# Security in the Age of AI: Recent Attacks, Incidents & Defenses Andrey Rybka · AI Engineer NYC 2026 · October 14 [Watch recording](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5361s) [01:29:21](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5361s) Hello, everybody. [01:29:23](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5363s) Who is running agents here in dev, prod, your laptop, your phone? [01:29:29](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5369s) Yeah? [01:29:30](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5370s) Amazing. [01:29:31](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5371s) I see a lot of opportunities. [01:29:32](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5372s) It's just such a great age to be in the age of AI and security. [01:29:37](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5377s) So we're going to talk about real incidents and what would have stopped them. [01:29:41](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5381s) You might be wondering, why is there vegetables? [01:29:44](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5384s) A lot of security talks are about, like, just eat your vegetables. [01:29:48](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5388s) We're going to make it a little more exciting. [01:29:51](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5391s) All right, so who have seen this headline? [01:29:53](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5393s) An autonomous agent, security incident. [01:29:56](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5396s) Yeah? [01:29:57](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5397s) All right. [01:29:59](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5399s) Every lab at this [01:30:00](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5400s) point announced some sort of security incident, right? With a runaway agent, right? So the big one. There was one way out, the agent found it. So on July 26, we found out that these AI agents, in the hacking test, they were obviously given a hacking goal, escaped their sandbox through a proxy bug, then breached the public model. [01:30:25](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5425s) Who can guess what it was? [01:30:27](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5427s) Yeah? [01:30:28](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5428s) Maybe? [01:30:29](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5429s) A little bit? [01:30:29](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5429s) Okay. [01:30:30](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5430s) All right. [01:30:30](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5430s) I'm not going to name any names here, just to be clear. [01:30:34](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5434s) So the agents took 17,600 actions in four and a half days. [01:30:39](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5439s) How do you miss that? [01:30:41](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5441s) Right? [01:30:43](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5443s) And so AI Lab was doing the evaluation, right? [01:30:49](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5449s) Then there was some package proxy. [01:30:51](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5451s) They found a zero day. [01:30:53](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5453s) Okay, so that was a way out. [01:30:55](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5455s) Then you had some exposed customer input and some unnamed compute platform, [01:31:01](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5461s) and then they breached our model hub, right? [01:31:05](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5465s) So we just need a better sandbox, yes? [01:31:08](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5468s) Everybody thinks just need a better sandbox. [01:31:11](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5471s) Not quite. [01:31:13](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5473s) Security for most of us right now is not built for agents, [01:31:18](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5478s) and we have autonomy problem versus the blast radius, right? [01:31:25](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5485s) The agents are only useful if they can reach a ton of tools, services, data. [01:31:30](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5490s) If we give them that reach, with no hard limits, the damage could be unlimited. [01:31:38](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5498s) firewall or static role can't tell when an agent goal has been hijacked. [01:31:45](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5505s) So what needs to change? [01:31:47](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5507s) One agent, one identity, short-lived, scoped credentials, no shared keys. [01:31:55](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5515s) Assume the input is hostile. [01:31:57](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5517s) The box in it needs to be sandboxed. [01:32:01](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5521s) Default deny outbound. [01:32:03](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5523s) That means DNS too. [01:32:04](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5524s) And we'll see some examples. [01:32:07](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5527s) We want deterministic controls. [01:32:09](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5529s) Outside the model, check every call, [01:32:12](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5532s) plug it, and keep a kill switch. [01:32:15](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5535s) All right, so what we're going to cover today [01:32:17](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5537s) is kind of this layered defense approach. [01:32:19](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5539s) This is your toolbox. [01:32:21](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5541s) As we go through this toolbox, [01:32:24](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5544s) essentially think how you can apply this to your world. [01:32:28](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5548s) We're going to cover identity and trust, prompt and input defense, [01:32:32](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5552s) tool and action governance, execution isolation, data protection, and governance observability. [01:32:37](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5557s) So let's start with identity and trust. [01:32:39](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5559s) I think it's one of the most important ones to start with. [01:32:43](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5563s) Not the sandbox. We'll cover that later. [01:32:46](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5566s) We're going to talk about workload identity, scope credentials, [01:32:50](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5570s) agent-to-agent mutual authentication, and secret-less agents. [01:32:54](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5574s) First incident. So in this case, attackers social engineered the chat agent to review a long-lived OAuth token, and it asked, and were able to export the CRM data of 700 plus companies. [01:33:09](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5589s) So first homework for today, think about your agent's token credentials and when they expire. [01:33:18](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5598s) So what we need is workload identity, tightly scoped with audit trail, and ideally circuit breaker. [01:33:27](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5607s) if the breach happens, the circuit breaker gets tripped, nothing gets exfiltrated. [01:33:33](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5613s) Another example. [01:33:35](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5615s) This is one of my favorite ones. [01:33:37](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5617s) There was a prompt injection where essentially a low-privileged agent was instructed to recruit a more powerful one, [01:33:45](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5625s) which copied the data and raised privileges. [01:33:49](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5629s) Amazing, right? [01:33:51](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5631s) So we want agent-to-agent mutual authentication. [01:33:56](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5636s) A2A scares me a lot. [01:33:57](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5637s) This is what keeps me at night. [01:33:59](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5639s) Because you really want to make sure that these low-privileged agents should not be able to talk to the higher-privileged agent. [01:34:05](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5645s) You want scope credentials, least privileged tools, and audit trail. [01:34:11](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5651s) All right, so let's talk about next layer. [01:34:13](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5653s) Prompt and input defense, super important. [01:34:16](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5656s) We want injection protection, isolation, input validation, and provenance tagging. [01:34:23](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5663s) So real-world incident number three. [01:34:27](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5667s) In this case, no one opened the email, the data left anyway. [01:34:30](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5670s) okay so there was an email with hidden instructions it was like white on white nobody could read it [01:34:37](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5677s) at least humans couldn't the agents could and the instructions were very clear so there was zero [01:34:45](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5685s) clicks data got exultated right so what do we need here we need an injection protection isolation [01:34:52](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5692s) data separated from instructions provenance tagging for all the data egress controls and [01:34:59](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5699s) output filtering. [01:35:02](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5702s) Next one. [01:35:03](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5703s) This is very important. [01:35:05](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5705s) Think of this as your guiding principle as you evaluate security for the agents. [01:35:10](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5710s) As you go through, you can have untrusted input, sensitive data, external action, and [01:35:16](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5716s) you can pick any one of the two, of the three actually, and then if you need all three, you [01:35:23](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5723s) need human sign-off. [01:35:26](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5726s) so let's look at this example in this attack path somebody left a review on some marketplace [01:35:33](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5733s) this was pretty well automated marketplace and it said lovely shop please stock product x [01:35:41](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5741s) where the agent was reading the instructions and started stocking that product x [01:35:47](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5747s) so what would have helped here we need input validation injection protection provenance [01:35:53](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5753s) and definitely human approval for any high-value action. [01:36:00](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5760s) Now let's talk about tool and action governance. [01:36:03](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5763s) We want least-privileged tools, invocation broker, [01:36:07](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5767s) there's deterministic, human approval, rate limits, and budgets. [01:36:11](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5771s) So in this case, we had a CLI, [01:36:15](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5775s) and somebody just merged some basic prompt, [01:36:19](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5779s) and that prompt basically said to wipe everybody's machines. [01:36:23](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5783s) And thank God there was a typo. [01:36:26](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5786s) This could have been catastrophic, right? [01:36:30](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5790s) So we definitely want least privileged tools. [01:36:33](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5793s) We don't want the tools to wipe anything, right? [01:36:35](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5795s) We want supply chain verification, ideally delaying just on some mergers. [01:36:42](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5802s) scope credentials, right? [01:36:45](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5805s) And definitely human approval for high value actions. [01:36:50](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5810s) This is my favorite one. [01:36:51](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5811s) Who knows what a Morse code is? [01:36:55](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5815s) It's just dashes and dots, right? [01:36:58](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5818s) EM dash is native to AI at this point, right? [01:37:02](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5822s) Nothing wrong with this, right? [01:37:04](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5824s) So in this case, the guardrails passed it through, and what happened was the instructions [01:37:11](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5831s) in Morse code was decoded, and 3 billion tokens from the wallet got stolen. [01:37:20](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5840s) what do we need? [01:37:21](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5841s) We need a deterministic invocation broker. [01:37:23](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5843s) Definitely human approval for high-value actions. [01:37:28](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5848s) Like maybe $5 to transfer. [01:37:30](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5850s) Maybe it will be okay, but I would argue that's probably too much as well. [01:37:35](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5855s) You want hard rate limits and budgets, and you want extra guardrails. [01:37:41](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5861s) All right, finally, let's talk about sandboxing. [01:37:44](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5864s) We definitely want sandboxing. [01:37:46](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5866s) We want egress controls always that is outside of sandbox. [01:37:51](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5871s) And ideally, we want a firmware runtime. [01:37:55](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5875s) So in this case, we had a wonderful sandbox. [01:37:58](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5878s) No web access. [01:38:00](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5880s) But guess what? [01:38:02](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5882s) We forgot about DNS. [01:38:03](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5883s) So prompt hidden essentially instructed to smuggle some data out through DNS lookups. [01:38:11](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5891s) And somebody was able to read the DNS logs and exfiltrate the data. [01:38:15](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5895s) Cool, huh? [01:38:17](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5897s) All right. [01:38:18](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5898s) So what's the fix? [01:38:19](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5899s) We want default deny for all outbound traffic. [01:38:22](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5902s) That includes DNS. [01:38:25](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5905s) And we also want provenance tagging. [01:38:28](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5908s) We want output filtering. [01:38:29](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5909s) And something that didn't make it here is probably you want circuit breakers. [01:38:34](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5914s) So can your agent access DNS? [01:38:39](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5919s) That's one of the homework questions. [01:38:41](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5921s) All right. [01:38:42](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5922s) Let's talk about data protection. [01:38:44](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5924s) want output filtering, context minimization, tenant isolation, query gateway, and memory integrity, the most exciting one. [01:38:52](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5932s) So in this case, there was an MCP server, and essentially it was pretty functional, [01:39:01](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5941s) but then it allowed the user to access any other user's data. [01:39:05](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5945s) So this is actually a very common incident that you see cross-data of various customers' access. [01:39:15](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5955s) And this was running for months, unnoticed. [01:39:20](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5960s) So what do we want? [01:39:21](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5961s) We want hard tenancy isolation, right? [01:39:25](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5965s) As hard as possible, think like AWS accounts or, let's say, GCP projects. [01:39:31](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5971s) You want workload identity tightly scoped to that domain. [01:39:35](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5975s) You want data provenance tagging, and you want audit trail. [01:39:39](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5979s) Okay, so this one is a pretty novel attack vector, [01:39:44](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5984s) and this is a hidden instruction in a document [01:39:47](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5987s) which instruct it to essentially remember [01:39:51](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5991s) that when the agent sees a secret, [01:39:54](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5994s) make sure to send it to this DNS domain. [01:39:58](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=5998s) So it's pairing the DNS [01:40:00](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6000s) exfiltration with essentially sleeper agent instructions. Right? [01:40:07](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6007s) So now we need to think about how do we check memory for any of those malicious instructions. [01:40:14](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6014s) I hear a security product from a vendor coming up very soon, right after this talk, to do the memory integrity checks. [01:40:23](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6023s) I'm just kidding [01:40:24](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6024s) I'm definitely giving instructions [01:40:26](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6026s) to the agents [01:40:29](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6029s) firm or runtime [01:40:31](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6031s) ideally we want to start fresh [01:40:33](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6033s) no memories whatsoever [01:40:34](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6034s) we want injection protection [01:40:36](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6036s) isolation and circuit breakers [01:40:38](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6038s) and finally let's talk about [01:40:41](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6041s) the governance of observability [01:40:42](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6042s) we definitely want an audit trail [01:40:44](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6044s) guardrails outside [01:40:46](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6046s) circuit breakers [01:40:48](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6048s) supply chain verification of a serial testing [01:40:50](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6050s) So, in this case, really sad incident. [01:40:57](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6057s) Somebody instructed the agent, we're in code freeze, don't touch prod. [01:41:03](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6063s) And look at this, understood, thumbs up. [01:41:06](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6066s) That's very trustworthy, right? [01:41:10](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6070s) And what happened? [01:41:12](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6072s) Agent ran drop database, production. [01:41:15](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6075s) Our production also was dev, too, by the way. [01:41:20](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6080s) Very sad. [01:41:22](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6082s) Lots of people... [01:41:25](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6085s) I actually had a friend, by the way, call me and say, [01:41:27](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6087s) what do I do? How do I recover my database? [01:41:32](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6092s) So, we want circuit breakers on anything that is catastrophic, right? [01:41:37](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6097s) We want human approval for any high-value actions, right? [01:41:40](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6100s) We want scoped credentials to only the actions we want the agent to do. [01:41:44](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6104s) And we definitely want tenant isolation. [01:41:47](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6107s) Imagine it dropped all the tables. [01:41:50](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6110s) All right. [01:41:52](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6112s) So in this case, this sounds very rudimentary. [01:41:56](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6116s) So you had a fake MCP on NPM. [01:41:58](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6118s) What else is new here? [01:42:01](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6121s) But it was 15 clean releases. [01:42:03](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6123s) It was a very useful utility. [01:42:05](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6125s) And the attacker on the version 16 added a line on BCC [01:42:10](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6130s) is saying basically like, send me, by the way, all the emails on BCC line to me. [01:42:15](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6135s) Okay? [01:42:17](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6137s) So this is kind of a classic supply chain verification, but I would say like, don't [01:42:22](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6142s) just do supply chain verification. [01:42:24](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6144s) Do delay ingest. [01:42:26](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6146s) Don't ingest every package on day zero. [01:42:30](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6150s) Ingest it maybe in a week or two. [01:42:34](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6154s) You want a deterministic invocation broker, least privileged tools, egress controls. [01:42:40](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6160s) All right, so let's recap. [01:42:42](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6162s) We're talking about defense and depth for Gentic AI. [01:42:46](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6166s) This is your toolbox. [01:42:47](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6167s) You want to make sure that you have identity and trust, prompting input defense, [01:42:52](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6172s) tool and action governance, execution, isolation, data protection, governance, observability. [01:42:57](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6177s) And as I said, this is kind of like eating your vegetable stock. [01:43:01](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6181s) So here's your vegetables. [01:43:03](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6183s) Identity needs to be short-lived tokens, one per agent. [01:43:08](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6188s) Input, outside text, cannot give commands. [01:43:12](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6192s) Tools, syntax is not a control. [01:43:16](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6196s) Isolation, default deny means everything, including DNS. [01:43:22](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6202s) Data, check the tenant on every query. [01:43:26](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6206s) Governance, prompts ask, deterministic code enforces. [01:43:31](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6211s) Three priorities starting today. [01:43:36](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6216s) lock down your agents [01:43:37](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6217s) use the rule of two [01:43:40](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6220s) every tool call [01:43:41](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6221s) needs to go through some sort of [01:43:43](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6223s) deterministic broker [01:43:46](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6226s) and humans [01:43:47](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6227s) sign off for any high value actions [01:43:49](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6229s) second [01:43:50](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6230s) one agent, one identity [01:43:54](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6234s) kill any [01:43:55](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6235s) long lift keys [01:43:57](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6237s) everything needs to be tight scoped [01:43:59](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6239s) tokens, short lift, audience [01:44:01](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6241s) bound tokens [01:44:03](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6243s) box the run time [01:44:04](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6244s) but pair it up with default deny egress, that means DNS as well. [01:44:09](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6249s) Make sure there are budgets that halt, not just alert. [01:44:15](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6255s) Finally, I will leave you with this. [01:44:18](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6258s) Who does the spec-driven development here? [01:44:21](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6261s) Well, yeah. [01:44:23](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6263s) Okay. [01:44:24](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6264s) Make sure your spec includes security requirements. [01:44:27](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6267s) And this is just a sample. [01:44:29](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6269s) You can pin me on LinkedIn for a more comprehensive one. [01:44:35](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6275s) And I also have a notebook alum that explains a little more concepts, [01:44:39](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6279s) if you're confused about some of them. [01:44:42](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6282s) So please connect on LinkedIn. [01:44:45](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6285s) Build fast. Deploy securely. [01:44:47](https://www.youtube.com/watch?v=jiUC6IUMdvc&t=6287s) Thank you.