Why Do You Trust Your AI Agent?

Speaker A: Agentic AI is really, really powerful. And someone recently found this out the hard way and I have to look this up. Her name is Summer Yeh. Uh, she is the director of AI alignment at Meta Superintelligence Labs. So that's a department that deals with AI. Right. So what she did, she installed OpenClaw, let it run without any boundaries on her computer with her permissions, and it deleted all her emails. Welcome to Threat Talks. My name is Liujan Kaoning and here from headquarters. Head onto it. We bring you the next episode. And the subject of today is Zero Trust for AI agents. Let's get onto it. Welcome to Threat Talks. Um, let's delve deep into the dynamic world of cybersecurity. Let me start by introducing our guest of today. He's a regular, his name is Rob Maas. He's the field CTO of ontuit and he comes up with solutions. Welcome.

Speaker B: Thank you.

Speaker A: Because we do need a solution for, uh, this problem, I guess. Um, you recently wrote a blog post about, uh, zero trust in the agentic age, what it means, and we're going to talk about this. Uh, but first let me have a, Let me ask a question. Within our company, for example, you are also someone who creates MCP service agents and that. And our development department is making sure that the security operation center runs as much on agents as possible to make it super efficient. And we see people vibe coding all the time. So what is the risk here, you think? What, what, what, what?

Speaker B: Uh, the biggest risk here is that, uh, we give all these agents, uh, the same privileges that we have as a human. I call this just in case privileges. Uh, those are the privileges that you have to do your job. But we as humans think about when we need them and if those actions that we execute are smart to do, and if we will not get fired by it, for example, agents will not do that. So agents will just take all these privileges and do whatever their intention is to do. So it can be delete all your files, read all your files, upload all the data, et cetera. I think that introduces, uh, a really big, big risk. Uh, but now I'm really curious. This is one of the risks, but what do you think is the biggest risk here?

Speaker A: Yeah, um, though there is many, uh, luckily we have clever people. I would say that, uh, think twice. And we are in a security company. Well, although my example in the introduction, when you're head of AI doesn't mean you get, uh, standbyed, of course. Um, yeah, so there's many people creating things and what I fear the most is that a portion that a single super uh, um, good at vibe coding guy at the SoC, for example, creates something that's really awesome ah and we do not recognize as it being vital and awesome and it becomes something vital to our primary business processes. And then um, this guy leaves or is sick or whatever and there's something crucially uh, going on there and we don't know uh, how to fix it but our company has become dependent on it. So things that, things that we are doing currently is mapping what we have. How important is, are they simple tools to make life easy. Like uh, ah, someone created um, uh, an agent that you can ask for uh, problems in certain firewalls for example and will give you all the bug numbers that we know of those kind of things. Those are super useful to the SoC, of course, but if it doesn't work for a day it doesn't really matter that much. However if it is an agent that responds to cases like say someone made an agent that understands how to respond to a certain uh, request for information on a vulnerability and all that knowledge is getting into skills and prompts and all that of that agent and it's not a governed by our uh, SOC 2 compliance for development which is really strict. Um, or uh, nobody knows how it really works or how to tune it and it breaks down in the middle of the night. Yeah, we might have a problem so we need to be really careful. We need to know what's out there and make sure that it doesn't become like this new wave of shadow uh it. And it's easier than ever, I mean even today. But I mean if we fast forward for one, one year or so everybody is a, is a developer. So uh, let's have. And most of it for the good part.

Speaker B: The good part here is that uh, it's also mentioned in this blog post this uh, this one. So uh, I think we'll discuss it as well.

Speaker A: Yeah, the blog post obviously will be in the, in the show notes, but in the blog post you um, took the Caesar pillars, right. Um, by the way they align more or less with the Forest Surtrust extended framework also. So shall we peel it off there and see what's uh, different here? Do we. Yeah, I think that's work in the first place.

Speaker C: I mean.

Speaker B: Yeah, I think uh, while still a lot of people need to adapt to it I think still. Uh, but it has proven its um, uh value. Uh, but it is just uh, you need to put in work to make zero trust work. Zero trust Is just a strategy and the implementation is something you need to do yourself as business. You cannot just buy a sticker and put it on the outside of your building and you're done. You really need to implement uh, uh, this. But once you have done so it really works.

Speaker A: But for AI also, I mean, is it.

Speaker B: Yeah, yeah.

Speaker A: So zero trust something new.

Speaker B: Zero trust? No, no, Zero trust is really a uh, strategy and the implementation will vary as we will discuss. Uh, but the whole idea, the same principles, the same concepts will apply.

Speaker A: So it's still a universal strategy to cybersecurity. And that's in a way comforting. Okay, well let's do the first one. Identity.

Speaker B: Yeah, um, how does that change? I already uh, briefly mentioned it, uh, that we have just in case privileges as uh, people when we work at the company. And that is because we have a kind of a conscious, we think about things that we are going to execute. At least I hope we do. Uh, and uh, we can audit everything and we can fire it if we make really stupid mistakes. Um, and that uh, all that an AI agent doesn't have that it will just be given an intention. It will try to use all the privileges it has to reach its goal. It hasn't have any consciousness, uh, it doesn't get care, it doesn't care if it gets fired. So it will just execute it. Uh, I refer to that as non human identities. So they are there, they need privileges of course, uh, but make it very small and to the point on what they really need.

Speaker A: It's a big, like uh, a worm, like a Trojan, uh virus, uses uh, all your privileges everywhere uh unintentionally. And it was not never your intention to use your privilege like that. And now the AI has the same kind of capability, but also doesn't.

Speaker B: Yeah, that's just comparable. The difference with AI is of course that uh, you give it an intent, it needs to do something and it will just try as long and as fast as it can to reach that goal. Where um, at least traditional worms have static code which you can detect more easily. Yeah.

Speaker A: Mhm. Yeah. Um, you also mentioned human can be held accountable. It actually m makes me reminds me of this episode, uh, of uh, uh, Black Mirror where uh, they had an app. Well the end of the episode is that it turns out to be an app where people try to match two people together whether they would have a romantic relationship. And how the app worked is to spawn a thousand instances of both people and see whether it would go on a date or so and how the date would Go. And uh, so, uh, and in that way the life expectancy of an agent's mind is super short. Right.

Speaker B: So it, and the agent doesn't even

Speaker A: have time to apologize if it screws up.

Speaker B: Yeah. Ah. And depending on the agents uh, m. Most agents nowadays can also spin up new instances of agents to do things in parallel. So it's very relatable.

Speaker A: Uh, yeah, and they um, sometimes hallucinate as we all know. And that doesn't go away so far. Okay, um, so, but what do I have to think of that in practice then? Because now most organizations have a LDAP server where humans are in. Are you advocating that AI agents should have their own branch, uh, organizational unit in ldap?

Speaker B: Well, more or less. I uh, refer to a vault. It's more common already in cloud environments and uh, also in containerized environments where you get just in time, uh, you have identities and you get just in time privileges. So you get an identity and that has certain uh, privileges and you can quickly rotate them, pull them back. And when you spin up a new agent, it should get a new identity with new just in time privileges. So you can at least have more control. But also, especially with AI where you send a lot of data in most cases to the cloud, you don't want any identity or uh, the authentication code or token or password to end up uh, with the cloud provider. Because if it is uh, not rotating then it can be used forever with all the privileges that are attached to it.

Speaker A: So that means that uh, systems that uh, the agent is connecting to need

Speaker B: to quickly also have a, to be dynamic. And that's something called a vault.

Speaker A: Yeah. Okay, so this is doable.

Speaker B: It is doable. But still I think for a lot of companies, uh, it's a new way of thinking. Uh, and, and that makes it a bit harder to implement.

Speaker A: I think we can make a whole episode about just this. Devices.

Speaker B: Yeah.

Speaker A: What's changing there?

Speaker B: Yeah, so as mentioned also before, um, an agent will try to use everything that's around it. Uh, so if it has access to files, it will use these files, read them, delete them, upload them, whatever is needed to uh, accomplish this task. Um, that means that in this case where we used to have devices with edr, for example, we now should really look at the execution environment where the agent is running and tie it down as strictly as possible. Because if the agent doesn't need access to the files on the host, then don't give it to them. Um, so really strict the environment where they can access things uh, around it, um, and tie that down. That could be a vm, that could be a container, it could be serverless, but at least tie it down.

Speaker A: It's a bit like the identity and the device fuses together.

Speaker B: Yeah, it's true, yeah. Uh, the agent is kind of uh, it's multiple pillars in one. It is kind of the application we come to that it's kind of course of the device it tries to use, the environment it has access to. And it also is an identity because it needs privileges to execute tasks. So it's all those things combined.

Speaker A: Okay. Then we get to the network layer and network security is like a thing that's security more or less started with it or so. So it's boring too many but still very very important. How does that change if we're talking about the ip?

Speaker B: So the same principle applies here. First uh of all make sure that the agent internally cannot access things it should not access. So if you have an agent that should work with um, uh, for example CRM, uh data, so the customer data then make sure it cannot access any financial system for example very I would say to the core of zero trust, limit those access. But it gets a bit uh, more um, important now to also limit the access for example to API servers, to MCP tooling, uh, new skills. With OpenCloud for example, the agent can uh, pull in new skills uh, on the marketplace. Uh, and you should really prevent that and tie it as um, deny it as much as possible and only allow what's really, really needed for that agent.

Speaker A: Okay, so I suppose I have a

Speaker C: container or a VM or whatever it

Speaker A: is somewhere that is my agent that can do several tasks. I um, mean one, at some point it needs to access my CRM data and maybe for SERP agent, uh, the product catalog or whatever, uh, uh, but never define this data for sure. It's really hard to do this in a firewall, at least in a traditional way.

Speaker B: I mean yeah, you really need an identity based, identity based firewalls. Um, well modern firewalls have already these capabilities. Um, you see this also a lot with the.

Speaker A: So a network session then needs to have identity. Ah, that maps to a role and that role is a short lived role that does a particular task. So it could be the sub agent to collect data from the CRM system.

Speaker B: That could be a good implementation of this.

Speaker A: And that's on the network level. You can already do it. But is it still on the network level though? I mean shouldn't we do it in like a mesh or.

Speaker B: Yeah, you can debate about it, uh, if I talk about network segmentation and service mesh is also a form of your segmentation, whether it's physical hardware or software defined networking, which I count a service mesh to, uh, of course the implementation differs, uh, but the ideas behind it are the same.

Speaker A: Yeah. So what's the network layer then? Is that device that controls whether a packet gets through. It could be a proxy, it could be a mesh, could be a firewall, but likely in this age, not with

Speaker B: a segmentation gateway in this case.

Speaker A: Yeah, yeah, yeah. John was quite clever in inventing Zero Trust. We rediscovered it every time. Okay, clear. And then the next layer is applications and uh, workloads.

Speaker B: It's not the last one, but it's one.

Speaker A: The next one. Yeah.

Speaker B: Um, so the application workload, we all briefly mention it. Normally we tie down an application, uh, and if we want to protect an application, we do vulnerability scanning. We can put a firewall or a web application filter in front of it. API gateway, we have all these toolings. Uh, but now the agent is, is both the user and the application in itself. Um, and that means that we really need to have um, a strict policy on what the agent can do, especially when it comes to tools. What we have in an LLM, we have tools. So the things that an agent is allowed to execute, which can quickly sprawl, uh, if we allow it to include all kinds of MCP servers. Um, the solution here is to really make a vetted list and wherever possible control that on what MCP servers are allowed. So what tools is this, uh, agent allowed to execute and tie that really down to what's really needed.

Speaker A: This is not the practice today, I can tell you.

Speaker B: No, it's really hard. Uh, getting the list is already hard. And uh, implementing controls. There are now some of the, uh, solutions that implement this, but that only works if the company enforces those policies on that specific, uh, solution. Uh, there is no generic. Well, vendors are looking into it, but there's no AI firewall that solves this problem at the moment.

Speaker A: I mean, if I see our practice, for example, in our development department, we run our uh, source code in dev containers. They run uh, on a VM that we actually control somewhere in the data center, not on local laptop. Which is a relief because I mean a developer can install any MCP server or agent or whatever on their laptop and they have the same access as them. Like you said, just in case or just in, uh, uh, what did you say? I have to do that again? I did read the blog part.

Speaker B: Just in case. If it's a mimicked uh, employee.

Speaker C: Yeah. So, um, I'll do it again. Um, so this is in our day to day life already, uh, really hard. And I think we have one thing, for example, how we control this more or less is that we do our development work in a dev container that has a kind of different identity than the developer. Because if we would allow the developer to run all kinds of agents or MCP servers on their laptop, then they have the same, like you said, the just in case or just in time privileges, then uh, it's just in case.

Speaker B: Yeah, it is just in case.

Speaker C: Yeah. And um, uh, for the vms it's kind of different. So we control it more or less.

Speaker B: You already took measures, uh, uh, on the device. How are we in the workload level? Uh, that makes the impact less if an uh, employee would install his own MTP server. Of course the impact for the local system is the same, but not for the critical workload here.

Speaker C: Yeah, but I mean really wanting to control this, there's also a risk in that. And that's just a bit of a sidestep maybe from our nice uh, layout uh, in blockmouse. But um, if I really control it, like make it strict and limit it and make sure that nothing can be accessed, it also kills innovation.

Speaker B: Yeah, that's the balance I think you need to find as a company.

Speaker C: Uh, how the balance is on a very um, operational level. I mean it's really hard for a CISO to set a guideline for this, I guess because it's in the details. How I mean when we talked about Zero Trust before, in the beginning it was like networking. It's nice because you put a firewall somewhere, the segmentation gateway somewhere.

Speaker A: It governs all traffic because you know,

Speaker C: the traffic has to go through this pipe. So I have 100% coverage of everything.

Speaker A: And with endpoint it's already two, the different endpoint solutions, et cetera. And now skipping a few steps with cloud and containerization, et cetera. Now we're here at the agentic age and it's really in the details how a developer um, configures their MCP servers, for example on their laptop. I mean that's a nightmare if you ask me.

Speaker B: Yeah, yeah. But I think this will be uh, quite often a security get a mouse game. Uh, at the moment, uh, there will come solutions, I'm sure of that. Uh, but at this moment it's the only thing you can do is write down guidelines, control where you can control, uh, and then um, hopefully uh, adhere that people Will adhere to these.

Speaker A: Uh, yeah, and AI, we had an episode on this, like to prevent prompt injection, for example, and AI to govern this, to look over your shoulder all the time to see if you're not doing anything stupid. That's also. That's not been the solution so far.

Speaker B: Not yet, no. Maybe it will. But the problem with AI in general is, uh, it is not deterministic. So even these controls can have an outcome. Uh, that's a false positive.

Speaker A: Yeah, you can basically, uh, prompt inject everything as soon as you.

Speaker B: There is no guarantee.

Speaker A: Last, uh, one is data.

Speaker B: Yeah. So the data, it was already a very difficult one, uh, because you need to read the data and then have your policies around it and it becomes more complex because everything in AI is data driven. You have your prompts, you have your retrieval augmented, uh, generation systems. Um, so there will be a lot of data in the prompts, but the data can also be within your documents, in parts of the documents and will all be sent to the AI. And then the answers also need to be checked because, uh, we did an episode already on it. It can be false, uh, or misleading. Um, so you need new data controls. Um, there are some theoretical approaches to this. For, uh, example, for prompt injection, uh, we have Camel as a proposed solution. Uh, but this one is really hard. And uh, people try to find a solution, uh, to counter this. But yeah, data is. I think it's the hardest one to solve.

Speaker A: I'm actually a little bit more optimistic about this.

Speaker B: Okay, good to hear.

Speaker A: Yeah. And the reason is because all these, uh, calls that agents do to LLMs and to other agents, etcetera, as long as they are not mutually.

Speaker B: Yeah, that's one decryptable.

Speaker A: But you can actually see what they're doing. I mean that's an advantage over a human brain because I cannot see what you're thinking. But we can actually see what an AI thinks. Whether it's thinking or not is a different kind of podcast. Um, so, uh, uh, if we log all that, we can actually at least see what they're doing.

Speaker B: Yeah, we can. Have to thrill. I agree. Yeah, Trill is not a problem. But in runtime and in execution.

Speaker A: And then if you have Claude for coding and then chatgpt to look at, uh, what it's doing, I mean, then maybe they can, uh.

Speaker B: Yeah, maybe that will be the solution.

Speaker A: Yeah, we'll see. These are the five pillars. Ah, clear. It's a kind of a shift in how zero trust applies, uh, to the world. Um, but its basic principles are still there is There anything missing from this? Is there any areas uncovered?

Speaker B: If we're with CISA and also with uh, Zero Trust extended framework from Forrester, you also have these, um, I would say the foundational layers. Um, um, they are still in place. Uh, but the things that are addressed at minimal is for example behavior analytics, which becomes very important with AI agents because they have a fast master. Fast, uh, uh, are way faster. They execute things constantly. Uh, and if you have an AI agent normally only uh, accessing the CRM system and it now connects to the financial system, you should be able to detect it. Uh, or maybe it learned a new skill because it was able to download a new skill or a new MCP server and does something that it hasn't done before. You should be able to detect that. That's one of the things. Um, intention is a new thing. But with AI agents work really with intention. You give them a prompt. I want to achieve this. And they are going to try to figure out uh, if they can reach that. Uh, and we need to find a way to see if an agent is

Speaker A: still

Speaker B: following um, that direction, that intention or that it's changed because we uploaded a document with a prompt injection for example. Or we give uh, yeah, keep a

Speaker A: sub agent on track. That's we could have some uh, uh, intention on track detection or so. Yeah. Hmm. Okay. Yeah, that's a new area that we. That could be. Does it exist yet?

Speaker B: No, it's partly in behavioral, uh, it comes close to behavioral analytics but it's not very specific for AI AI agents yet. Um, another thing, uh, that's a bit missing. Uh, we are really looking into autonomous agents. Uh, but I think for a lot of things they should be able to have a human in the loop, especially when it comes to critical decisions, uh, that I will make. Uh, and we should always have uh, the kill switch. So the example you gave in the introduction was the kill switch was turn off the system. Uh, we should have something in place that if an agent really goes rogue that you can stop it.

Speaker A: Yeah, but it's so fast.

Speaker B: Yeah. So you should have the human in the loop if it gets too critical systems or critical, uh, um, workloads that you will be able to either approved that it is allowed. And I'm also uh, doing this uh, quite often when I'm coding. Oh, always allow is fine. Uh, but we should think about, hey, this is really a critical system. There should be a human saying okay, what you're now going to uh, do is fine.

Speaker A: Yes, our jobs become much more. Instead of doing the work is validating that the AI's outcome is indeed in line with the intention and the best interests of the people of the company and all those. And that's uh, but that's an underdeveloped skill, at least in our. For everyone we're putting a lot of effort in this actually.

Speaker B: But I think for everyone this ah, is new because AI in general is quite new. Uh, so everyone needs to learn when they are going to use AI. Everyone needs to learn this capability.

Speaker A: Clear. Our time is almost up. But um, what should we do? What should be the next step or the next few steps that any organization should take to make uh, sure it's

Speaker B: not very different than we discussed before? I think everyone should embrace AI because it is coming. There's no denial about that.

Speaker A: Either embrace it or go bankrupt. Huh?

Speaker B: More or less. Uh, but start with making sure that you have a good overview of everything uh, that's being used within your company. Especially when it comes to MCP servers and the access they have. I think that's, that's the starting point because if you don't know what people are running and doing with AI then it'll be really hard to implement the other controls.

Speaker A: Does every organization need to have one authority on AI, specifically like an AI officer?

Speaker B: Maybe we're heading in that direction. I think uh, for now it's an extra role or function for the Ah, CISOs to at least get an insight in. Hey, what's my company doing with AI and how does it. What risk are involved with it?

Speaker A: Well, lots of work ahead but also very exciting. Uh, I might add Rob, thank you very much for these insights and uh, like I said, uh, before the link to the blog post is in the show notes if you are interested to read more about it to our viewers. Thank you very much for tuning in today. Um, if you like this please reward us with a like. We'd appreciate that. And the subscribe button is right next to it. So next episode will also be in your inbox. Once again, bye bye. Hope to see you next time. Thank you for listening to Threat Talks, a podcast by Onto It Cybersecurity and mzics. Did you like what you heard? Do you want to learn more? Follow Threat Talks to stay up to date on the topic of cybersecurity.