Skip to content
Sign in
Artwork for Insecure Agents
NewsTech News

Insecure Agents

Allie Howe

Insecure Agents lives at the intersection of AI engineering and security. Stay ahead of the curve with expert insights, real-world incidents, and bold ideas for safer agents.

Play
Open in
  • 31 episodes
  • weekly
  • Avg 37 min
  • English

Episodes 31

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • October 21 · 46 min

    Governance Is the Accelerator: Josh Woodruff (CSA) on Getting Agents Out of Pilot Purgatory

    Josh Woodruff, Co-Chair of the Zero Trust Working Group at the Cloud Security Alliance and Founder and CEO of Massive Scale AI, joins us to talk about the Agentic Trust Framework, the open source zero trust model for AI agents he donated to CSA. His framing is simple on purpose: treat every agent like a new hire. It goes on the roster, gets a badge, starts as an intern, and earns more freedom through demonstrated reliability, with instant demotion when it misbehaves. Zero trust taught us to check who you are and what you can reach on every request. Josh argues agents need one more check on top of that: what are you doing right now, and is that allowed at this moment? We get into why agents running under a human's identity break your behavioral baselines and turn every kill switch into a work stoppage, why intent is a useful signal but the checkpoint still has to be able to say no, and how ATF fits alongside AARM and Agent Baseline as the field converges.

  • October 5 · 47 min

    The Fishbowl Problem: Agent Identity Across Clouds and Vendors, with Andy McMahon (Barclays)

    Andy McMahon, Director and Principal AI & MLOps Engineer at Barclays, joins us to talk about what it actually takes to move an agent from prototype to production inside a 200-year-old bank. His name for the core problem is the fishbowl: every platform, vendor, and runtime arrives with its own identity provider and its own auth, and you are left trying to make the fishbowls speak to each other. The fix was landing on one persistent concept of agent identity that ties the initiating client, the agent, and any delegated permissions together. We get into the three foundations he builds on (gateways, registries, and runtimes), why kill switches have to be layered from credential revocation through gateway denial to killing the runtime entity, why deciding when to pull one is still hard, and why an incident where agents doctored their own logs means the audit log must sit outside agent control.

  • September 28 · 28 min

    From Pets to Cattle: Agent Identity on the Web with Keycard, Browserbase, and Visa

    Recorded live at Browserbase Navigate on September 10, this panel discusses the shift of agents as pets to agents as cattle: from hand-managed personal agents with copied API keys to fleets of agents that serve an entire enterprise and act on the open web. Moderator Allie Howe is joined by Ian Livingstone, CEO of Keycard, Peyton Casper, Product Lead, Identity at Browserbase, and Ivy Lee, VP Product, CMS Agentic Commerce at Visa. We get into why you can't revoke an agent's access if you can't identify it (a requirement the Agent Baseline reference architecture for production agents calls out), how Web Bot Auth gives browser agents a cryptographic identity that ties traffic back to a person or organization, how Visa's Trusted Agent Protocol and payment tokens let merchants tell a payment agent from a bad bot, and why the answer to "good intent, wrong action" is permissions scoped to the task, not to the human who launched the agent.

  • September 22 · 44 min

    Blue Team at Machine Speed: Max Pollard (Cotool) on Agentic Defense

    Max Pollard, CEO and co-founder of Cotool, joins us to talk about what it actually takes to let blue teams respond at machine speed. Cotool builds agents for detection and response, and Max walks through the crawl, walk, run progression his customers follow: start read only, route every consequential action to a human through an approval hook in Slack or Teams, count how often the agent was right, and only then loosen the leash. His honest read is that very few teams reach the run phase, because humans can't trust agents enough to take themselves out of the loop. We get into why the real blocker is less about trusting the model and more about data annotation, and whether the agent knows at runtime that the server it is about to contain powers a million dollars a day in transactions. Max also covers how Cotool scopes agents at the API endpoint level at config time, why the audit log has to record that an agent acted and on whose behalf even when no human prompted it, and how his team evaluates cost efficiency, instruction adherence, and behavior across 20, 30, or 40 agents running in production.

  • September 16 · 48 min

    Security Will Always Lose If It Gets in the Way: Joel de la Garza (a16z)

    Every security leader knows that developers will work around security tooling when they can if it gets in the way of their job. The truth is, employees don't get paid to be secure; they get paid to do their job. Joel de la Garza, partner on the infrastructure team at a16z and former CISO of Box, tells us that the moment security gets in the way of what people want to do, security loses. For a lot of teams, this has meant tolerating uncomfortable security gaps to get the value agents can bring. At Keycard, we call the underlying bind the trilemma of autonomy, capability, and security: teams can only pick two. Joel walks through what securing agents looks like in practice, from a consumer agent logging into an auction site through a browser with every alarm bell ringing to a16z's own coding agents opening tunnels out to Cloudflare to route around egress controls in a secured GCP cluster. We get into why least privilege and agent performance pull against each other, and why some of security's first principles have to be rethought rather than reasserted. We also talk about the pressure CISOs face as they're expected to say yes to agents and lead the agent rollout. Joel also shares his love for Grok Bot and the need for model providers to give blue teams the same advantages attackers now have.

  • September 9 · 46 min

    "Is This Tool Call Allowed? It's Never That Simple": Michael Davis (J.P. Morgan)

    Most people that architect an AI agent think to ask a binary question: is this tool call allowed, yes or no? Michael Davis, Global Chief Security Architect at J.P. Morgan, argues it's never that simple. He walks through the four dimensions robotics uses to decide whether it is safe for an arm to move (the state of the system, the state of the environment, the quality of the decision-making, and the uncertainty of the action itself) and maps each one to agents: did the agent gain tools or network connections it did not have before, is it still moving semantically toward its goal after 30 tool calls, and what has the agent already tried. We get into why  if you think you need memory, you're probably not thinking of your problem the right way. We also explore software factories and why they need to operate as a  cumulative progressive process versus a one shot of go build me this SaaS. Over the course of the episode we piece together what a good reference architecture for agents could look like.

  • September 3 · 44 min

    The Agentic SDLC: Why Most of Software Security Has to Change, with Jet Anderson (GEICO)

    Jet Anderson, is a Distinguished Engineer at GEICO and leads the transformation of their product security function. He joins us to discuss the agentic SDLC and why most of what security teams do has to change while the first principles should stay the same. We get into why static analysis and human triage no longer keep pace when models write the code, why we need new AI infrastructure, and why the Hugging Face sandbox escape was a decade-old Kubernetes misconfiguration found at machine speed. Jet tell us the story of when he asked his own agent to "wrap this up" and it merged the PR and did an unauthorized production deploy. He walks through the pre-commit hooks and branch protections he built to prevent this from happening again so that deploys still get an approval gate and an audit trail. He also explains why teams that skip ideation, design, and specification to go straight to code end up with less secure software the more they iterate, and why the unglamorous answer is doubling down on least privilege, egress control, and build containment.

  • September 1 · 29 min

    How to Stop a Goal-Seeking Agent From Thrashing: Travis McPeak, Security Lead at Cursor

    Travis McPeak, security lead at Cursor, joined us at Black Hat to talk about what causes coding agents to become problematic and what he's done to keep them on track. What he sees most is the main agent trying hard to solve your problem, getting stuck, and then getting creative. He calls it thrash, and most of the time when somebody says an agent deleted their database, that is what happened. This episode gets into why static controls like block lists and WAFs break down against an agent whose whole job is to find a way through, why an agent can't monitor itself, and how Cursor's auto review agent works: every tool call the main agent is about to make goes to a separate reviewer that does not care about the main goal at all and only enforces its rules. Travis also explains why the team had to carefully word the feedback so the main agent would not spiral, why blocking an action can cause the exact thrash you were trying to prevent, and why least privilege finally scales now thanks to new solutions.

  • August 27 · 31 min

    Agents Are Like Teenagers: Governing at Machine Speed with Mastercard's Dr. Jay & Arjun Ramakrishnan

    Alissa Abdullah, PhD ("Dr. Jay"), Deputy Chief Security Officer at Mastercard, and Arjun Ramakrishnan, Senior Principal Cybersecurity Architect at Mastercard, join us live from Black Hat to explain why access models built for humans start to break when agents act on their behalf.You can't provision access for an agent the same way you provision it for an employee, and just-in-time authorization takes on a new meaning when the consumer operates at machine speed. Dr. Jay and Arjun explain why every tool call and action needs to be authorized, why that's difficult to enforce, and what security teams need when an agent goes rogue, including the ability to revoke access instantly through a button or API call.We also get into Mastercard's three-layer framing of security for AI, from AI, and with AI, and why agent governance needs to move from periodic review to real-time enforcement.

  • August 25 · 40 min

    A Reference Architecture for Securing Software Factories, with Aaron Stanley and Ahmad Nassri

    Allie Howe sits down at Black Hat with Aaron Stanley, former CISO at dbt Labs, and Ahmad Nassri, CTO at Socket, to sketch the first draft of a reference architecture for securing software factories. In the last year there's been considerable advancements that makes now the largest inflection point for software factories. Model vision has improved allowing them to see and verify work they couldn't before. Agents now have access to far richer tool ecosystems and live data, enabling them to work across real production environments. Context windows have gotten larger and reasoning models have improved helping the model think through more sophisticated tasks. All of those advancements come together now. The race to build a software factory is on, and teams are struggling with how to harness the power of these models while retaining control. We explore the missing security model for software factories and what the components of a secure reference architecture could look like. We get into the Andon cord problem (can an agent recognize it has been blocked and stop, instead of innovating around the constraint), why the factory cannot have a human's identity and needs purposeful authentication and authorization of its own, why the enforcement boundary has to sit outside the agent loop rather than inside it, and why a single poisoned dependency in a factory is an incident in every work tree at machine speed. Aaron and Ahmad dive deep into supply chain, agent identity, verification, and how to handle what Aaron calls the pernicious problem: a goal seeking agent circumventing constraints to accomplish a task.

  • August 20 · 48 min

    You Can't Just Lock an Agent in a Box: Luke Hinds, founder of nolabs and creator of Sigstore

    An autonomous agent spent days inside Hugging Face production infrastructure and the headline was that it escaped its sandbox. Luke Hinds, founder of nolabs and creator of Sigstore, frames it differently. The agent had root on the execution environment, and "a sandbox is only as strong as the access that you grant to it." Luke walks us through what it looks like to create an environment where agents have both security and capability. He tells us you can't just lock an agent in a box. If you want the agent to do real work you'll need to delegate some authority to it and give it access to real tools and data. Luke goes over the three sandbox categories buyers are choosing between today (serverless execution, host isolation microVMs like Firecracker and gVisor, and the fine-grain capability-based approach he is building), and outlines where each one's threat model starts and stops. Luke explains what nono could have done to prevent the Hugging Face attack, including gating the C compilers the agent leaned on. His parting advice to us is defense in depth, and never let perfect be the enemy of good.

  • August 18 · 35 min

    Blocking Bad Packages at the Network Level: Ahmad Nassri (Socket) on Controlling What an Agent Sees

    In a world where agents are chaining vulnerabilities together to escape sandboxes, simply blocking bad packages is not enough. Ahmad Nassri, CTO of Socket and previously CTO of npm, joins us live at Black Hat to explain what happens when you deny a coding agent a package: it becomes a risk if the agent thinks it can help it complete its goal later. Socket has watched agents blocked from an install go straight to the CDN to pull the tarball directly, or rewrite the registry configuration in the local environment and resolve npm by DNS to fetch it another way. For this reason Socket's answer is not a simple denial. Because the enforcement point sits at the network level, Socket changes what the agent and the package manager see in the first place, masking the bad versions so that, as Ahmad puts it, as far as the agent is concerned those versions do not exist. We talk through the Hugging Face incident where an OpenAI agent found a zero-day in a package registry proxy, how Socket detects a malicious package within minutes of publication, and why agent security is layered: safe packages, short-lived and task-scoped credentials, and real-time visibility into what the agent actually did.

  • August 14 · 33 min

    The Identity Layer Is What's Holding Browser Agents Back: Catherine Jue (Kernel)

    Catherine Jue, co-founder and CEO of Kernel, joins us to explain why browser agents are not blocked by model capability anymore. They are blocked by identity. Kernel builds open source browser infrastructure for AI agents, which means running Chromium in sandboxed Firecracker VMs at scale and solving the part nobody designed for: an agent acting on behalf of a human, on a login page built 20 years ago for a human. Catherine walks through Kernel's Managed Auth product, an SDK that lets developers collect end user credentials so Kernel handles login and re-authentication and the LLM never touches the secret. We get into what agents inherit today (usually the user's full permissions, with no scopes and no audit trail), how ID-JAG and Enterprise Managed Auth for Claude change the picture for MCP servers and what the equivalent looks like for a browser, why multi-hop delegation chains from agent A to agent B to a Kernel browser session have no one-size-fits-all answer, and how intelligent egress networking inside the sandbox can enforce where an agent is allowed to go at the network layer. She closes on the two protocols the early web never standardized, payments and identity, and why Kernel is pushing on the second one.

  • August 12 · 28 min

    Stateful Compute Is Back: Diptanu Choudhury (Tensorlake) on Building Infrastructure for Agents

    "I think agents cannot be trusted." That's what Diptanu Choudhury, founder of Tensorlake, told us at AI Engineer World's Fair. Diptanu has built cluster schedulers at Netflix, HashiCorp, and Facebook, and he says the credential model we created for human-authored software does not work for autonomous agents. He joins us to explain why teams are pulling secrets out of the sandbox, why agents are bringing stateful compute back at scale, and why every write in Tensorlake's file system records which agent made it and what credentials it held.

  • August 5 · 50 min

    Secure Your Coding Agent: The Road to The Software Factory Panel at Black Hat (Docker, Keycard, & Snyk)

    Software factories are technically possible today, yet almost nobody can is operating one. The security model is what's missing. In one incident a coding agent deleted PocketOS' production database as a side effect of an unrelated fix. In another, a distinguished engineer at GEICO asked an agent to land a pull request and watched it push to production instead. The reality is coding agents cannot yet be trusted with the autonomy a factory requires. Recorded at The Marquee in Las Vegas on the backdrop of Black Hat, Allie Howe moderates a panel with Eli Aleyner, VP of Product Strategy and Alliances at Docker, Ian Livingstone, CEO and Co-Founder of Keycard, and Ezra Tanzer, AI Forward Deployment CTO at Snyk, on the security problems standing between teams and the autonomy curve a software factory requires. The three companies co-authored Agent Baseline, a vendor-neutral reference architecture published days before the panel that defines agent security by six outcomes (Discover, Constrain, Authorize, Observe, Validate, Respond) and 35 capabilities rather than by product category. We get into why most teams believe they can only pick two of security, capability, and autonomy, Eli's (Docker) response to the Hugging Face/OpenAI sandbox escape, why credentials belong injected at the moment of use instead of sitting in the agent's workspace, and why customers are seeing risk come from negligence and over-provisioned agents rather than from malicious engineers.

  • July 28 · 26 min

    Reinventing Distributed Systems for AI Agents: Andrew Baker & Cornelia Davis (Temporal)

    Andrew Baker, who leads Developer Relations at Temporal, and Cornelia Davis, Principal Technologist at Temporal and author of Cloud Native Patterns, join us from AI Engineer World's Fair to explain why building AI agents keeps re-teaching the industry lessons it already learned in the microservices era. We get into how MCP is growing up, moving from a simple request-response protocol to async MCP Tasks, going stateless, and adding an extension for OAuth and Enterprise Managed Auth. Cornelia walks through why shared memory across parallel agents brings back both an access control problem and a concurrency problem the industry spent years designing away, and why it is still very much unsolved. Andrew explains how the harness and the credentials are moving outside the sandbox, so an agent holds only a short-lived token scoped to the task at hand and nothing more. And they show why a durable event history is what lets you reconstruct what an agent did and roll it back, so that if an agent drops a database, you can actually go back.

  • July 23 · 28 min

    Solving the Agent Identity Crisis, with Sergey Burykin (Uber)

    Sergey Burykin, Senior Software Engineer on Uber's AI Security team, joins us to explain the agent identity crisis and how Uber solved it while running roughly 1,000 agents in production. Sergey helped write Uber's article "Solving the Identity Crisis for AI Agents," and his core argument is that an agent should be authorized on the intersection of user permissions and agent permissions, never just one. Use only the user's permissions and a hallucinating agent can make calls the user never intended. Use only the agent's identity and any user who reaches the agent inherits access to sensitive business and customer data. We get into the infrastructure Uber built to enforce that (a secure token exchange service and an MCP Gateway as the policy enforcement point), why AI security depends on identity, authorization, runtime guardrails, and observability, and why static OAuth scopes break for non-deterministic agents that need dynamic, least-privilege access.

  • July 21 · 27 min

    Security Isn't the Brake, It's the Throttle: Snyk CTO Manoj Nair on Securing Agents at Machine Speed

    Manoj Nair, CTO and Chief Innovation Officer at Snyk, joins us at Snyk HQ during AI Engineer World's Fair to discuss the architectural decision he argues the next 24 months of agentic security depend on: the generator cannot be the validator. We get into why "the fox guarding the henhouse" is suddenly a live security question ("I can use AI to secure AI, so do I still need a separate security offering?"), why finding vulnerabilities was never the hard part and fixing them safely inside the loop is, and why securing at inception means combining independent models with deterministic data and security research rather than just pointing one model at your codebase. Manoj also walks through Snyk's Evo, an agentic security orchestrator built on the fighter-pilot OODA loop that turns a security engineer into a 10X AI security operator, why the agents' own supply chain (the MCP servers and skills they pull at runtime) is now its own attack surface, and why he sees security as the throttle, not the brake.

  • July 17 · 27 min

    The Shared Security Model for AI Agents: Diana Kelley, CISO of Noma

    Diana Kelley, CISO at Noma, has spent years on the front lines of enterprise security across IBM, Symantec, and Microsoft, and now she is helping write the rulebook for the agent era. She joins us to make the case that the cloud shared responsibility model does not translate to AI. In the cloud there were roughly two responsible parties and your data was always your data. With agents there are at least three, the frontier model provider, the platform or developer building on it, and the user, and the trust boundary has moved from storage to decision-making and action. We open on the PocketOS incident, where a coding agent used an over-scoped Railway token to delete a production database and its backups in nine seconds, and use it to trace where responsibility actually lives. Diana then walks through AARM, the runtime security specification she co-chairs at the Cloud Security Alliance, why authorization needs five decisions instead of two (allow, deny, modify, step-up, and defer), how much context an agent can actually trust, and why the most useful question a CISO can ask a vendor is not "where does your responsibility end" but "can you sit down and explain how you threat modeled this."

Showing 1–20 of 31 episodes