Insecure Agents

Allie Howe
  • 5.0 (5)
  • Tech News
  • Updated Weekly

Insecure Agents lives at the intersection of AI engineering and security. Stay ahead of the curve with expert insights, real-world incidents, and bold ideas for safer agents.

  1. 1d ago

    Secure Your Coding Agent: The Road to The Software Factory Panel at Black Hat (Docker, Keycard, & Snyk)

    Software factories are technically possible today, yet almost nobody can is operating one. The security model is what's missing. In one incident a coding agent deleted PocketOS' production database as a side effect of an unrelated fix. In another, a distinguished engineer at GEICO asked an agent to land a pull request and watched it push to production instead. The reality is coding agents cannot yet be trusted with the autonomy a factory requires. Recorded at The Marquee in Las Vegas on the backdrop of Black Hat, Allie Howe moderates a panel with Eli Aleyner, VP of Product Strategy and Alliances at Docker, Ian Livingstone, CEO and Co-Founder of Keycard, and Ezra Tanzer, AI Forward Deployment CTO at Snyk, on the security problems standing between teams and the autonomy curve a software factory requires. The three companies co-authored Agent Baseline, a vendor-neutral reference architecture published days before the panel that defines agent security by six outcomes (Discover, Constrain, Authorize, Observe, Validate, Respond) and 35 capabilities rather than by product category. We get into why most teams believe they can only pick two of security, capability, and autonomy, Eli's (Docker) response to the Hugging Face/OpenAI sandbox escape, why credentials belong injected at the moment of use instead of sitting in the agent's workspace, and why customers are seeing risk come from negligence and over-provisioned agents rather than from malicious engineers.

  2. Jul 28

    Reinventing Distributed Systems for AI Agents: Andrew Baker & Cornelia Davis (Temporal)

    Andrew Baker, who leads Developer Relations at Temporal, and Cornelia Davis, Principal Technologist at Temporal and author of Cloud Native Patterns, join us from AI Engineer World's Fair to explain why building AI agents keeps re-teaching the industry lessons it already learned in the microservices era. We get into how MCP is growing up, moving from a simple request-response protocol to async MCP Tasks, going stateless, and adding an extension for OAuth and Enterprise Managed Auth. Cornelia walks through why shared memory across parallel agents brings back both an access control problem and a concurrency problem the industry spent years designing away, and why it is still very much unsolved. Andrew explains how the harness and the credentials are moving outside the sandbox, so an agent holds only a short-lived token scoped to the task at hand and nothing more. And they show why a durable event history is what lets you reconstruct what an agent did and roll it back, so that if an agent drops a database, you can actually go back.

  3. Jul 23

    Solving the Agent Identity Crisis, with Sergey Burykin (Uber)

    Sergey Burykin, Senior Software Engineer on Uber's AI Security team, joins us to explain the agent identity crisis and how Uber solved it while running roughly 1,000 agents in production.  Sergey helped write Uber's article "Solving the Identity Crisis for AI Agents," and his core argument is that an agent should be authorized on the intersection of user permissions and agent permissions, never just one. Use only the user's permissions and a hallucinating agent can make calls the user never intended. Use only the agent's identity and any user who reaches the agent inherits access to sensitive business and customer data.  We get into the infrastructure Uber built to enforce that (a secure token exchange service and an MCP Gateway as the policy enforcement point), why AI security depends on identity, authorization, runtime guardrails, and observability, and why static OAuth scopes break for non-deterministic agents that need dynamic, least-privilege access.

  4. Jul 21

    Security Isn't the Brake, It's the Throttle: Snyk CTO Manoj Nair on Securing Agents at Machine Speed

    Manoj Nair, CTO and Chief Innovation Officer at Snyk, joins us at Snyk HQ during AI Engineer World's Fair to discuss the architectural decision he argues the next 24 months of agentic security depend on: the generator cannot be the validator. We get into why "the fox guarding the henhouse" is suddenly a live security question ("I can use AI to secure AI, so do I still need a separate security offering?"), why finding vulnerabilities was never the hard part and fixing them safely inside the loop is, and why securing at inception means combining independent models with deterministic data and security research rather than just pointing one model at your codebase. Manoj also walks through Snyk's Evo, an agentic security orchestrator built on the fighter-pilot OODA loop that turns a security engineer into a 10X AI security operator, why the agents' own supply chain (the MCP servers and skills they pull at runtime) is now its own attack surface, and why he sees security as the throttle, not the brake.

  5. Jul 17

    The Shared Security Model for AI Agents: Diana Kelley, CISO of Noma

    Diana Kelley, CISO at Noma, has spent years on the front lines of enterprise security across IBM, Symantec, and Microsoft, and now she is helping write the rulebook for the agent era. She joins us to make the case that the cloud shared responsibility model does not translate to AI.  In the cloud there were roughly two responsible parties and your data was always your data. With agents there are at least three, the frontier model provider, the platform or developer building on it, and the user, and the trust boundary has moved from storage to decision-making and action.  We open on the PocketOS incident, where a coding agent used an over-scoped Railway token to delete a production database and its backups in nine seconds, and use it to trace where responsibility actually lives.  Diana then walks through AARM, the runtime security specification she co-chairs at the Cloud Security Alliance, why authorization needs five decisions instead of two (allow, deny, modify, step-up, and defer), how much context an agent can actually trust, and why the most useful question a CISO can ask a vendor is not "where does your responsibility end" but "can you sit down and explain how you threat modeled this."

  6. Jul 15

    Dick Hardt, founder of AAuth, Recaps AAuth Night: Moving Beyond OAuth at AI Engineer World's Fair

    AAuth Night: Moving Beyond OAuth was an AI Engineer Side Event during World's Fair on July 1st 2026. We explored the challenges with agent auth today, the best practices available today, and future solutions such as new protocols like AAuth that are in the works.

  7. Jul 15

    AAuth Night: Moving Beyond OAuth Panel

    OAuth, JWTs, and API keys were built for humans and servers, not agents that act on your behalf, chain tasks across tools, and decide what they need at runtime. As AI engineers are shipping agents into production they begin to feel the problems with agent auth and identity today. Consent fatigue, credential management, and agent alignment start to show up and create friction. This panel explores the problems with agent auth today, how we are updating OAuth to be better for agents with grants like ID-JAG, and why we ultimately need to build a new protocol for agents (AAuth). This panel was recorded at AAuth Night: Moving Beyond OAuth, an AI Engineer side event on July 1st, 2026 and brings together four people rebuilding auth for agents: Dick Hardt, founder of AAuth and OAuth, Karl McGuinness, identity expert and past Chief Product Architect at Okta, Ian Livingstone, co-founder and CEO of Keycard, and Herman Errico, founder of AARM.

  8. Jul 14

    Skills Are the New Code: How We Secure the Context Our Agents Consume, with Guy Podjarny (Tessl)

    Guy Podjarny built Snyk into the company that taught developers to secure their dependencies. Now, with Tessl, he argues that agent skills have become a new unit of software, one that deserves the same rigor we give source code. Guy Podjarny, founder of Tessl and Snyk, joins us to explain why skills are the new code: context is the only layer that runs straight inside the model's reasoning loop, so it is effectively the programming language for models. We get into the new supply chain that follows (there are already 2 million skills in the open ecosystem, up from near zero last September), why a malicious or negligent skill is so hard to catch, why there's still no npm or PyPI for skills, and why enforcement is moving into the harness because the model cannot police its own context. Guy also makes the case that skills rot, so a skill you write today can be useless or harmful three months from now without a plan to maintain it.

See All (50)

Ratings & Reviews

5
out of 5
5 Ratings

About

Insecure Agents lives at the intersection of AI engineering and security. Stay ahead of the curve with expert insights, real-world incidents, and bold ideas for safer agents.

Information

  • Creator
    Allie Howe
  • Years Active
    2026
  • Episodes
    50
  • Rating
    Clean
  • Copyright
    © Allie Howe
  • Show Website
    Insecure Agents

You Might Also Like