“Every talk about AI quality assumes the same quiet thing: that your product is being used in good faith. It isn’t. The moment an AI system ships, it acquires adversaries — users probing for the embarrassing answer, customers feeding it inputs you never imagined, and increasingly, attackers who treat your model as an attack surface. Traditional quality asks “”does it work?”” Adversarial quality asks “”what happens when someone wants it to fail?”” Those are different questions, and most teams are only answering the first one.

This session makes the case that in 2026, quality and security have collapsed into the same discipline – and QE is where they meet. Drawing from building and shipping AI products, this talk moves past correctness into the territory the rest of the agenda leaves untouched: prompt injection, jailbreaks, data exfiltration through model outputs, poisoned context, and the uncomfortable reality that your AI’s most dangerous behavior won’t show up in any test suite written by someone being polite to it. We’ll look at why “”it passed eval”” is a false comfort, how to build an adversarial mindset into a QE function that was trained to verify, not attack, and what it actually takes to break your own product before the internet does it for you.”