Insecure Agents Podcast

"There's no separation between the control and data planes." @guypod (founder of @tessl_io and @snyksec) That's why prompt injection works, and why you can't secure a skill from inside the model. The fix: put the control plane where the context can't reach it.

Follow Insecure Agents Events: luma.com/insecureagents Try AAuth, join the slack channel, learn more: #walkthrough" target="_blank" rel="nofollow noopener">aauth.dev/#walkthrough

The energy at AAuth Night: Moving Beyond OAuth was incredible! @jankytweet shared how ID-JAG makes OAuth better today. @DickHardt introduced AAuth, a new protocol that tracks an agent's mission and runs agents without API keys. Thanks to our panelists and everyone who demo'd and @okta @snyksec @KeycardLabs @cloudsa for their support!

in b4 this becomes the new oauth

Incredible turn out for AAuth Night - really electric crowd and tons of folks talking about the agent auth problem.

Doors just opened and AAuth Night is filling up fast @aiDotEngineer

@ShrekOverflow 🙌 see you there

So very excited to see x.com/insecureagents… 😍

My thoughts on agents and oauth2 is increasingly.

AAuth Night: Moving Beyond OAuth is TONIGHT We have over 500 people registered for our @aiDotEngineer side event! It's a stone's throw from Moscone and doors open at 5:30pm expect DEMOS + PANEL + COMMUNITY

Grab one of the last spots: luma.com/a2h25m60

AAuth night is TOMORROW and we're excited to share @okta is joining as a supporter. We're glad to have Okta in the room to help us think through the best practices for agent auth today and what we need to build for tomorrow.

Full episode: insecureagents.com/episodes/karl-… Karl is on the panel at AAuth Night: Moving Beyond OAuth this Wednesday in SF: luma.com/a2h25m60

The average company hands out ~16 OAuth grants per employee. That's 16,000 long-lived keys a thousand-person org can't see or revoke. @jankytweet, author of ID-JAG, on why agents make that ungovernable, and how to fix it. Out now 👇

THE GREAT LOOPS DEBATE is on @ianlivingstone and @GeoffreyHuntley take on @dexhorthy and a surprise guest to answer Do loops produce slop? Do we have the AI infra we need today to verify the work and track state? What tasks are right for loops? Main stage 7/2 @aiDotEngineer

@derekmeegan @browserbase If you want to learn more about the current best practices for agent security and where the future is headed come to our side event during AI Engineer on July 1 luma.com/a2h25m60

100% feature-request coverage. 99% of support answered in under 24 hours. Built by a few engineers. @derekmeegan built bb, the internal agent serving the entire team at @browserbase. His advice: if you want to scale an agent's reach make sure the harness is verifiably secure.

Listen to the full episode: insecureagents.com/episodes/derek…

@aiDotEngineer 🫶

6️⃣ Things to Know about AI Engineer World's Fair 2026 - It’s bigger than all previous AIEs - 4x Larger Expo with 4 Expo stages - Researchers: Poster sessions & Poaster sessions - AI Leadership: Token Billionaires & Off the Record - AI Verticals: Healthcare, GTM, FDE, AGC, Finance - Side Events: NEO, Kids day - attendees get $40k in credits to try everything our sponsors have to offer! It's going to be our BIGGEST show yet!

This clip was from us talking about the Railway incident. If you want to learn about how to build agents that don't drop prod databases come to AAuth Night: Moving Beyond OAuth July 1st @aiDotEngineer You'll learn how to run your agent without an API key luma.com/a2h25m60

"People have actually asked, like we have an MCP server. It's like, oh, it would be nice to be able to delete projects from this. I'm like, no, it's fine. You don't need to be able to do that. You can go to the UI, we don't care." - @zeeg CPO @sentry

@zeeg @sentry If you want to dive deeper into building agents that actually work and you can trust sign up for our AIE side event July 1st luma.com/a2h25m60 come learn about AAuth and be part of the future of agent auth

60 verified vulns including auth bypasses. Cost: $1,000 in compute. "They were all off the critical paths, and impact was limited, but they were issues we would have absolutely paid bounties for." @zeeg (CPO, @sentry) on what agents can actually do once you get past the hype.