Notes from CHI 2026: HCI, AI & the Future of Agentic Security
A week of sessions, a designathon, and a lot of conversations about the impact of AI. Here’s what stuck with me and why it matters for how we design agentic systems.
We kicked off CHI 2026 with a designathon meet-up; I helped co-organize: Generative Design and Vibe Coding: Rethinking The Design-Development Divide for UI Prototyping (Zhang et al., CHI EA 2026). Ninety minutes on the clock, v0.dev and Lovable sponsoring with credits, and a room of designers, developers, and researchers building things fast. The website has the full proposal, and Xinqi Zhang’s LinkedIn recap has more photos and info.
Two things stood out to me:
- The first was how unblocked people were. These tools let “individuals with little design or coding experience to meaningfully participate in creative and technical processes”. I saw it in real time: people without SWE backgrounds producing interactive prototypes alongside engineers with years of experience, in the same hour, on roughly the same footing.
- The second was what this means once these prototypes become products. The same paper (citing Pimenova et al., 2025) describes the gap: vibe coding “introduce[s] breakdowns in trust, focus, and understanding,” and creates “the uneasy experience of surrendering control to AI during creative flow.” That mainly refers to creative control, but the mismatch between what you shipped and how well you understand what you shipped is exactly the gap that gets exploited when the thing goes live.
The floor of who can build has basically been removed, but the floor of who can secure what they’ve built isn’t moving nearly as fast.
This designathon has inspired me to think harder about what makes vibe coding more robust across every level of expertise: tools that help users not just ship, but understand what they’re shipping.
The Research Sessions
Three threads kept snagging on things I think about a lot as a designer of people-centered AI experiences:
1. Human steering of AI agents
The session I circled on Friday was Steering and Evaluating Generative AI, and the work I want to focus on is Privy: “Envisioning and Mitigating Privacy Risks for Consumer-facing AI Product Concepts” by Hao-Ping (Hank) Lee (someone I had the privilege to previously work with) and collaborators at CMU, UIUC, and UW. Privy is an LLM-powered Privacy Impact Assessment tool built for practitioners who aren’t privacy experts. One participant put the problem bluntly: “the biggest hurdle would be when you start off on a blank page and you’re like, ‘Oh my God, where do I start?'” In their evaluation, the LLM version beat a template baseline on every dimension they measured: relevancy, severity, clarity, mitigation effectiveness.
What connected for me isn’t how Privy helps, but when. Privy is explicitly scoped to “consumer-facing AI product concepts”. The study had practitioners assess ideas, not shipped code. Privacy risks are cheapest to catch and easiest to mitigate at the concept stage, before architecture lands, before data flows solidify, before the “we’ll fix it in a later sprint” math kicks in. This had me thinking about my own design work in security. Most threat-modeling tools show up after the code is written, when the cheapest fixes are no longer on the table. Instead, I believe in building threat modeling that can start at “I have an idea” vs only “here’s our repo, audit it.”
One more Privy move worth naming: users have to manually rate the relevance and severity of AI-suggested risks before they land in the report. It’s friction on purpose, built because one participant noted a real risk of AI over-reliance: “you may actually just be like, sure, this looks good, and accept.” The model is not the final judge on if the risk is real; the human is. That pattern is behind the approval gates is a principle I leverage to in my own design work. Threat modeling is too consequential to be rubber-stamped and needs to fit user needs and context.
2. Generative UX and conversational agents
This is the area I came into CHI most curious about: Generative UX (GenUX). These are UIs whose affordances are generated by the AI, based on what the user is trying to do, instead of a fixed toolbar of buttons designed before the task was known or an empty chat input.
I published on a slice of this area last year at CHIWORK: Dynamic Prompt Middleware. We generated prompt-refinement controls (radios, checkboxes, free-text) on the fly, tailored to each user prompt. We found that the dynamic controls “afforded more control, lowered barriers to providing context, and encouraged task exploration and reflection.” When prompting becomes the main way humans steer AI, treating prompting as a generic text box leaves a lot of steering power on the table.
The closest CHI 2026 paper in spirit is Just-In-Time Objectives by Michelle Lam and collaborators at Stanford and UW. The talk opened with a metaphor that nailed the problem and has been rattling around my head ever since: today’s general-purpose AI chat is a spork. It’s one tool asked to do everything, and as a result it “can’t really fork a piece of broccoli because it also has to scoop soup”. Every specialized task gets a slightly worse interface because the interface is trying to be universal. Their fix was to go “from spork to Mary Poppins bag”: induce the user’s objectives at interaction time from observed context, then turn them into “first-class interactive objects that are visible, modifiable, and equipped to powerfully steer any number of downstream AI systems.” The conceptual leap from “generate controls for refining a prompt” to “generate the goal itself as a steerable object” is the direction I think the field is headed. The spork framing is the cleanest argument I’ve heard for why chat alone is leaving so much on the table.
Adjacent and worth naming: Sensemaking in Multi-Agent LLM Interfaces by Saumya Pareek and collaborators. Their reframe of transparency is one I keep coming back to: not a binary, not a more-is-better dial, but a “sufficiency judgement.” Enough for the task at hand, and no more. They also flag that users treat number of agents as a proxy for reliability, which creates a “false sense of reliability” worth designing against if you’re shipping anything agentic.
I’ve already been exploring some of these ideas in my own work in designing Trent’s UI/UX: chat that can reshape the UI, action cards that let the agent propose and the user confirm, and treating secure design plans and goals as first-class objectives. But there’s a lot of road ahead and potential to achieve. The most interesting GenUX conversations I had all week were in the hallways: other practitioners and researchers working out what “generative interface” means in production (generating fresh code every time vs. composing pre-built components, for example). I left Barcelona more optimistic about where generative and dynamic UX is headed. Generating the interface from the user’s current security goal, not just talking about it, is the direction I’m most excited to keep pushing in my own design work.
3. Healthcare AI and lessons for security
The healthcare-AI track ended up having more to say about agentic security UX than I would’ve guessed going in. Both are domains where the stakes are concrete (someone is directly harmed when the system is wrong), errors can be silent (you don’t find out until something goes bad), and the user is frequently not the domain expert. Two papers from this track have reshaped how I think about agentic security.
The first was Metacognitive Demands and Strategies While Using Off-The-Shelf AI Conversational Agents for Health Information Seeking (Shri Harini Ramesh et al., 2026). The finding that stopped me: users say they’re on top of things with chatbots, but think-aloud transcripts reveal a lot of silent cognitive work they don’t realize they’re doing. They get stuck in “loops of rephrasing.” They quietly let the agent drive the conversation when they stop steering. And P11’s line on overconfident model tone (“It sounds so sure, but I don’t know if it’s right”) could have been said about pretty much any AI security tool on the market today.
The second was Intelligent Reasoning Cues (Venkatesh Sivaraman et al., 2026). The paper argues the whole “AI as second-opinion” framing is too narrow. Instead: think of AI outputs as reasoning cues that induce specific patterns of response. Resolving contradictions. Considering alternatives. Surfacing preferences. What reshaped my thinking: AI help is most valuable precisely where the decision is genuinely ambiguous. On the standard, already-clear calls, it reads as friction, not support. Help on the obvious stuff can be noise.
Three things I’m carrying back from this track:
- Design for users who don’t realize how much thinking the chatbot is asking of them. Make the goal, the evidence, and the scope visible by default, so the metacognitive tax is paid by the UI and not by the user’s working memory.
- Scale the help to the ambiguity. Surface every finding. On clear-cut cases, a concise severity and fix is plenty. Save the AI’s reasoning work (evidence, alternatives, clarifying questions) for where the user actually needs to think.
- When you do help, help as a reasoning cue, not a verdict. Sometimes the AI is surfacing a contradiction between the user’s design doc and their code. Sometimes it’s offering an alternative they hadn’t considered. Sometimes it’s asking a question worth sitting with. That’s less “here’s the answer, trust me” and more “here’s something worth noticing.” It’s the posture I’m most interested in building into agentic security.
The Hallway Track
A CHI talk is about 8 minutes. That’s barely enough time to tell the room what a paper found, let alone what the finding should actually change about how we design experiences. Real insights happen in the hallway: in conversations where someone walks you through the parts of the study that didn’t fit the slides, or where you trade war stories about designs that didn’t turn out well and problems you’re working on.
The hallway has always been the part of conferences that matters most to me. This trip it mattered differently. I was there with a different hat on: not as a researcher publishing, but as a practitioner building. The conversations that moved the needle weren’t the ones where I learned what a paper found. They were the ones where I asked “OK, but how would you actually design for that?” and traded notes with designers wrestling with the same issues from a different angle. Those conversations are how I translate HCI research into design practice: how to make what we ship usable, safe, and a real amplifier for agentic workflows.
It was also a genuine pleasure to see old friends and collaborators: people from my PhD program, co-authors I hadn’t seen in years, colleagues from previous research roles who are now in their own interesting corners of industry and academia. That community is tight-knit, generous, and hard to replicate anywhere else.
If you’re working on something adjacent, like agentic systems, high-stakes decision UX, or security for non-experts; I’d love to keep the conversation going. Show me what you’re designing.
I’m bringing all of this back to my design work on agentic systems: tools that meet people where they’re shipping, inside their creative flow, not bolted on after. More on what we’re building at Trent AI.
All papers cited are in the CHI 2026 proceedings or the author’s prior publications with DOIs below.
Papers cited
- Xinqi Zhang, Hariharan Subramonyam, Advait Sarkar, Ian Drosos, Zichao Wang, Kyungho Lee, Veronica Pimenova, Xiang Anthony Chen, and Kai Lukoff. 2026. Generative Design and Vibe Coding: Rethinking The Design-Development Divide for UI Prototyping. (CHI EA ’26). https://doi.org/10.1145/3772363.3778802
- Hao-Ping (Hank) Lee, Yu-Ju Yang, Matthew Bilik, Isadora Krsek, Thomas Serban von Davier, Kyzyl Monteiro, Jason Lin, Shivani Agarwal, Jodi Forlizzi, and Sauvik Das. 2026. Privy: Envisioning and Mitigating Privacy Risks for Consumer-facing AI Product Concepts. (CHI ’26). https://doi.org/10.1145/3772318.3791279
- Shri Harini Ramesh, Foroozan Daneshzand, Babak Rashidi, Shriti Raj, Hariharan Subramonyam, and Fateme Rajabiyazdi. 2026. Metacognitive Demands and Strategies While Using Off-The-Shelf AI Conversational Agents for Health Information Seeking. (CHI ’26). https://doi.org/10.1145/3772318.3791647
- Venkatesh Sivaraman, Eric Paul Mason, Mengfan Ellen Li, Jessica Tong, Andrew Joseph King, Jeremy M. Kahn, and Adam Perer. 2026. Intelligent Reasoning Cues: A Framework and Case Study of the Roles of AI Information in Complex Decisions. (CHI ’26). https://doi.org/10.1145/3772318.3790953
- Michelle S. Lam, Omar Shaikh, Hallie Xu, Alice Guo, Diyi Yang, Jeffrey Heer, James A. Landay, and Michael S. Bernstein. 2026. Just-In-Time Objectives: A General Approach for Specialized AI Interactions. (CHI ’26). https://doi.org/10.1145/3772318.3790713
- Saumya Pareek, Jarod Govers, Naja Kathrine Kollerup, Emily Wong, Eduardo Velloso, and Jorge Goncalves. 2026. Sensemaking in Multi-Agent LLM Interfaces: How Users Interpret Transparency and Trustworthiness Cues. (CHI ’26). https://doi.org/10.1145/3772318.3791157
