Blocking Bad Packages at the Network Level: Ahmad Nassri (Socket) on Controlling What an Agent Sees "We're also masking the visibility of those numbers and those versions' existence from the agent itself. So as far as the agent or the package manager is concerned, those versions don't exist." @AhmadNassri, CTO of @SocketSecurity and previously CTO of npm, talked to us live at Black Hat about why denying a coding agent a bad package does not completely remove the risk, and why the answer is to make it seem like the package doesn't exist at all. We get into: > What a goal-seeking agent will do if it's blocked: go to the CDN for the tarball of a blocked package or try to resolve npm by DNS > How masking bad versions at the network level stops an agent from thrashing and going after another route > The Shai-Hulud variants that ship no malicious code at all, just a prompt telling your agent it is an authorized pentester > Why the output you approved was the fifth thing the agent tried, and the four it discarded are where a compromise could live TIMESTAMPS (01:20) The OpenAI agent that escaped its sandbox and took 17,000 actions (02:40) Turning a package registry into a reverse proxy to the open internet (03:50) When zero days stopped being a Fortune 500 problem, and why the low vulns matter now (05:10) Goal seeking agents (06:50) The low severity CVE you ignored for five years is now exploitable (10:00) Socket Firewall stopping malicious packages at the network level (10:40) Detection in minutes from publication, and stopping the keyv worm mid-spread (11:40) Blocked agents going straight to the CDN, or rewriting the registry config (18:00) When the payload is a prompt (19:40) Secrets, permissions, and controlling action actions (22:00) The chain of custody problem with Agent Skills (28:00) Short-lived task scoped credentials (31:50) Attackers rewriting malware in real time when they notice they are blocked