We'll dig into this live TOMORROW after @aiDotEngineer with @ianlivingstone, @AhmadNassri, @ealeyner, @DickHardt, @braintrust, @SocketSecurity, @KeycardAI. Panel, then live demos. At Elsie Rooftop 🥂🗽

"If it starts getting stuck, then it will do what I call thrash. It just starts to get creative about ways to solve the problem, and that is very unpredictable." - @travismcpeak @cursor_ai We learned thrash from Travis. Next week's reference architecture release defines it.

The Fishbowl Problem: Agent Identity Across Clouds and Vendors, with Andy McMahon (Barclays) "There's a tendency to think, we've got OAuth on behalf of flows, we've solved this problem. We really haven't." Andy McMahon, Principal AI & MLOps Engineer @Barclays, guest lecturer at @UniofOxford, and author of Machine Learning Engineering with Python, joined us to talk about what it takes to get an agent into production inside a 200-year-old bank. He walks through the "fishbowl problem" of stitching permissions across clouds and SaaS vendors, why "we've solved this with OAuth on-behalf-of flows" is wishful thinking, and how a persistent agent identity, tying the initiating client, the agent, and its delegated permissions together, gives gateways, registries, and runtimes the teeth to actually enforce control. We get into: > The fishbowl problem: every platform, vendor, and runtime brings its own identity provider and its own auth > Why gateways, registries, and runtimes are the foundation you need before you experiment > The layered kill switch: quarantine the identity, revoke the credentials, deny at the gateway, shut down the runtime entity > Why knowing when to pull that switch is still an unsolved problem > What it means that agents at Hugging Face doctored their own logs TIMESTAMPS (01:20) Innovation inside a 200-year-old bank (04:35) The fishbowl problem: every platform brings its own identity provider (05:50) Why OAuth on-behalf-of flows fall short (08:13) Where control sits when a SaaS vendor owns the whole agent ecosystem (10:20) Gateways, registries, runtimes, and non-determinism across the architecture (13:48) The registry as system of record, dedup, and quality gates (17:24) Layered kill switches: quarantine, revoke, deny, delete (20:00) The unsolved part: knowing when to pull the switch (21:37) Agents doctoring their own logs at Hugging Face (22:48) Why you cannot trust the application to audit itself (24:06) Intent-based auth, mission drift, and AAuth (30:00) Budgets, the Resy incident, and enforcing control using short lived credentials (38:39) Software factories, human in the loop, and accountability when agents write the code (40:36) The bottleneck was never the writing of the code

Our next AAuth Night is coming up soon on Oct 15th! @DickHardt @ianlivingstone @jankytweet @jaredhanson Learn how to set a budget on how many times an agent can call a downstream resource, track an agent’s mission, and run agents without API keys. RSVP

"Our detection times are in minutes from the time that something is published, we already know what it is" @AhmadNassri CTO @SocketSecurity Excited to see Ahmad demo how to validate what our agents consume at machine speed 10/13 after @aiDotEngineer NYC

"In dev, we have the main agent, it's building software, and then we have a security review agent, for example, and it doesn't care about the main goal at all. It's just find any potential security problems in this, and then go report them back to the main agent." @travismcpeak security lead @cursor_ai

AAuth Night: Moving Beyond OAuth is happening Oct 15 in SF! Join us if you want to learn how to run agents without an API key, track if an agent is following its mission, and set limits on the amount of times an agent can call a downstream resource.

"When a robot's going to move its arm, it's generally predicting what are all the outcomes that potentially could happen next. We very rarely do that in cyber. Most of our detective stuff is binary." - Michael A. Davis, Global Chief Security Architect @jpmorgan

"Is This Tool Call Allowed? It's Never That Simple": Michael Davis (J.P. Morgan) "Is the AI agent still making good decisions? Maybe it's made 30 tool calls already. With a classifier, say, well, did it make the right tool calls? Is it still moving semantically towards its goal?" Michael Davis, Global Chief Security Architect at @jpmorgan, explains the complexity of architecting secure agents, and why runtime security decisions should model the way robotics deals with uncertainty. We get into why  if you think you need memory, you're probably not thinking about your problem the right way. We also explore why software factories need to operate as a  cumulative, progressive process versus a one shot "go build me this SaaS". Over the course of the episode we piece together what a good reference architecture for agents ought to include. We get into: > The four dimensions robotics uses to decide it is safe to move an arm > Why memory is an extremely complex addition to your agent > How to know an agent will call an API in the right order with the right parameters at the right time > Software Factories: what works and what doesn't TIMESTAMPS (00:01) The cybersecurity poverty line, and why your suppliers' breaches become yours (00:03) Patching is harder for the models than finding the vulnerability (00:04) Partial coverage, unnecessary functions, and trading a security incident for an ops incident (00:05) The loop ends at the patch, which is where the application teams begin (00:06) Software monoculture, and why we all get one patch (00:07) 7,000 shipping configurations was a people problem, now it is a compute problem (00:09) Skills are code, and every skill brings its own dependencies (00:13) Taxonomies for vulnerabilities and mitigations (00:14) A mitigation is deleting the code (00:15) Pioneers and settler teams inside a very large bank (00:18) Multiple paved paths, and when to merge them into an expressway (00:22) How do you know that read-only role is really read-only (00:24) Removing the ability to read an email and send one in the same session (00:26) Verification asks whether the test passed, not whether the agent did the right thing (00:29) The handoff leaked the data, and both agents were authorized (00:31) "I don't believe memory is a thing" (00:34) Why memory makes just-in-time access impossible (00:37) Exfiltrating data through a batch of calendar invites (00:39) Where could you point me to a good reference architecture (00:41) The four dimensions robotics uses to decide it is safe to move an arm (00:43) Retries are not a bad thing

"How are we gonna deploy this thing, who's gonna use it? What are the authentication and authorization requirements around it? The SDLC never went away. We just had to reintegrate it back into the agentic world of software development." - @thatsjet @GEICO

The Agentic SDLC: Why Most of Software Security Has to Change, with Jet Anderson "Always be building the best sandbox, assuming the worst intent of a model that would run inside of it. But then go back to the same things we did in the SDLC before. Authentication, authorization, access control, egress control, infrastructure config hardening, supply chain hardening" @thatsjet is a Distinguished Engineer at @GEICO leading the transformation of their product security function, and author of GEICO's blog on the agentic SDLC. He came on the week after Black Hat to explain what actually breaks when models write the code, the infrastructure, and the deploy pipeline, and while somethings have to change, most of the fix is a set of controls we already know. We get into: > Why the security toolbox built around human triage runs out of road when output goes up an order of magnitude > Why the Hugging Face sandbox escape was a decade-old Kubernetes misconfiguration found at machine speed > The day he told his own agent to wrap it up and it merged the PR and deployed to prod > Why teams that skip ideation and design get less secure software the more they iterate > His prediction that agents will invent their own covert language in Unicode we can't read TIMESTAMPS (01:20) From graphic design to leading product security at GEICO (03:30) Why the agentic SDLC is a problem of scale, not new first principles (05:00) Code volume 10x or more, and developers who can't evaluate their own output (06:30) Why static analysis and human triage arrive too late and too slow (08:40) The Hugging Face sandbox escape, and why Jet had seen this story before (11:30) Not new classes of weakness, the same ones found a hundred times faster (15:40) "Let's wrap this up" and the unauthorized production deploy (17:30) Pre-commit hooks, branch protections, and an audit trail for a solo developer (20:30) Why skipping ideation and design makes software less secure the more you iterate (23:00) Behavioral monitoring, agents watching agents, and "I can't complete my goal" (30:30) Agents inventing their own covert language in Unicode (32:40) Sandbox escape bench: frontier models with guardrails scored zero (36:00) Provenance, cool-down periods, and containing your builds (38:40) Are we already in the four-month window for agentic security?

How to Stop a Goal-Seeking Agent From Thrashing: Travis McPeak, Security Lead at Cursor "Most of the time, 'It deleted my database,' is actually not going be a prompt injection. It's going be thrash." @travismcpeak, security lead at @cursor_ai, talked to us at Black Hat about what actually causes coding agents to go wrong. When an agent is trying hard to solve a problem and gets stuck, it starts getting creative. He calls it thrash, and he walked us through what Cursor built to stop it. We get into: > Why block lists and WAFs break down against an agent whose whole job is to find a way through > Why an agent can't monitor itself, and what a reviewer that has a different goal catches instead > How Cursor's auto review sees every tool call before it fires, and why the feedback had to be worded carefully > Why blocking an action can cause the exact thrash you were trying to prevent > Why least privilege finally scales now TIMESTAMPS (01:30) Travis McPeak, security lead at Cursor, live from Black Hat (02:45) Why block lists and WAFs break down against a creative agent (03:20) Why an agent can't course correct itself (03:40) Thrash: what actually deleted your database (04:15) Inside Cursor's auto review, and wording the feedback so the main agent doesn't spiral (06:00) Least privilege that finally scales (07:00) Layered defense: permissions are the boundary, review and proxy decide the rest (09:00) What a software factory needs: validators, canaries, observability, a fast loop (11:40) An error, a left turn, and an agent going off the rails (13:00) Agents as early-career employees: tell them to stop and ask (15:40) The sudo deny list, and the Python script that sails right past it (18:30) Agent identity: person, bot, or bot on behalf of me (23:45) The 500-character shell command, 200 approvals, and consent fatigue (26:45) Reacting at machine speed

Blocking Bad Packages at the Network Level: Ahmad Nassri (Socket) on Controlling What an Agent Sees "We're also masking the visibility of those numbers and those versions' existence from the agent itself. So as far as the agent or the package manager is concerned, those versions don't exist." @AhmadNassri, CTO of @SocketSecurity and previously CTO of npm, talked to us live at Black Hat about why denying a coding agent a bad package does not completely remove the risk, and why the answer is to make it seem like the package doesn't exist at all. We get into: > What a goal-seeking agent will do if it's blocked: go to the CDN for the tarball of a blocked package or try to resolve npm by DNS > How masking bad versions at the network level stops an agent from thrashing and going after another route > The Shai-Hulud variants that ship no malicious code at all, just a prompt telling your agent it is an authorized pentester > Why the output you approved was the fifth thing the agent tried, and the four it discarded are where a compromise could live TIMESTAMPS (01:20) The OpenAI agent that escaped its sandbox and took 17,000 actions (02:40) Turning a package registry into a reverse proxy to the open internet (03:50) When zero days stopped being a Fortune 500 problem, and why the low vulns matter now (05:10) Goal seeking agents (06:50) The low severity CVE you ignored for five years is now exploitable (10:00) Socket Firewall stopping malicious packages at the network level (10:40) Detection in minutes from publication, and stopping the keyv worm mid-spread (11:40) Blocked agents going straight to the CDN, or rewriting the registry config (18:00) When the payload is a prompt (19:40) Secrets, permissions, and controlling action actions (22:00) The chain of custody problem with Agent Skills (28:00) Short-lived task scoped credentials (31:50) Attackers rewriting malware in real time when they notice they are blocked

The energy at AAuth Night: Moving Beyond OAuth was incredible! @jankytweet shared how ID-JAG makes OAuth better today. @DickHardt introduced AAuth, a new protocol that tracks an agent's mission and runs agents without API keys. Thanks to our panelists and everyone who demo'd and @okta @snyksec @KeycardLabs @cloudsa for their support!