Show Notes
Why are security leaders terrified of connecting AI agents to production data? Because unlike humans, AI agents don't apply judgment, and they operate at machine speed, meaning they can relentlessly hunt down production credentials and do catastrophic damage before a human analyst even blinks. In this episode, Ashish and Caleb sit down with Graham Neray, CEO of Oso, to tackle the massive, unsolved problem of AuthZ (Authorization) for autonomous AI. We explore why the industry's reliance on static, over-permissioned human identities is a recipe for disaster when applied to tools like Claude Code and Notion Agents. Graham explains the dangerous pitfalls of allowing agents to adopt the permissions of their human operators (privilege escalation), versus the complexity of assigning agents their own unique service accounts. The conversation dives deep into the fragmented agent security market. Should you deploy a browser extension, an endpoint sensor, or an edge proxy?. Learn why blocking destructive actions is a flawed approach (because agents need to destroy things to work), and why the future of AI AuthZ requires dynamic, data-level policies and continuous "human in the loop" validation.
Questions asked: (00:00) Introduction(02:50) Graham Neray’s Background and the Mission of Oso(04:20) Why No One is Actually Building Their Own Agents(05:50) The Core Anxiety: Connecting AI to Production Data(07:20) Why Humans Have Judgment and Agents Don't(11:00) The Unsolved Crisis of Human Least Privilege(16:50) Agent Identities: Adopting User Permissions vs. Unique Service Accounts(18:20) Case Study: Privilege Escalation in Agent Alpha Testing(20:00) Background Agents and Unique Identities (Notion, Cursor, Perplexity)(22:30) Why You Need a Governance Plane Outside the AI Product(25:50) The False Promise of Blanket "No Destructive Actions" Policies(33:30) How to Deploy Agent Security: Browsers, Endpoints, and Proxies(38:30) Why No One Actually Uses the "Block" Feature in Security(41:50) The Context Problem: When is an RM-RF Command Good vs. Bad?(43:30) The Future of AuthZ: Resource and Data-Level Agent Permissions
Thank you to Oso for sponsoring this episode of AI Security Podcast.
More from AI Security Podcast
While attackers using AI can now operate at "machine speed," traditional enterprise security teams are often stuck moving at "meeting speed." To bridge this gap, organizations must fundamentally rethink how they structure their security operations, leverage AI for defensive scale, and eliminate the bureaucratic bottlenecks that delay critical patching and remediation. In this episode of the AI Security Podcast, Ashish and Caleb sit down to analyze the September 2026 Anthropic Threat Report and the underlying causes of recent high-profile AI sandbox escapes. Caleb explains how security leaders can fight AI with AI, sharing how he successfully used autonomous agents to conduct a 98% accurate least-privilege architectural audit across his entire organization. Caleb also speaks about the "barbell hiring" strategy eliminating middle management to build a highly agile, cross-functional Security SWAT team composed entirely of principal-level experts and junior engineers.
As the speed of automated threats outpaces traditional patching cycles, organizations must prioritize structural containment over purely reactive detection. Cloud network architectures frequently default to permissive egress, meaning workloads can reach the public internet unless explicitly restricted. In this episode, Doug Merritt, CEO of Aviatrix and former CEO of Splunk, details how to build practical containment strategies for modern cloud and AI environments. He outlines how security teams can implement egress controls in monitor mode to validate traffic without risking system downtime. The discussion covers the transition from legacy IP-based firewalls to identity-based policies for ephemeral serverless and Kubernetes workloads. By prioritizing reachability and blast radius as core metrics, organizations can systematically reduce their attack surface and improve resilience.
When non-technical employees can spin up fully functioning apps in days and AI agents are running parallel workflows that babysit their own pull requests, the traditional SDLC is dead. In this episode, Ashish sits down with Prahathess Rengasamy, Senior Security Engineer at SpaceX AI, to discuss how the staggering compression of development time requires an entirely new approach to security engineering. Prahathess explains why legacy 10-minute PR wait times are incompatible with multi-agent workflows, and how security teams can build internal Model Context Protocol (MCP) servers to inject compliance and security guardrails directly into an agent's context window. We unpack the differences between Q&A chatbots and autonomous coding agents, the critical need to preserve foundational preventative cloud controls (like AWS SCPs and GCP Org Policies), and why holding an autonomous machine accountable for management decisions is a critical architectural flaw. Finally, Prahathess breaks down the "build vs. buy" debate, revealing how small security teams can leverage AI to rapidly deploy internal platforms and paved roads that previously took months to engineer.
How does a global financial engine moving trillions annually manage cyber risk in the age of AI? In this episode, Ashish sits down with Subra Kumaraswamy, CISO of Visa. Subra discusses Visa's journey as part of Anthropic's Glasswing Project testing the Mythos model, revealing why a majority of Mythos-discovered vulnerabilities were non-exploitable due to robust zero-trust architecture and micro-segmentation. Subra explains why Visa open-sourced VVAH (Visa Vulnerability Agentic Harness) to help security teams scale vulnerability discovery, prioritization, and remediation across any model. He also breaks down how Visa triages 98% of Level 1 SOC incidents with AI agents, why "Mean Time to Adapt" (MTTA) is replacing legacy patch timelines, and how cross-functional AI governance enables innovation while maintaining strict production controls
Is the AI "vulnpocalypse" already here? According to Casey Ellis, Founder of Bugcrowd and pioneer of Disclose.io, we aren't quite in an apocalypse yet, we're actually in a "slopdemic." The cost of discovering vulnerabilities has plummeted, flooding bug bounty and SOC triage queues with low-quality, noisy submissions. Because these queues are so overwhelmed, many highly skilled researchers are simply hoarding zero-days because reporting them has become too difficult. In this episode, Ashish sits down with Casey to unpack the major themes and mindset shifts from RSA and Black Hat 2026. Casey breaks down how AI is shrinking the OODA loop for defenders, forcing the industry to adopt a true "assume breach" mentality and reconsider deception technology to frustrate active adversaries. They also explore the risks of non-technical employees "vibe coding" corporate applications and why CISOs must get hands-on with AI tools at home if they want to understand the risks their workforce is taking.