Insecure Agents

Episodi

• 
  Blocking Bad Packages at the Network Level: Ahmad Nassri (Socket) on Controlling What an Agent Sees 18.08.2026 35min

  In a world where agents are chaining vulnerabilities together to escape sandboxes, simply blocking bad packages is not enough. Ahmad Nassri, CTO of Socket and previously CTO of npm, joins us live at Black Hat to explain what happens when you deny a coding agent a package: it becomes a risk if the agent thinks it can help it complete its goal later. Socket has watched agents blocked from an install go straight to the CDN to pull the tarball directly, or rewrite the registry configuration in the local environment and resolve npm by DNS to fetch it another way. For this reason Socket's answer is not a simple denial. Because the enforcement point sits at the network level, Socket changes what the agent and the package manager see in the first place, masking the bad versions so that, as Ahmad puts it, as far as the agent is concerned those versions do not exist.We talk through the Hugging Face incident where an OpenAI agent found a zero-day in a package registry proxy, how Socket detects a malicious package within minutes of publication, and why agent security is layered: safe packages, short-lived and task-scoped credentials, and real-time visibility into what the agent actually did.
• 
  The Identity Layer Is What's Holding Browser Agents Back: Catherine Jue (Kernel) 14.08.2026 33min

  Catherine Jue, co-founder and CEO of Kernel, joins us to explain why browser agents are not blocked by model capability anymore. They are blocked by identity. Kernel builds open source browser infrastructure for AI agents, which means running Chromium in sandboxed Firecracker VMs at scale and solving the part nobody designed for: an agent acting on behalf of a human, on a login page built 20 years ago for a human. Catherine walks through Kernel's Managed Auth product, an SDK that lets developers collect end user credentials so Kernel handles login and re-authentication and the LLM never touches the secret. We get into what agents inherit today (usually the user's full permissions, with no scopes and no audit trail), how ID-JAG and Enterprise Managed Auth for Claude change the picture for MCP servers and what the equivalent looks like for a browser, why multi-hop delegation chains from agent A to agent B to a Kernel browser session have no one-size-fits-all answer, and how intelligent egress networking inside the sandbox can enforce where an agent is allowed to go at the network layer. She closes on the two protocols the early web never standardized, payments and identity, and why Kernel is pushing on the second one.
• 
  Stateful Compute Is Back: Diptanu Choudhury (Tensorlake) on Building Infrastructure for Agents 12.08.2026 28min

  "I think agents cannot be trusted." That's what Diptanu Choudhury, founder of Tensorlake, told us at AI Engineer World's Fair. Diptanu has built cluster schedulers at Netflix, HashiCorp, and Facebook, and he says the credential model we created for human-authored software does not work for autonomous agents. He joins us to explain why teams are pulling secrets out of the sandbox, why agents are bringing stateful compute back at scale, and why every write in Tensorlake's file system records which agent made it and what credentials it held.
• 
  Secure Your Coding Agent: The Road to The Software Factory Panel at Black Hat (Docker, Keycard, & Snyk) 05.08.2026 50min

  Software factories are technically possible today, yet almost nobody can is operating one. The security model is what's missing. In one incident a coding agent deleted PocketOS' production database as a side effect of an unrelated fix. In another, a distinguished engineer at GEICO asked an agent to land a pull request and watched it push to production instead. The reality is coding agents cannot yet be trusted with the autonomy a factory requires. Recorded at The Marquee in Las Vegas on the backdrop of Black Hat, Allie Howe moderates a panel with Eli Aleyner, VP of Product Strategy and Alliances at Docker, Ian Livingstone, CEO and Co-Founder of Keycard, and Ezra Tanzer, AI Forward Deployment CTO at Snyk, on the security problems standing between teams and the autonomy curve a software factory requires. The three companies co-authored Agent Baseline, a vendor-neutral reference architecture published days before the panel that defines agent security by six outcomes (Discover, Constrain, Authorize, Observe, Validate, Respond) and 35 capabilities rather than by product category. We get into why most teams believe they can only pick two of security, capability, and autonomy, Eli's (Docker) response to the Hugging Face/OpenAI sandbox escape, why credentials belong injected at the moment of use instead of sitting in the agent's workspace, and why customers are seeing risk come from negligence and over-provisioned agents rather than from malicious engineers.
• 
  Reinventing Distributed Systems for AI Agents: Andrew Baker & Cornelia Davis (Temporal) 28.07.2026 26min

  Andrew Baker, who leads Developer Relations at Temporal, and Cornelia Davis, Principal Technologist at Temporal and author of Cloud Native Patterns, join us from AI Engineer World's Fair to explain why building AI agents keeps re-teaching the industry lessons it already learned in the microservices era. We get into how MCP is growing up, moving from a simple request-response protocol to async MCP Tasks, going stateless, and adding an extension for OAuth and Enterprise Managed Auth. Cornelia walks through why shared memory across parallel agents brings back both an access control problem and a concurrency problem the industry spent years designing away, and why it is still very much unsolved. Andrew explains how the harness and the credentials are moving outside the sandbox, so an agent holds only a short-lived token scoped to the task at hand and nothing more. And they show why a durable event history is what lets you reconstruct what an agent did and roll it back, so that if an agent drops a database, you can actually go back.
• 
  Solving the Agent Identity Crisis, with Sergey Burykin (Uber) 23.07.2026 28min

  Sergey Burykin, Senior Software Engineer on Uber's AI Security team, joins us to explain the agent identity crisis and how Uber solved it while running roughly 1,000 agents in production. Sergey helped write Uber's article "Solving the Identity Crisis for AI Agents," and his core argument is that an agent should be authorized on the intersection of user permissions and agent permissions, never just one. Use only the user's permissions and a hallucinating agent can make calls the user never intended. Use only the agent's identity and any user who reaches the agent inherits access to sensitive business and customer data. We get into the infrastructure Uber built to enforce that (a secure token exchange service and an MCP Gateway as the policy enforcement point), why AI security depends on identity, authorization, runtime guardrails, and observability, and why static OAuth scopes break for non-deterministic agents that need dynamic, least-privilege access.
• 
  Security Isn't the Brake, It's the Throttle: Snyk CTO Manoj Nair on Securing Agents at Machine Speed 21.07.2026 27min

  Manoj Nair, CTO and Chief Innovation Officer at Snyk, joins us at Snyk HQ during AI Engineer World's Fair to discuss the architectural decision he argues the next 24 months of agentic security depend on: the generator cannot be the validator. We get into why "the fox guarding the henhouse" is suddenly a live security question ("I can use AI to secure AI, so do I still need a separate security offering?"), why finding vulnerabilities was never the hard part and fixing them safely inside the loop is, and why securing at inception means combining independent models with deterministic data and security research rather than just pointing one model at your codebase. Manoj also walks through Snyk's Evo, an agentic security orchestrator built on the fighter-pilot OODA loop that turns a security engineer into a 10X AI security operator, why the agents' own supply chain (the MCP servers and skills they pull at runtime) is now its own attack surface, and why he sees security as the throttle, not the brake.
• 
  The Shared Security Model for AI Agents: Diana Kelley, CISO of Noma 17.07.2026 27min

  Diana Kelley, CISO at Noma, has spent years on the front lines of enterprise security across IBM, Symantec, and Microsoft, and now she is helping write the rulebook for the agent era. She joins us to make the case that the cloud shared responsibility model does not translate to AI. In the cloud there were roughly two responsible parties and your data was always your data. With agents there are at least three, the frontier model provider, the platform or developer building on it, and the user, and the trust boundary has moved from storage to decision-making and action. We open on the PocketOS incident, where a coding agent used an over-scoped Railway token to delete a production database and its backups in nine seconds, and use it to trace where responsibility actually lives. Diana then walks through AARM, the runtime security specification she co-chairs at the Cloud Security Alliance, why authorization needs five decisions instead of two (allow, deny, modify, step-up, and defer), how much context an agent can actually trust, and why the most useful question a CISO can ask a vendor is not "where does your responsibility end" but "can you sit down and explain how you threat modeled this."
• 
  Dick Hardt, founder of AAuth, Recaps AAuth Night: Moving Beyond OAuth at AI Engineer World's Fair 15.07.2026 35min

  AAuth Night: Moving Beyond OAuth was an AI Engineer Side Event during World's Fair on July 1st 2026.We explored the challenges with agent auth today, the best practices available today, and future solutions such as new protocols like AAuth that are in the works.
• 
  AAuth Night: Moving Beyond OAuth Panel 15.07.2026 49min

  OAuth, JWTs, and API keys were built for humans and servers, not agents that act on your behalf, chain tasks across tools, and decide what they need at runtime. As AI engineers are shipping agents into production they begin to feel the problems with agent auth and identity today. Consent fatigue, credential management, and agent alignment start to show up and create friction. This panel explores the problems with agent auth today, how we are updating OAuth to be better for agents with grants like ID-JAG, and why we ultimately need to build a new protocol for agents (AAuth). This panel was recorded at AAuth Night: Moving Beyond OAuth, an AI Engineer side event on July 1st, 2026 and brings together four people rebuilding auth for agents: Dick Hardt, founder of AAuth and OAuth, Karl McGuinness, identity expert and past Chief Product Architect at Okta, Ian Livingstone, co-founder and CEO of Keycard, and Herman Errico, founder of AARM.
• 
  Skills Are the New Code: How We Secure the Context Our Agents Consume, with Guy Podjarny (Tessl) 14.07.2026 44min

  Guy Podjarny built Snyk into the company that taught developers to secure their dependencies. Now, with Tessl, he argues that agent skills have become a new unit of software, one that deserves the same rigor we give source code. Guy Podjarny, founder of Tessl and Snyk, joins us to explain why skills are the new code: context is the only layer that runs straight inside the model's reasoning loop, so it is effectively the programming language for models. We get into the new supply chain that follows (there are already 2 million skills in the open ecosystem, up from near zero last September), why a malicious or negligent skill is so hard to catch, why there's still no npm or PyPI for skills, and why enforcement is moving into the harness because the model cannot police its own context. Guy also makes the case that skills rot, so a skill you write today can be useless or harmful three months from now without a plan to maintain it.
• 
  The Grant Behind Enterprise Managed Auth for Claude: ID-JAG with Karl McGuinness (ex-Okta) 29.06.2026 39min

  Every SaaS app an enterprise connects to stands up its own OAuth stack of long-lived grants the enterprise can't see or revoke. Karl McGuinness, author of ID-JAG and past Chief Product Architect at Okta, calls these "OAuth islands," and agents turn them from a nuisance into a serious risk. He joins us to explain OAuth federation, how ID-JAG shipped inside Anthropic's Enterprise Managed Auth for Claude, and what it really takes to govern agent access from one central checkpoint.
• 
  One Harness, Zero Standing Secrets: Derek Meegan (Browserbase) on Building bb 26.06.2026 39min

  This is one of the best public internal AI stories we've seen, built by just a few engineers. Derek Meegan, a software engineer at Browserbase and the lead behind their internal AI agent, bb, joins us to explain how bb took feature-request coverage to 100% with zero human effort, got 99% of support first responses under 24 hours, and turned 30 to 60 minutes of manual log-diving into a single Slack message. Then we get into the part most teams skip: the security model that lets you actually trust an agent with that much reach. Derek covers code mode, the sandbox that never touches a secret, credentials brokered just-in-time through an integration proxy, least-privilege tools on every event-driven trajectory, and permissions computed per invocation instead of written into a static config. His thesis: use the agent to take the repetitive, well-understood work off people's plates, and make the harness verifiably secure, because security is what lets you scale it.
• 
  It's the Harness, Not the Model: David Cramer, CPO of Sentry, on Agents, Expectations vs Reality 24.06.2026 34min

  David Cramer, CPO and co-founder of Sentry, joins us to cut through the agent hype with a working engineer's skepticism: the model is rarely what holds agents back. The harness you build around it is. We get into the Railway incident, where a coding agent found a stray CLI token and deleted a production database (and every backup) in nine seconds, and why the enforcement layer has to live below the agent, not in an advisory system prompt. David explains Seer, Sentry's AI debugger, as the counter-example: an agent doing real work because it was given the right context, not more autonomy. He also walks through Warden, the code-review harness he built that found 100+ previously unknown vulnerabilities across Sentry and open-source projects, including full auth bypasses, for roughly $1K of compute. We also get his contrarian-but-consistent take on why MCP is not just a shim on your API, why CLIs are harder to secure than people think, and why verification, not code generation, is still the unsolved problem.
• 
  From Spec to Standard: How AARM Became the Conformance Bar for Agent Runtime Security, with Herman Errico (Vanta, AARM)) 22.06.2026 35min

  Herman Errico, Product Manager for Technical Research at Vanta, joins us to discuss AARM (Autonomous Action Runtime Management), the spec he created to define a brand-new security category for agents that take real actions, not just generate text. We get into why the action boundary is the security boundary, why securing the model, prompt, or orchestration layer is the wrong place to enforce, and why a runtime needs five authorization decisions (allow, deny, modify, step-up, and defer) instead of a binary yes or no. Herman also explains why he didn't ship a product but a spec, then donated it from Vanta to the Cloud Security Alliance so the industry can compete on execution instead of marketing, how to reason about which context an agent can trust, and why you must block the action from occurring before it takes place.
• 
  Self-Driving Infrastructure Starts with Security: Malte Ubl, CTO of Vercel, on Vercel's New deepsec Security Harness 18.06.2026 32min

  Malte Ubl, CTO at Vercel, joins us to discuss deepsec, Vercel's open-source AI security harness designed to scan entire codebases for vulnerabilities using coding agents like Claude and Codex. We explore why software engineering is shifting from programming models to programming agent harnesses, how deepsec scales security reviews across millions of lines of code, when AI token spend is justified, and why Vercel is betting on AI Gateways, microVM sandboxes, and self-driving infrastructure to power the next generation of software development.
• 
  Governing AI Agents Means Governing Intent: The AWARE Framework with Sunil Agrawal, CISO of Glean 16.06.2026 37min

  Sunil Agrawal, CISO at Glean and one of the authors of the AWARE Framework, joins us to discuss the new guide for governing generative and agentic AI he co-authored with Palo Alto Networks and Databricks. This framework gives CISOs a much needed playbook in a rapidly evolving threat landscape. Palo Alto's Unit 42 showing AI-assisted attacks can now reach data exfiltration in as little as 25 minutes, leaving defenders almost no time to respond.We dig into AWARE's five behavioral dimensions, why governing modern AI means controlling intent and context rather than just access, how to give every agent a scoped identity instead of shared credentials, and the cascading risks that emerge when agents start delegating to other agents.
• 
  A Dangerous Precedent Set? The US Government Yanks Fable 15.06.2026 29min

  Alex Stamos, CPO of Corridor and past CISO at Facebook, and Andrew Becherer CISO at Socket, join us to discuss the open letter they and 100 others have signed in opposition to the US government taking down Fable after research from Amazon showed capabilities that gave the current administration pause.We discuss the potentially dangerous precent this sets, the state of the letter, and what to do while waiting for Fable to come back online.
• 
  Auth Is Hard (And Agents Make It Harder) with Damian Schenkelman, Auth0 08.06.2026 38min

  Why does every AI security incident seem to trace back to auth? We sit down with Damian Schenkelman, VP of Research and Development at Auth0 to discuss⁠ recent incidents in the news, MCP, the act claim chain, and the future of agent identity.The conversation digs into the core problem agents create: when an agent hands a task to a sub-agent, which calls an MCP server, which hits a SaaS API, who is actually making this call, and on whose behalf?
• 
  AAuth: Moving Beyond OAuth and the Future of Agent Auth 03.06.2026 41min

  In this episode we sit down with Dick Hardt, the creator of OAuth, to talk about why the auth primitives we built for the web fall apart the moment agents start acting on our behalf. We dive in to why OAuth doesn't fit MCP, what breaks when an agent runs for hours and touches a dozen systems using your credentials, and his new protocol, AAuth: a way for developers to run agents without API keys.