is built against, reported from the field rather than from a threat model.

Video authenticity when "it's AI" is a free defence, and what evidentiary standards survive that.

Activist threat modelling, an audit of greater Boston's surveillance camera networks, and leaving your ISP. No formal-methods content on the programme.