@insecureagents
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
AI engineers and security practitioners listen to us to learn how to give their agents the security they need to reach full autonomy and capability.
San Francisco, CA
Joined June 2025
- Tweets332
- Following118
- Followers1K
- Likes613
"In dev, we have the main agent, it's building software, and then we have a security review agent, for example, and it doesn't care about the main goal at all. It's just find any potential security problems in this, and then go report them back to the main agent."
@travismcpeak security lead @cursor_ai
How to Stop a Goal-Seeking Agent From Thrashing: Travis McPeak, Security Lead at Cursor
"Most of the time, 'It deleted my database,' is actually not going be a prompt injection. It's going be thrash."
@travismcpeak, security lead at @cursor_ai, talked to us at Black Hat about what actually causes coding agents to go wrong. When an agent is trying hard to solve a problem and gets stuck, it starts getting creative. He calls it thrash, and he walked us through what Cursor built to stop it.
We get into:
> Why block lists and WAFs break down against an agent whose whole job is to find a way through
> Why an agent can't monitor itself, and what a reviewer that has a different goal catches instead
> How Cursor's auto review sees every tool call before it fires, and why the feedback had to be worded carefully > Why blocking an action can cause the exact thrash you were trying to prevent
> Why least privilege finally scales now
TIMESTAMPS
(01:30) Travis McPeak, security lead at Cursor, live from Black Hat
(02:45) Why block lists and WAFs break down against a creative agent
(03:20) Why an agent can't course correct itself
(03:40) Thrash: what actually deleted your database
(04:15) Inside Cursor's auto review, and wording the feedback so the main agent doesn't spiral
(06:00) Least privilege that finally scales
(07:00) Layered defense: permissions are the boundary, review and proxy decide the rest
(09:00) What a software factory needs: validators, canaries, observability, a fast loop
(11:40) An error, a left turn, and an agent going off the rails
(13:00) Agents as early-career employees: tell them to stop and ask
(15:40) The sudo deny list, and the Python script that sails right past it
(18:30) Agent identity: person, bot, or bot on behalf of me
(23:45) The 500-character shell command, 200 approvals, and consent fatigue
(26:45) Reacting at machine speed
Blue Team at Machine Speed: Max Pollard (Cotool) on Agentic Defense
"There's a lot of marketing noise to say, hey, take the human out of the loop. We've seen very few people hit that run phase."
@maxpollard415, CEO and co-founder of @cotoolai, builds AI agents for detection and response, and explains how hard it is to give an agent the autonomy to do real work. He talked to us about what actually stands between a blue team and machine speed response.
We get into:
> Crawl, walk, run: read only, then an approval hook in Slack, then counting how often the agent was right
> Why one blocker is whether the agent knows at runtime that the server it is about to kill powers a million dollars a day
> Why Cotool grants API access during config time
> Why the audit log has to capture each agent action and whether it acted on someone's behalf
TIMESTAMPS
(01:00) Scaling detection and response beyond headcount
(02:00) Why attackers adopt first: no twelve month compliance review
(04:30) Rails, paved roads, off-ramps, and the nine-person team with no security hire
(09:30) Do the agents actually take action? Starting read only
(11:00) Approval hooks: routing the action to a human in Slack or Teams
(12:00) "Take the human out of the loop" is marketing noise
(13:50) The trust problem is really a data annotation problem
(17:00) What Cotool evaluates: cost, instruction adherence, disposition
(19:00) Knowing when agent number 17 of 40 starts drifting
(27:00) Agent identity and how RBAC works in Cotool
(29:30) Keeping the audit log out of the agent's reach
(31:30) Agent trajectory telemetry, and terabytes a month of it
(34:30) Coarse-grained APIs and the god mode credential problem
(40:00) What's next: auto research loops and digital twins
"We go very, very granular, beyond the integration as to what specific API calls get attached to an agent."
- @maxpollard415 CEO @cotoolai
"We go very, very granular, beyond the integration as to what specific API calls get attached to an agent."
- @maxpollard415 CEO @cotoolai
Blue Team at Machine Speed: Max Pollard (Cotool) on Agentic Defense
"There's a lot of marketing noise to say, hey, take the human out of the loop. We've seen very few people hit that run phase."
@maxpollard415, CEO and co-founder of @cotoolai, builds AI agents for detection and response, and explains how hard it is to give an agent the autonomy to do real work. He talked to us about what actually stands between a blue team and machine speed response.
We get into:
> Crawl, walk, run: read only, then an approval hook in Slack, then counting how often the agent was right
> Why one blocker is whether the agent knows at runtime that the server it is about to kill powers a million dollars a day
> Why Cotool grants API access during config time
> Why the audit log has to capture each agent action and whether it acted on someone's behalf
TIMESTAMPS
(01:00) Scaling detection and response beyond headcount
(02:00) Why attackers adopt first: no twelve month compliance review
(04:30) Rails, paved roads, off-ramps, and the nine-person team with no security hire
(09:30) Do the agents actually take action? Starting read only
(11:00) Approval hooks: routing the action to a human in Slack or Teams
(12:00) "Take the human out of the loop" is marketing noise
(13:50) The trust problem is really a data annotation problem
(17:00) What Cotool evaluates: cost, instruction adherence, disposition
(19:00) Knowing when agent number 17 of 40 starts drifting
(27:00) Agent identity and how RBAC works in Cotool
(29:30) Keeping the audit log out of the agent's reach
(31:30) Agent trajectory telemetry, and terabytes a month of it
(34:30) Coarse-grained APIs and the god mode credential problem
(40:00) What's next: auto research loops and digital twins
"You put these tools for hacking into the world, but then you handicap the blue teamers, just feels like a falsely created equilibrium or disequilibrium." - Joel de la Garza, @a16z
Security Will Always Lose If It Gets in the Way: Joel de la Garza (a16z)
"You're not paying people to be secure, you're paying people to do their job. And at the moment where security gets in the way of people doing what they want to do, security will always lose."
Joel de la Garza, partner on the infrastructure team at @a16z and previously the CISO at Box, sat down with us at the a16z studio in San Francisco to explain why the attacker advantage everyone is measuring is manufactured and how security teams can secure agents without getting in the way.
We get into:
> Why the disequilibrium between attackers and defenders is artificial, created by gatekeeping rather than technology
> What happened when a16z's own coding agents opened tunnels out to Cloudflare to route around egress controls
> Why the cost to hack fell from millions of dollars to nothing, and why a decade of accepted risk is now reachable
> Why agents perform better without least privilege, and which security first principles have to be rethought
TIMESTAMPS
(01:20) Static secrets in GitHub Actions, and the best practice that became a non-negotiable
(02:30) Everybody has a plan until they get punched in the face
(03:40) A decade of risk acceptance, and the security debt that compounded
(06:40) The cost to hack goes from millions of dollars to zero
(07:50) The coding agents that tunneled out of a secured GCP cluster
(09:00) Agents have no morality
(10:30) The end state fallacy, and why the disequilibrium is artificial
(11:30) Curing cancer is hard so sell cigarettes instead
(12:40) Why enterprise budget lands overwhelmingly on blue team
(14:00) Every platform shift gets its security wave. Agents are day one
(16:30) Blocking what the agent can even see, and agents that watch agents
(18:30) Ephemeral sprites or long-running persistent agents
(22:00) The agent access illusion tradeoff between performance and security
(24:00) You're not paying people to be secure
(27:00) Agents work better when there isn't least privilege
(42:00) Why open source is the existential requirement for defenders
(46:30) CISO must say yes and lead the rollout
Security Will Always Lose If It Gets in the Way: Joel de la Garza (a16z)
"You're not paying people to be secure, you're paying people to do their job. And at the moment where security gets in the way of people doing what they want to do, security will always lose."
Joel de la Garza, partner on the infrastructure team at @a16z and previously the CISO at Box, sat down with us at the a16z studio in San Francisco to explain why the attacker advantage everyone is measuring is manufactured and how security teams can secure agents without getting in the way.
We get into:
> Why the disequilibrium between attackers and defenders is artificial, created by gatekeeping rather than technology
> What happened when a16z's own coding agents opened tunnels out to Cloudflare to route around egress controls
> Why the cost to hack fell from millions of dollars to nothing, and why a decade of accepted risk is now reachable
> Why agents perform better without least privilege, and which security first principles have to be rethought
TIMESTAMPS
(01:20) Static secrets in GitHub Actions, and the best practice that became a non-negotiable
(02:30) Everybody has a plan until they get punched in the face
(03:40) A decade of risk acceptance, and the security debt that compounded
(06:40) The cost to hack goes from millions of dollars to zero
(07:50) The coding agents that tunneled out of a secured GCP cluster
(09:00) Agents have no morality
(10:30) The end state fallacy, and why the disequilibrium is artificial
(11:30) Curing cancer is hard so sell cigarettes instead
(12:40) Why enterprise budget lands overwhelmingly on blue team
(14:00) Every platform shift gets its security wave. Agents are day one
(16:30) Blocking what the agent can even see, and agents that watch agents
(18:30) Ephemeral sprites or long-running persistent agents
(22:00) The agent access illusion tradeoff between performance and security
(24:00) You're not paying people to be secure
(27:00) Agents work better when there isn't least privilege
(42:00) Why open source is the existential requirement for defenders
(46:30) CISO must say yes and lead the rollout
"It feels like every agent's building a lot of infrastructure that feels reusable"
- Joel de la Garza, Partner on the @a16z Infra Investing Team
"It feels like every agent's building a lot of infrastructure that feels reusable"
- Joel de la Garza, Partner on the @a16z Infra Investing Team
Security Will Always Lose If It Gets in the Way: Joel de la Garza (a16z)
"You're not paying people to be secure, you're paying people to do their job. And at the moment where security gets in the way of people doing what they want to do, security will always lose."
Joel de la Garza, partner on the infrastructure team at @a16z and previously the CISO at Box, sat down with us at the a16z studio in San Francisco to explain why the attacker advantage everyone is measuring is manufactured and how security teams can secure agents without getting in the way.
We get into:
> Why the disequilibrium between attackers and defenders is artificial, created by gatekeeping rather than technology
> What happened when a16z's own coding agents opened tunnels out to Cloudflare to route around egress controls
> Why the cost to hack fell from millions of dollars to nothing, and why a decade of accepted risk is now reachable
> Why agents perform better without least privilege, and which security first principles have to be rethought
TIMESTAMPS
(01:20) Static secrets in GitHub Actions, and the best practice that became a non-negotiable
(02:30) Everybody has a plan until they get punched in the face
(03:40) A decade of risk acceptance, and the security debt that compounded
(06:40) The cost to hack goes from millions of dollars to zero
(07:50) The coding agents that tunneled out of a secured GCP cluster
(09:00) Agents have no morality
(10:30) The end state fallacy, and why the disequilibrium is artificial
(11:30) Curing cancer is hard so sell cigarettes instead
(12:40) Why enterprise budget lands overwhelmingly on blue team
(14:00) Every platform shift gets its security wave. Agents are day one
(16:30) Blocking what the agent can even see, and agents that watch agents
(18:30) Ephemeral sprites or long-running persistent agents
(22:00) The agent access illusion tradeoff between performance and security
(24:00) You're not paying people to be secure
(27:00) Agents work better when there isn't least privilege
(42:00) Why open source is the existential requirement for defenders
(46:30) CISO must say yes and lead the rollout
AAuth Night: Moving Beyond OAuth is happening Oct 15 in SF!
Join us if you want to learn how to run agents without an API key, track if an agent is following its mission, and set limits on the amount of times an agent can call a downstream resource.
luma.com/insecure-rmm0
We're thrilled to support AARM Intercept Demo Night happening October 21st in SF with @TrustVanta and @KeycardAI.
If you're interested in seeing how to make it so an agent can only do the thing it was asked to do apply to join us.
RSVP: luma.com/vanta-zg62?utm_sour…
"Is This Tool Call Allowed? It's Never That Simple": Michael Davis (J.P. Morgan)
"Is the AI agent still making good decisions? Maybe it's made 30 tool calls already. With a classifier, say, well, did it make the right tool calls? Is it still moving semantically towards its goal?"
Michael Davis, Global Chief Security Architect at @jpmorgan, explains the complexity of architecting secure agents, and why runtime security decisions should model the way robotics deals with uncertainty. We get into why if you think you need memory, you're probably not thinking about your problem the right way. We also explore why software factories need to operate as a cumulative, progressive process versus a one shot "go build me this SaaS". Over the course of the episode we piece together what a good reference architecture for agents ought to include.
We get into:
> The four dimensions robotics uses to decide it is safe to move an arm
> Why memory is an extremely complex addition to your agent
> How to know an agent will call an API in the right order with the right parameters at the right time
> Software Factories: what works and what doesn't
TIMESTAMPS
(00:01) The cybersecurity poverty line, and why your suppliers' breaches become yours
(00:03) Patching is harder for the models than finding the vulnerability
(00:04) Partial coverage, unnecessary functions, and trading a security incident for an ops incident
(00:05) The loop ends at the patch, which is where the application teams begin
(00:06) Software monoculture, and why we all get one patch
(00:07) 7,000 shipping configurations was a people problem, now it is a compute problem
(00:09) Skills are code, and every skill brings its own dependencies
(00:13) Taxonomies for vulnerabilities and mitigations
(00:14) A mitigation is deleting the code
(00:15) Pioneers and settler teams inside a very large bank
(00:18) Multiple paved paths, and when to merge them into an expressway
(00:22) How do you know that read-only role is really read-only
(00:24) Removing the ability to read an email and send one in the same session
(00:26) Verification asks whether the test passed, not whether the agent did the right thing
(00:29) The handoff leaked the data, and both agents were authorized
(00:31) "I don't believe memory is a thing"
(00:34) Why memory makes just-in-time access impossible
(00:37) Exfiltrating data through a batch of calendar invites
(00:39) Where could you point me to a good reference architecture
(00:41) The four dimensions robotics uses to decide it is safe to move an arm
(00:43) Retries are not a bad thing
"We have teams built inside the company that are there to adopt the pioneering capabilities. And kind of smooth out those rough edges and make them adoptable by the rest of the organization. By doing that, it actually allows innovation to be much more rapid. - Michael Davis, Global Chief Security Architect @jpmorgan
"When a robot's going to move its arm, it's generally predicting what are all the outcomes that potentially could happen next. We very rarely do that in cyber. Most of our detective stuff is binary."
- Michael A. Davis, Global Chief Security Architect @jpmorgan
"We have teams built inside the company that are there to adopt the pioneering capabilities. And kind of smooth out those rough edges and make them adoptable by the rest of the organization. By doing that, it actually allows innovation to be much more rapid. - Michael Davis, Global Chief Security Architect @jpmorgan
"Is This Tool Call Allowed? It's Never That Simple": Michael Davis (J.P. Morgan)
"Is the AI agent still making good decisions? Maybe it's made 30 tool calls already. With a classifier, say, well, did it make the right tool calls? Is it still moving semantically towards its goal?"
Michael Davis, Global Chief Security Architect at @jpmorgan, explains the complexity of architecting secure agents, and why runtime security decisions should model the way robotics deals with uncertainty. We get into why if you think you need memory, you're probably not thinking about your problem the right way. We also explore why software factories need to operate as a cumulative, progressive process versus a one shot "go build me this SaaS". Over the course of the episode we piece together what a good reference architecture for agents ought to include.
We get into:
> The four dimensions robotics uses to decide it is safe to move an arm
> Why memory is an extremely complex addition to your agent
> How to know an agent will call an API in the right order with the right parameters at the right time
> Software Factories: what works and what doesn't
TIMESTAMPS
(00:01) The cybersecurity poverty line, and why your suppliers' breaches become yours
(00:03) Patching is harder for the models than finding the vulnerability
(00:04) Partial coverage, unnecessary functions, and trading a security incident for an ops incident
(00:05) The loop ends at the patch, which is where the application teams begin
(00:06) Software monoculture, and why we all get one patch
(00:07) 7,000 shipping configurations was a people problem, now it is a compute problem
(00:09) Skills are code, and every skill brings its own dependencies
(00:13) Taxonomies for vulnerabilities and mitigations
(00:14) A mitigation is deleting the code
(00:15) Pioneers and settler teams inside a very large bank
(00:18) Multiple paved paths, and when to merge them into an expressway
(00:22) How do you know that read-only role is really read-only
(00:24) Removing the ability to read an email and send one in the same session
(00:26) Verification asks whether the test passed, not whether the agent did the right thing
(00:29) The handoff leaked the data, and both agents were authorized
(00:31) "I don't believe memory is a thing"
(00:34) Why memory makes just-in-time access impossible
(00:37) Exfiltrating data through a batch of calendar invites
(00:39) Where could you point me to a good reference architecture
(00:41) The four dimensions robotics uses to decide it is safe to move an arm
(00:43) Retries are not a bad thing
"When a robot's going to move its arm, it's generally predicting what are all the outcomes that potentially could happen next. We very rarely do that in cyber. Most of our detective stuff is binary."
- Michael A. Davis, Global Chief Security Architect @jpmorgan
"Is This Tool Call Allowed? It's Never That Simple": Michael Davis (J.P. Morgan)
"Is the AI agent still making good decisions? Maybe it's made 30 tool calls already. With a classifier, say, well, did it make the right tool calls? Is it still moving semantically towards its goal?"
Michael Davis, Global Chief Security Architect at @jpmorgan, explains the complexity of architecting secure agents, and why runtime security decisions should model the way robotics deals with uncertainty. We get into why if you think you need memory, you're probably not thinking about your problem the right way. We also explore why software factories need to operate as a cumulative, progressive process versus a one shot "go build me this SaaS". Over the course of the episode we piece together what a good reference architecture for agents ought to include.
We get into:
> The four dimensions robotics uses to decide it is safe to move an arm
> Why memory is an extremely complex addition to your agent
> How to know an agent will call an API in the right order with the right parameters at the right time
> Software Factories: what works and what doesn't
TIMESTAMPS
(00:01) The cybersecurity poverty line, and why your suppliers' breaches become yours
(00:03) Patching is harder for the models than finding the vulnerability
(00:04) Partial coverage, unnecessary functions, and trading a security incident for an ops incident
(00:05) The loop ends at the patch, which is where the application teams begin
(00:06) Software monoculture, and why we all get one patch
(00:07) 7,000 shipping configurations was a people problem, now it is a compute problem
(00:09) Skills are code, and every skill brings its own dependencies
(00:13) Taxonomies for vulnerabilities and mitigations
(00:14) A mitigation is deleting the code
(00:15) Pioneers and settler teams inside a very large bank
(00:18) Multiple paved paths, and when to merge them into an expressway
(00:22) How do you know that read-only role is really read-only
(00:24) Removing the ability to read an email and send one in the same session
(00:26) Verification asks whether the test passed, not whether the agent did the right thing
(00:29) The handoff leaked the data, and both agents were authorized
(00:31) "I don't believe memory is a thing"
(00:34) Why memory makes just-in-time access impossible
(00:37) Exfiltrating data through a batch of calendar invites
(00:39) Where could you point me to a good reference architecture
(00:41) The four dimensions robotics uses to decide it is safe to move an arm
(00:43) Retries are not a bad thing
Listen wherever you get your podcasts: insecureagents.com/episodes/…
Someone got their Resy account deactivated this week because their agent was making roughly 200 API requests an hour.
Budgets, a new part of AAuth, lets a person manage how much resource their agent is using and could've helped.
RSVP for AAuth Night: luma.com/insecure-rmm0
Totally fair action from Resy tbh just asked Instinct for its activity log and holy hell lol
"Total: roughly 200 API requests per hour, around the clock
1. 4 Charles availability sweep every 10 minutes, 24/7 since Friday morning - each run hit their API ~17-19 times (one per date in a 21-day window). ~100-115 calls/hour
2. Every morning at 9am drop time, a 2.5-minute burst polling every 0.4 seconds - 200-375 requests per drop
3. Occasional session-token refreshes"
Join us at AAuth Night Oct 15th in SF: luma.com/insecure-rmm0
Watch @DickHardt's demo from the last one during @aiDotEngineer World's Fair to learn more about AAuth
"How are we gonna deploy this thing, who's gonna use it? What are the authentication and authorization requirements around it?
The SDLC never went away. We just had to reintegrate it back into the agentic world of software development." - @thatsjet @GEICO
The Agentic SDLC: Why Most of Software Security Has to Change, with Jet Anderson
"Always be building the best sandbox, assuming the worst intent of a model that would run inside of it. But then go back to the same things we did in the SDLC before. Authentication, authorization, access control, egress control, infrastructure config hardening, supply chain hardening"
@thatsjet is a Distinguished Engineer at @GEICO leading the transformation of their product security function, and author of GEICO's blog on the agentic SDLC. He came on the week after Black Hat to explain what actually breaks when models write the code, the infrastructure, and the deploy pipeline, and while somethings have to change, most of the fix is a set of controls we already know.
We get into:
> Why the security toolbox built around human triage runs out of road when output goes up an order of magnitude
> Why the Hugging Face sandbox escape was a decade-old Kubernetes misconfiguration found at machine speed
> The day he told his own agent to wrap it up and it merged the PR and deployed to prod
> Why teams that skip ideation and design get less secure software the more they iterate
> His prediction that agents will invent their own covert language in Unicode we can't read
TIMESTAMPS
(01:20) From graphic design to leading product security at GEICO
(03:30) Why the agentic SDLC is a problem of scale, not new first principles
(05:00) Code volume 10x or more, and developers who can't evaluate their own output
(06:30) Why static analysis and human triage arrive too late and too slow
(08:40) The Hugging Face sandbox escape, and why Jet had seen this story before
(11:30) Not new classes of weakness, the same ones found a hundred times faster
(15:40) "Let's wrap this up" and the unauthorized production deploy
(17:30) Pre-commit hooks, branch protections, and an audit trail for a solo developer
(20:30) Why skipping ideation and design makes software less secure the more you iterate
(23:00) Behavioral monitoring, agents watching agents, and "I can't complete my goal"
(30:30) Agents inventing their own covert language in Unicode
(32:40) Sandbox escape bench: frontier models with guardrails scored zero
(36:00) Provenance, cool-down periods, and containing your builds
(38:40) Are we already in the four-month window for agentic security?
