Free Daily Podcast Summary
Insecure Agents: Daily Summaries Delivered
by Allie Howe
Insecure Agents lives at the intersection of AI engineering and security. Stay ahead of the curve with expert insights, real-world incidents, and bold ideas for safer agents.
Latest Episodes
The most recent episodes — sign up to get AI-powered summaries of each one.
- 2 weeks ago46 min
Governance Is the Accelerator: Josh Woodruff (CSA) on Getting Agents Out of Pilot Purgatory
Josh Woodruff, Co-Chair of the Zero Trust Working Group at the Cloud Security Alliance and Founder and CEO of Massive Scale AI, joins us to talk about the Agentic Trust Framework, the open source zero trust model for AI agents he donated to CSA. His framing is simple on purpose: treat every agent like a new hire. It goes on the roster, gets a badge, starts as an intern, and earns more freedom through demonstrated reliability, with instant demotion when it misbehaves. Zero trust taught us to check who you are and what you can reach on every request. Josh argues agents need one more check on top of that: what are you doing right now, and is that allowed at this moment? We get into why agents running under a human's identity break your behavioral baselines and turn every kill switch into a work stoppage, why intent is a useful signal but the checkpoint still has to be able to say no, and how ATF fits alongside AARM and Agent Baseline as the field converges.
- Oct 5, 202647 min
The Fishbowl Problem: Agent Identity Across Clouds and Vendors, with Andy McMahon (Barclays)
Andy McMahon, Director and Principal AI & MLOps Engineer at Barclays, joins us to talk about what it actually takes to move an agent from prototype to production inside a 200-year-old bank.His name for the core problem is the fishbowl: every platform, vendor, and runtime arrives with its own identity provider and its own auth, and you are left trying to make the fishbowls speak to each other. The fix was landing on one persistent concept of agent identity that ties the initiating client, the agent, and any delegated permissions together.We get into the three foundations he builds on (gateways, registries, and runtimes), why kill switches have to be layered from credential revocation through gateway denial to killing the runtime entity, why deciding when to pull one is still hard, and why an incident where agents doctored their own logs means the audit log must sit outside agent control.
- Sep 28, 202628 min
From Pets to Cattle: Agent Identity on the Web with Keycard, Browserbase, and Visa
Recorded live at Browserbase Navigate on September 10, this panel discusses the shift of agents as pets to agents as cattle: from hand-managed personal agents with copied API keys to fleets of agents that serve an entire enterprise and act on the open web. Moderator Allie Howe is joined by Ian Livingstone, CEO of Keycard, Peyton Casper, Product Lead, Identity at Browserbase, and Ivy Lee, VP Product, CMS Agentic Commerce at Visa. We get into why you can't revoke an agent's access if you can't identify it (a requirement the Agent Baseline reference architecture for production agents calls out), how Web Bot Auth gives browser agents a cryptographic identity that ties traffic back to a person or organization, how Visa's Trusted Agent Protocol and payment tokens let merchants tell a payment agent from a bad bot, and why the answer to "good intent, wrong action" is permissions scoped to the task, not to the human who launched the agent.
- Sep 22, 202644 min
Blue Team at Machine Speed: Max Pollard (Cotool) on Agentic Defense
Max Pollard, CEO and co-founder of Cotool, joins us to talk about what it actually takes to let blue teams respond at machine speed. Cotool builds agents for detection and response, and Max walks through the crawl, walk, run progression his customers follow: start read only, route every consequential action to a human through an approval hook in Slack or Teams, count how often the agent was right, and only then loosen the leash. His honest read is that very few teams reach the run phase, because humans can't trust agents enough to take themselves out of the loop. We get into why the real blocker is less about trusting the model and more about data annotation, and whether the agent knows at runtime that the server it is about to contain powers a million dollars a day in transactions. Max also covers how Cotool scopes agents at the API endpoint level at config time, why the audit log has to record that an agent acted and on whose behalf even when no human prompted it, and how his team evaluates cost efficiency, instruction adherence, and behavior across 20, 30, or 40 agents running in production.
- Sep 16, 202648 min
Security Will Always Lose If It Gets in the Way: Joel de la Garza (a16z)
Every security leader knows that developers will work around security tooling when they can if it gets in the way of their job. The truth is, employees don't get paid to be secure; they get paid to do their job.Joel de la Garza, partner on the infrastructure team at a16z and former CISO of Box, tells us that the moment security gets in the way of what people want to do, security loses.For a lot of teams, this has meant tolerating uncomfortable security gaps to get the value agents can bring. At Keycard, we call the underlying bind the trilemma of autonomy, capability, and security: teams can only pick two.Joel walks through what securing agents looks like in practice, from a consumer agent logging into an auction site through a browser with every alarm bell ringing to a16z's own coding agents opening tunnels out to Cloudflare to route around egress controls in a secured GCP cluster.We get into why least privilege and agent performance pull against each other, and why some of security's first principles have to be rethought rather than reasserted. We also talk about the pressure CISOs face as they're expected to say yes to agents and lead the agent rollout.Joel also shares his love for Grok Bot and the need for model providers to give blue teams the same advantages attackers now have.
- Sep 9, 202646 min
"Is This Tool Call Allowed? It's Never That Simple": Michael Davis (J.P. Morgan)
Most people that architect an AI agent think to ask a binary question: is this tool call allowed, yes or no? Michael Davis, Global Chief Security Architect at J.P. Morgan, argues it's never that simple. He walks through the four dimensions robotics uses to decide whether it is safe for an arm to move (the state of the system, the state of the environment, the quality of the decision-making, and the uncertainty of the action itself) and maps each one to agents: did the agent gain tools or network connections it did not have before, is it still moving semantically toward its goal after 30 tool calls, and what has the agent already tried. We get into why if you think you need memory, you're probably not thinking of your problem the right way. We also explore software factories and why they need to operate as a cumulative progressive process versus a one shot of go build me this SaaS. Over the course of the episode we piece together what a good reference architecture for agents could look like.
- Sep 3, 202644 min
The Agentic SDLC: Why Most of Software Security Has to Change, with Jet Anderson (GEICO)
Jet Anderson, is a Distinguished Engineer at GEICO and leads the transformation of their product security function. He joins us to discuss the agentic SDLC and why most of what security teams do has to change while the first principles should stay the same. We get into why static analysis and human triage no longer keep pace when models write the code, why we need new AI infrastructure, and why the Hugging Face sandbox escape was a decade-old Kubernetes misconfiguration found at machine speed. Jet tell us the story of when he asked his own agent to "wrap this up" and it merged the PR and did an unauthorized production deploy. He walks through the pre-commit hooks and branch protections he built to prevent this from happening again so that deploys still get an approval gate and an audit trail. He also explains why teams that skip ideation, design, and specification to go straight to code end up with less secure software the more they iterate, and why the unglamorous answer is doubling down on least privilege, egress control, and build containment.
- Sep 1, 202629 min
How to Stop a Goal-Seeking Agent From Thrashing: Travis McPeak, Security Lead at Cursor
Travis McPeak, security lead at Cursor, joined us at Black Hat to talk about what causes coding agents to become problematic and what he's done to keep them on track. What he sees most is the main agent trying hard to solve your problem, getting stuck, and then getting creative. He calls it thrash, and most of the time when somebody says an agent deleted their database, that is what happened. This episode gets into why static controls like block lists and WAFs break down against an agent whose whole job is to find a way through, why an agent can't monitor itself, and how Cursor's auto review agent works: every tool call the main agent is about to make goes to a separate reviewer that does not care about the main goal at all and only enforces its rules. Travis also explains why the team had to carefully word the feedback so the main agent would not spiral, why blocking an action can cause the exact thrash you were trying to prevent, and why least privilege finally scales now thanks to new solutions.
About Insecure Agents
Insecure Agents lives at the intersection of AI engineering and security. Stay ahead of the curve with expert insights, real-world incidents, and bold ideas for safer agents.
Customized Recaps
AI-powered recaps with compact key takeaways, quotes, and insights.
Straight to Your Inbox
Get key takeaways from Insecure Agents in a 5-minute read.
Save Hours Every Week
Stay current on your favorite podcasts without falling behind.
Frequently Asked Questions
What is Podzilla's Insecure Agents daily summary?
It's a free AI-powered email that summarizes new episodes of Insecure Agents as soon as they're published. You get the key takeaways, notable quotes, and links & mentions — all in a quick read.
How does the Insecure Agents podcast summary work?
When a new episode drops, our AI transcribes and analyzes it, then generates a personalized summary tailored to your interests and profession. It's delivered to your inbox every morning.
Is this an official Insecure Agents product?
No. Podzilla is an independent service that summarizes publicly available podcast content. We're not affiliated with or endorsed by Allie Howe.
Can I get summaries of other podcasts too?
Absolutely! The free plan covers up to 3 podcasts, any in the catalog. Basic raises that to 15, Pro to 40 and Max to 100. Browse our full catalog at /podcasts.
How often does Insecure Agents release new episodes?
Insecure Agents publishes weekly. Our AI generates a summary within hours of each new episode.
What topics does Insecure Agents cover?
Insecure Agents covers topics including News. Our AI identifies the specific themes in each episode and highlights what matters most to you.
Start getting Insecure Agents summaries tomorrow morning.
Free forever for up to 3 podcasts. No credit card required.
Free forever for up to 3 podcasts. No credit card required.