MVP Summit - Agentic Security Roundup

Chris: So we're here at Redmond on the Microsoft campus for Microsoft MVP Summit. So we're both MVPs in the Foundry space. But what's the catch? Josh: Well, kind of like Fight Club, can't talk about it right away because of the NDA in place.

Chris: Everything is under NDA. What has happened this year in 2026 is already quite a lot to talk about. Agents and securities gone wild. We've seen commoditization models.

We've seen legislation. So we're to talk governance, legislation, commoditization, and then what's on the future. So I guess, where do you want to start? Josh: guess let's go with the kind of regulatory and like legal side of this because that's kind of the compelling driver for a lot of organizations.

Ultimately, they're going to follow what the law sells them to. Chris: Plus, guess a cheat that I think we've mentioned so far, we were both once lawyers. So we're really comfortable starting with law. Josh: It's a good start point for us.

Chris: So there's been a lot of change, I think. Well, the one that interested me the most was what Singapore did the launch in January. I think it was of their agentic governance framework. What did think about that?

Were you following that? ⁓ Josh: Um, I was a little bit, there's, there's a lot out there to be honest. So I kind of did do a bit of a deep dive into it. Uh, kind of after the fact, guess, um, now Singapore, um, I think one of the key things for them is around what does all this mean for their people?

Um, and, know, looking at how the legislation is quite an interesting one. instead of seeing AI as LLMs, it does at with that agentic application lens. So looking at kind of agents that go out and things for people. ⁓ Chris: So guess with the new OWASP definitions around agentic security, there's all these new domains of AI, which are important, which we wrote that blog post around.

For example, you might have rogue agents that don't do what you expect. You might have agents that are communicating with other agents who could potentially change their instructions, poison them, misaligned agents. And you've got cascading failures. When you're building on a upon a molehill of all these agents, what happens when the failures kick in?

So I guess it's good that Singapore was thinking about this. What you seeing in the rest of the world? Josh: It's an interesting one because you might not see the same kind of approach being taken by other countries, which are probably participating in different ways to the AI landscape, let's call it. So when I think of the UK, one of the key things I'm seeing is they're of de-scoping effectively.

That was the once called AI Safety Institute. Now it's the AI Security Institute. From my standpoint, great that we've got an AI security institute. That's really cool.

what they did was they took the safety institute and removed some of the things about biases ⁓ kind of the aspects that you'd call more safety categories. ⁓ Chris: And that seems to be a focus in most places. I know Australia has put in a ton of investment in cybersecurity. Microsoft launched their cybersecurity skilling piece last year.

So you've got the UK focusing on the safety institute. The EU has just pushed back enforcement of the EU AI Act for high risk harms at least, and changed the SME exemption to companies with over 750 employees, which isn't what they'd usually treat as an SME. So you've got UK de-scoping, the EU pushing back, you've got Australia focusing on security. And then in the US, whilst NIST might be looking at their RFI all up on security, government seems to be focusing on deregulation and how can we innovate further?

So it seems to me like everyone's trying to run faster, might be seeing as a barrier to I mean, I don't agree. I think that's the way I'm seeing countries react. Josh: That's an interesting thought, actually. guess if we take it back to what we looking at before, one of the things was how nations are looking at AI and what they see their role in it.

So, you know, for better or for worse, I think nations like the United States and the UK are looking at, you know, the perception of an AI race, know, a race to AGI maybe as a milestone or kind of some form of super intelligence, whatever your definition may be of that. Maybe even looking at how AI research be AI-ified so that it doesn't need people to do it anymore, is kind another critical milestone point. So I guess if you're looking at it from that lens, you start to see certain things will be de-scoped in the kind of safety aspect potentially.

or a certain level of risk acceptance, a higher risk appetite with the priority on innovation, I guess is where it comes down. Chris: I guess AI is always a bit of a moving feast. So two years ago, AI probably meant generative AI. I meant large language models.

10 years ago, it was machine learning. 30 years ago, expert systems. But I think that's why I liked OWASP and touched on it earlier. It felt like OWASP was the first agentic security piece that really focused on agents and not the large language models underneath.

Now. So you think we're starting to see commodification on this space because it seems like we're no longer seeing the model as a primary building block, but the architecture around the model. Josh: That's an interesting one. So yeah, I think in some ways could see commodification to this, least compared to where it was two years ago, let's say.

Because of course everyone's talking about agents, happened for at least a year now in the mainstream. I when I look at things like models, I do use things like from an evaluation look at how performance is or security is across different model use. But really I'm just kind of picking one from the catalog or I'm kind of looking at using the model router and just taking it all out the equation. don't want to be thinking about it so much.

And so if I was to kind of look at that, I'd be saying, yeah, I guess I am seeing it more of as a commodity. don't care ⁓ much as I used to about, you know, what, what percentile it's in for a math problem, for example, unless I'm doing something really math intensive. you can tell I'm in the US actually, because I said math instead maths. Chris: Yeah.

guess open claw is a good example of that. So open claw, you know, my feeling is an open clause. yeah. I think it's solving a need.

people have built their own things with tools from NAN to custom workflows. So I respect the idea, even if I think the implementation could have been more secure in it was never claimed to be secure. But what think that's a really good example of commodification. So open claw works with any model under the hood to achieve.

to achieve tasks for you. And we're seeing the enterprise take the same approach. mean, we had Claude Cowork and when that was announced, a ton of company share prices dropped. ⁓ is about to launch Copilot Cowork in their wave three of M365.

It's the anthropic tech wrapped up. So guess people might see Microsoft and OpenAI as synonymous, but really Microsoft is the platform for all AI. So again, commodification. Josh: I'd argue, yeah, you've made a good point there.

hadn't really considered it from the cowork lens, but yes, it is very much an anthropic wraparound, isn't it, for this. And you actually kind of brought me onto something else. As you were saying that, was thinking of, there's you said in the car actually yesterday around OpenClaw. I'm not a user of it.

But you were kind of saying about ⁓ how it was that somebody hadn't really put together. and open sourced But ⁓ probably doing some of this to your own problems and looking it a bespoke, I was going to composable, but a disposable application. Chris: I think I'm commodification at every level of the stack. So you will heard me talk a few times about how I think SaaS might be eventually dead.

It's going to have a long death. as Satya the same, have people talking the SaaS -pocalypse and the data layer is the way forward for me. think data is what's important. Today, when you use a CRM system, the business rules live in the CRM.

They need to migrate to the data layer. So the agents can interact with systems as a first-class citizen. my mind, commodification affects the model, affects the apps that we use. And it means that what I care about is that if you log a sale, that your agent or you log it in the same way.

I don't care if you're using the app interface. And I didn't open source it because it was very bespoke to me. And I think our agents are very private, but then I guess that's another of commodification right skills. Yeah.

For example, the skills protocols been donated, LLM.txt is being adopted. There's a lot of commodification in the protocol layer. So again, last year there was ACP, A2A, A2P, like all these like 300, TLAs.

ACP is with A2A. We've got one standard now for agents speaking to agents. MCP is the de facto standard for agents speaking to tools. Do you think open source is driving this commodification?

Why do you think that's happening? Josh: It's an interesting question. Is it itself driving the commodification? Perhaps so in the sense, again, if I link it back to OpenClaw, what you saw there was how someone did something that people thought was great and they gave it GitHub stars, which is apparently a form of currency these days.

But it kind of drove that kind of mass adoption with people who, you know, talking to Kevin McDonnell recently talked about a skills gap being addressed with skills in the AI context. think having that adoption by, I'm not going say citizen developers, I don't think that's quite the correct term, but by perhaps newer developers or people coming become or wanting perfect that, own that skill a bit more. probably does drive commodification. And I think the open source community, you know, through the standards as well, is definitely doing that because one thing that you mentioned there was around A2A.

And I was looking at how A2A is the standard recently, because, you know, we did a blog on AI gateways recently, And to look at the AI gateway, to bring in an agent into that gateway, you use the A2A protocol. And if you want to bring in an API or MCP, you can kind of do it from the lens of open API. So I think these standards probably are kind of standardizing it if you want to call it something other than commodification. But yeah, a bit of a question for you.

What does the commodification mean to you? ⁓ Chris: So for me, commodification a good thing in the sense that it drives down cost, token cost. That also mean unexpected things. For example, if you're using Claude and I'm a big Claude user, Opus has just been given access to a 1 million token context window.

That doesn't mean you get many more tokens. You get the same amount, but now you can use a lot more and you can spend more. And I do worry low stakes conspiracy theory about, model providers incentivizing their models to use more tokens to drive up adoption. But commodification for me fundamentally means that we've got a lot more people having access to this technology.

I don't think the open source community has been welcoming them with open arms. They see well intentioned people doing pull requests with hundreds of thousands of lines of code, but they're not telling people, no, this is what good looks like. This is where security comes in. Some folks don't even know how Git works.

And yes, that's a security concern. Um, because people haven't met databases dropped by agents in the wild and things like that. We talked about that before, but it's also on the open source community to tell people, okay, you're coming into this forum. Here are the rules and standards that we expect.

And I people are going, Oh, who are all these stupid people coming into open source? And it's got like, actually you get probably gate kept because you had access to the skills. Maybe you need to tell people what the expectations are and what it looks like. And just saying, don't like AI that time's kind of gone, I'm afraid.

So commodification to me means that the bar has been lowered to getting in. We now need to tell people what being good sits and looks like. Open Claw is a good example. It's gone crazy in China.

There's all kinds of adoptions like Rustclaw, people roaring their own, but these could be more secure. And then Claude has now launched dispatch in their mobile app. So you can tie Claude co-work to your, to your mobile. You can tie Claude code to your mobile.

So you can do stuff on your own machine. So it's the commodification. But also I think companies are trying to respond to commodification with lock-in. I mean, you're familiar with the Comet browser, right?

Or agents in, in Edge, like Claude, for example. Have you tried any of these browsers, these agentic browsers? Josh: Honestly, no, haven't. Part of that is a security concern.

So I always aware of the risk of indirect prompt in particular with this, because ultimately you're letting an AI have at the internet. And you you Tay right? Yeah. That was probably good example of what kind of happens with indirect prompt.

Chris: Okay. Bring it on the right place to talk about it, say. No. Josh: been retired and it was retired pretty quickly and for good reason.

Chris: Yeah. And I think the reason I mentioned Comet is linking back to commodification. Yeah. Companies don't want to be commodified.

They don't want to become the base of a pyramid that you have to secure. Comet with this perplexity browser got Comet jacked in 150 seconds. So it's just over two minutes from a Reddit comment with an indirect prompt injection attack to Comet giving away credentials. Gartner's CCO effectively said, ban all browsers in your enterprise, like authentic browsers.

think that's the way forward. But again, for me, comes back to anytime you introduce these new technologies, we have to teach people how to use them responsibly. You can't hide that. That's a belief that I have because otherwise people will use dark AI.

They'll use Claude, ChatGPT, Mistral on their own phone. We should be telling our employees how these things work. I guess that takes me from commodification where these things are going. We've launched these technologies out into the wild.

I'm seeing now almost we're trying to secure them after the fact, like kind of Pandora's box style. that match what you're saying? Josh: Absolutely. We're having conversations about agentic security before there was a larger, more adoption of agentic applications.

If we look at when we're talking about security and the conversation is very much around conversational bots, effectively, prompt response type activities rather than something that is performing some sort of function using tools to do it. I'm finding that actually is what keeps happening. and you know, it sounds like I'm it, but I think as a security professional working in the AI era, if we're going to call it that. do have to...

Fair enough. Given what I do, I have a level of acceptance that this is the way it's going to be. if we take the term frontier, widespread use beyond Microsoft now, if you're working at the frontier, securing the frontier, Chris: No Josh: the organizations trying to doing this are actually kind of trying to move fast. And there is an element of breaking things.

Um, and it kind of puts security on the face of it at the back foot, you know, they're, they're reacting. Chris: You just reminded me of the South Park episode with Sora. Josh: Well, yeah, in that episode, they did have a little watermark that says Sora on it. So you can tell it's AI generated.

Yeah, exactly. Chris: Yeah. I mean, there's so many places we could take this. really want to talk about voice, about ambient modalities.

You got me thinking about kind of cowork again. of the things that worries me about security is a lot of people's perception is, there'll be human watching what it's doing. Cause in chat GPT, I write something and I get a response. but if you've sent a message to your copilot cowork and you're watching it, well, you're not delegating work.

Hey, you're supervising it. You have to be able to step away for anything to happen. Do you trust your AI to just do something sensible if you're not watching it? What if it's got your credit card details and your work email?

Like, how do you feel about that? This is why I feel that we're still securing as we go. Josh: And you're kind of raising the kind of key topic that sits at both security and governance really, which is observability. Can we see, it's not necessarily the human in the loop decision-making of it, which is of course also there and kind of important, but it's been able to actually see it.

And I was thinking about this as you're saying it, like, you know, even when prompt and response scenarios, if you scale that up to everyone using AI, That's not real observability if you can look at all these conversations because what are you meant to do with that much data? Like what person is able to process all that? Chris: And if you've got agents speaking to agents and that doesn't scale, the observability has to be between the agents to do the analysis of what they're all doing.

And I think that's where I'm seeing more folks build in new tools again, open source, Meta has just got their llama firewall, which I think is in the high nineties for identifying prompt, prompt injection techniques, identifying kind of potential breaking of the guard rails and misalignment. You need to do that on everything. You need to observe what your agents are doing if they speak to each other and that is in OWASP that is new, I don't think people are thinking about it yet.

Josh: No, and it's interesting thought actually, because yeah, as you're talking about things like voice, and know, what I'm starting to think of really is maybe the problem isn't just for security to try and be patching all this up, but if we look a bit bigger and go to everyone's responsibility, and what developers can do maybe a bit more is how do we prepare for a kind of agentic web, if you like. Chris: Yes. I like that because, and before you go into the genetic web, one thing that makes me think of is everyone's talking about voices, the new, new modality is.

actually about the modality after that. I've been talking about ambient AI for a long time. Yeah. I actually don't want AI that I have to tell to do things.

If I say the legal contract, want an AI to go, Chris has got a contract here. He's not reviewed it. He's not signed it. ⁓ I will in and redline it and mark it up.

There are a lot of things that if I was working in an office and I was someone's admin assistant, I might do these tasks because they're sensible. When AI can do that, that's when I think, you know, we can sit back, relax, move to a three day work week. Josh: It's an interesting thought again, because actually what you're suggesting there is the proactivity of AI, at least in that scenario. Chris: scenario in non-destructive scenarios.

It's kind of like how when you're an app in the old days, had create, read, update, But actually when we launched after the public, was never a true delete. It was a soft delete so we can restore it. Yeah, I don't want AI just doing things, but I'm happy with it adding comments that I can ignore if I want to. Josh: Yeah, I think the crud aspect of it is probably spot on at least from a security standpoint, because it comes down to fundamental data security really, like who has the permissions and what and what identities can do that.

Chris: Yeah. Identity is a nice one because I guess there's authorization and there's authentication. you have a security pass, that's great. If that pass lets you into every door in the building, maybe not so great.

Josh: Yeah. I know exactly what you're talking about here, which is MCP. Chris: it all ties back to your mention of the agentic web. So we had LLMs.

txt. It's been out for a couple of years now. And that was about how do you post a text file to identify and curate the content that you think might be cool for LLMs to know about. Then last year we had the launch of NL web, which I was really excited for.

Every website gets an MCP. That MCP server effectively means that every web can become a conversational input interface. So if I don't know, if I'm on GeoCities back in the day, I can speak to GeoCities and tell it what I want and have it build a website. MCP isn't great at the permissioning today.

Josh: Yeah, no, completely true. So luckily on Foundry, at least you can do authentication and you've got a few different authentication methods for the tools. But what you're drawing attention to is that nowhere really you able to currently govern the finer points of that MCP server. So, you know, use tool, never use this one, or you need elevated permissions in order to use this part of the tool.

And maybe some people ⁓ Some users or use cases will only benefit from the context of the model context protocol rather than the API. Chris: This is why the MCP isn't dead. I've not liked that recently because MCP isn't just access to data. It's also access to the context, the reusable pieces.

Yes, skills are good for some things. Skills can be malicious. lot of these agent skills in the marketplace is worth that one in five at one point had malicious code in them. I'd rather use an MCP that's being built for WhatsApp that I can then review and trust and download some random skills, but that's me.

So we've talked about a lot of problems. Before we wrap up and kind of summarize, what's already happened in just three months of 2026. What do you think the takeaways are? What would you be doing if you wanted to secure your systems today?

Josh: mean, for me, and you're probably going to laugh at this, but a key thing for me is looking at how you build an AI gateway. So in terms of Foundry ⁓ and Azure API management, for not familiar, can build an AI And this is really just a fancy term for an Azure APIM deployment that has AI features. Yeah, ⁓ well, because you can kind of all these things together. Chris: What should people care about?

Josh: So what do I mean by that? The models from a variety of different providers can be put together. Great. Exactly.

Yeah. If you want to put a bit of Gemini in there, your Foundry catalog, all in one place. Tools, MCP servers. So you can kind of bundle MCP servers in a variety of different ways.

You know, you can bundle on API that you have in APIM. You can take third party ones, deploy them as an Azure function maybe. I've done that recently. Chris: I see new commodification.

What else? ⁓ Josh: to be satisfied with my own security. Wow. What else can you do?

You've the whole governance piece and observability. So whether throttling with token limits, setting quotas, so like annual, weekly, whatever your poison. Chris: What else? and what users and departments are doing, I guess.

Yeah. Josh: Yes, the observability, so plugging it in to actually see the token stream and process. ⁓ Chris: certain usage. And I guess my favorite red is uh, semantic caching.

Oh yeah. I love this. The fact that if you send kind of a message to a model and a semantically similar message just returned, well, next time someone asks that same question, you send the same response back. But again, you need to secure it by checking for PII and cleaning it up.

Anything else that you would do to secure before we wrap up? Josh: Well, think it's just a tip really. Don't confuse, like we talked about, don't observability with visibility. Just because you can see all the things doesn't mean you can actually physically achieve that.

Chris: So you've just invented the opposite of security through obscurity. There is no security through full visibility. Josh: true. It's too much data.

Chris: So 2026, we're still March right now. We're here in Seattle, a that we're hearing, the fight club can't share. The law is changing. single region of the world is adopting vastly different laws.

need to track them. Models being modified. So we're looking at what the next layer of value is from the orchestration to the agents. The way we do security is different.

It's not about the LMS. It's about the way security interacts. In response to commodification, the hyperscaler and LLM providers are trying to move up the stack with things like cloud dispatch, cowork, comet browser, identity browsers. The web is being bolted on.

We're continuously bolting things on and sending them to be more agent friendly. And there's a lot of tools now to help us drive down the cost. And anything else that we should be thinking about? Josh: Wow.

think the main thing is because protocols are merging and de-merging all the time and one's being more adopted than others. I don't believe that MCP is dead. Like a lot of people are trying to tell me, especially when they say it's instead of a CLI, which just uses an MCP behind the scenes. I think about as an organization, got to make some strategic choices with platforms and tools.

But the frameworks. ⁓ You kind just need to take a step back and look at your drivers, your objectives, what you're trying to achieve with AI, where are you on, the diffusion of innovations model maybe, look then what decisions you should make off the back of that, because the state of the art is going to change a lot. ⁓ Chris: Yeah. And if you just have a chat box in your site, I'm probably not going to use it.

And like Spetaro said there's a new king of a hill every 60 minutes. So that's all going to change. Well, always good to talk. I'm sure we'll be in another studio somewhere.

Maybe not as nice as this one. So I guess I'll say thank you to the Microsoft, the dev rel and create this team. Josh: Exactly. Chris: See you.