Micah Silverman

Micah Silverman is Snyk’s Director of AI Acceleration, a Java developer and security educator whose teaching makes security decisions visible in working software. His examples range from a text adventure protected by OAuth to a reconstruction of a compromised GitHub Action and a chatbot with access to confidential student grades. Each connects an observable result to the code, permissions or data access that produced it.

From Java development to hands-on security education

Micah’s programming career reaches back to the early web. In a public career account, he recalls building a Java applet that simulated a Ouija board for the SciFi Channel in 1996: one enormous main method, written before he understood object-oriented programming. He later taught Java as an adjunct professor at New York University and co-authored Mastering Enterprise JavaBeans 3.0 with Rima Patel Sriganesh and Gerald Brose. Published in 2006, the book covered enterprise components, persistence and their integration into Java EE applications.

Micah joined Stormpath as a Java Developer Evangelist in 2015, describing programming and writing as two favorite activities the job brought together. His subsequent work at Okta used runnable applications to explain authentication and authorization.

His Zork-based OAuth application put a classic text adventure behind token-based access controls. Remove the access token, and the application rejects the game command. Integrating Spring Boot, Spring Security and Okta also let him remove seven classes totaling 570 lines of authentication-related code, leaving more of the application devoted to the game.

For the Okta Developer Certification launched in 2020, Micah built the practical examination application. Candidates completed API tasks against an individually provisioned Okta organization, demonstrating that they could operate the system rather than relying entirely on recall.

Explaining the mechanism behind a security failure

At Snyk, Micah’s roles have included Director of DevSecOps Acceleration in 2022 and Head of Security Relations in January 2024. Across his identity, supply chain and AI security work, he explains which implementation choices create—or remove—an opportunity for misuse.

• Separating identity from access. In his OpenID Connect writing, Micah describes initially resisting another protocol after learning OAuth. He came to appreciate OIDC’s explicit treatment of identity, defined token formats and separation between identifying a user and authorizing access to resources. His examples explain what each token does, making clear why a successful login does not answer every access-control question.

• Reconstructing a software supply chain attack. Micah’s harmless simulation of the 2025 tj-actions/changed-files compromise shows how moved release tags and commits detached from branches can conceal altered behavior. It also highlights a review trap: a GitHub Action can execute its bundled distribution file even when the corresponding source file appears unchanged. His contribution was to reconstruct and explain the attack, not to discover it.

AI security beyond instructions to the model

Micah teaches Snyk’s AI Security Engineer Foundations curriculum, covering AI risks, shadow AI, threat modeling, MCP security, secure agentic development and adversarial testing. His recorded course carries familiar application-security questions into systems that can interpret prompts, retrieve information and execute tools: what can the system read, and what can it do?

A central exercise uses Snyk Workshops’ deliberately vulnerable student assistant. The chatbot refuses to reveal confidential grades, but its refusal exposes that it has access to them. Micah contrasts a system prompt asking the assistant to keep information private with a restricted database view that removes the information from its available context. The latter changes what the application can disclose, rather than depending solely on the model following an instruction.

He also distinguishes malicious MCP tool descriptions from vulnerabilities in the server’s executable code, pairing agent-focused scans with dependency and source analysis. These are different routes to compromise and require different checks. In a live EVO demonstration, he inventories models, datasets, MCP servers and skills, then adds a policy that flags a prohibited model already present in a project. He extends that inventory into proposed build gates; the demonstration itself establishes detection, not an implemented deployment block.

The course retains the uncertainty of adversarial testing. Several audience prompts fail to extract the confidential grades in the final exercise. Micah uses variable model behavior to argue for repeated testing alongside controls such as restricted credentials, isolated environments and human approval. A refusal is one observed response; limiting the application’s access changes the conditions under which every response is produced.