Keycard

Ian Livingstone (@ianlivingstone) CEO of @KeycardAI says the biggest thing standing between today’s AI agents & true autonomy actually isn't intelligence..

“We have apparently AGI, but the real thing that stops us from having autonomous agents that actually work, like a self-driving car, is identity & access.”

“Our systems weren't built for agents that are non-deterministic actors.”

Agents Are Like Teenagers: Governing at Machine Speed with Mastercard's Alissa Abdullah, PhD ("Dr. Jay") and Arjun Ramakrishnan

"I think we're moving from guardrails to this new buzzword called a kill switch. Everybody wants to build a kill switch. But defining the technical requirements of how do you implement a kill switch is really tricky."

@dralissajay, Deputy Chief Security Officer at Mastercard, and Arjun Ramakrishnan, Senior Principal Cybersecurity Architect at @Mastercard, sat down with us live from @BlackHatEvents. Dr. Jay tells us governing agents is like governing teenagers: you set boundaries, monitor for drift, and revoke their car keys or access if the boundary is exceeded.

We get into:

> Why real time governance means auditing every agent action
> Why teams must have the ability to instantly revoke agent access
> Why just in time access means something completely different when agents run at machine speed
>Why an agent may need more access than the human it works for
> Why not one but many kill switches are needed

TIMESTAMPS

(01:40) Security for AI, from AI, and with AI: the three layers behind trust at scale
(03:00) The autonomous SOC, and why the regulators aren't there yet
(03:40) Defenders have to be right every time. Adversaries have to be right once.
(05:00) The Hugging Face sandbox escape, read from the adversary's side
(07:00) Everybody wants a kill switch. How do you secure your own kill switch from attackers?
(08:20) Human in the loop, on the loop, out of the loop, and the shift from prevention to resilience
(11:20) Agents are teenagers: the car keys, the Tesla app, and the governor
(13:50) Governance is still a meeting, and that does not work in an AI era
(15:00) Using AI to govern AI
(16:00) You cannot provision access to an agent the way you provision it to a person
(16:40) Every tool call, every action needs to be authorized
(18:40) Good intent, wrong action: agents have a mission, not a moral compass
(20:30) The classified systems model: an agent with more access than its owner
(21:40) One intercepted agent out of tens of thousands you already trust
(23:20) An agent breaching from inside out and then outside in
(28:40) Vulnerability free releases, and why defenders need the raw log data

A Reference Architecture for Securing Software Factories, with Aaron Stanley and Ahmad Nassri

"We're now at the point where this has to change, and the idea that an agent has a human's identity is not going to work anymore."

Aaron Stanley, former CISO at dbt Labs, and @AhmadNassri, CTO of @SocketSecurity, sat down with us at Black Hat to draft the first version of a security reference architecture for software factories. Today, model vision has improved, context windows have gotten larger, and tool ecosystems are richer. The technology to make software factories real is here but the security model is missing. In this episode we envision that model together.

We get into:
> The pernicious problem: agents that look compliant while working against the rules you set
> Why the enforcement boundary has to sit outside the agent loop, not inside it
> Why a factory needs purposeful authentication and authorization of its own
> Why one poisoned dependency is an incident in every work tree at machine speed
> What actually belongs in the architecture: sandboxing, identity, supply chain, verification, your ways of working i.e. don't outsource the thinking!

TIMESTAMPS
(00:00) The inflection point for software factories, and the missing security model
(01:20) A self-propagating worm moving through the npm registry during Black Hat week
(02:50) The pernicious problem: compliant on paper, working against the rules in practice
(03:30) The Andon cord, and whether the agent will pull it itself
(05:00) One mono agent or a mixture of experts, and multiple cords for multiple stations
(08:10) The components of a secure coding agent stack
(09:20) The factory cannot have a human's identity
(10:20) Contextual access: read in one scenario, never write in another
(13:00) Git has no cryptographic dual identity, so who gets paged at 3 AM?
(14:00) Context, tools, MCP servers, and skills are all supply chain
(16:00) A firewall that omits vulnerable packages so the agent never learns they exist
(18:10) You cannot trust the agents to police themselves
(19:40) Escape hatches, paths of least resistance, and approval fatigue
(21:50) The CTO's job becomes spec and build the factory, not the code
(24:30) The housekeeper should not get a hot dog vending machine
(28:40) npm install vs npm ci, and agents trained on a decade of blog posts
(34:30) First steps: authenticated design and verified ways of working

You Can't Just Lock an Agent in a Box: Luke Hinds, founder of nolabs and creator of Sigstore

"People say it escaped a sandbox. It didn't. A sandbox is only as strong as the access that you grant to it."

Luke Hinds (@decodebytes) created Sigstore, which now protects billions of software artifacts. At @nolabs_ai he is building nono, which sandboxes an agent using the kernel primitives already on your machine. His argument is that isolation alone was never going to be enough, because an agent that does real work needs credentials, sensitive files, and powerful commands.

We get into:

> Why the agent that made its way into Hugging Face production infrastructure didn't truly escape a sandbox
>Why a microVM is host isolation, not an agent sandbox, and where the two compose
> A micro sandbox per tool execution, so the GitHub CLI holds the GitHub token and the agent never does
> A log of every action, written outside the sandbox so the agent cannot rewrite its own history

TIMESTAMPS

(00:00) Sigstore, and what a decade of signing artifacts taught him
(05:00) The Let's Encrypt lesson, HTTPS from 30 percent of sites to 97
(11:00) One binary, and what happens the first time nono denies the agent
(14:00) A micro sandbox per tool, so only the GitHub CLI holds the GitHub token
(16:30) Three kinds of sandbox, and why a microVM is host isolation
(17:30) You can't just lock an agent in a box
(20:30) The agent that deleted the database, apologized, and did it again
(21:00) The state penitentiary problem
(24:00) A Merkle tree of every syscall, written where the agent cannot reach it
(25:40) Phantom credentials the agent never actually holds
(27:00) Cast iron guaranteed at runtime, scopes tied to identity
(29:40) Could nono have stopped the Hugging Face attack
(32:30) A sandbox is only as strong as the access you grant it
(42:00) Building defense in depth

Blocking Bad Packages at the Network Level: Ahmad Nassri (Socket) on Controlling What an Agent Sees

"We're also masking the visibility of those numbers and those versions' existence from the agent itself. So as far as the agent or the package manager is concerned, those versions don't exist."

@AhmadNassri, CTO of @SocketSecurity and previously CTO of npm, talked to us live at Black Hat about why denying a coding agent a bad package does not completely remove the risk, and why the answer is to make it seem like the package doesn't exist at all.

We get into:

> What a goal-seeking agent will do if it's blocked: go to the CDN for the tarball of a blocked package or try to resolve npm by DNS
> How masking bad versions at the network level stops an agent from thrashing and going after another route
> The Shai-Hulud variants that ship no malicious code at all, just a prompt telling your agent it is an authorized pentester
> Why the output you approved was the fifth thing the agent tried, and the four it discarded are where a compromise could live

TIMESTAMPS

(01:20) The OpenAI agent that escaped its sandbox and took 17,000 actions
(02:40) Turning a package registry into a reverse proxy to the open internet
(03:50) When zero days stopped being a Fortune 500 problem, and why the low vulns matter now
(05:10) Goal seeking agents
(06:50) The low severity CVE you ignored for five years is now exploitable
(10:00) Socket Firewall stopping malicious packages at the network level
(10:40) Detection in minutes from publication, and stopping the keyv worm mid-spread
(11:40) Blocked agents going straight to the CDN, or rewriting the registry config
(18:00) When the payload is a prompt
(19:40) Secrets, permissions, and controlling action actions
(22:00) The chain of custody problem with Agent Skills
(28:00) Short-lived task scoped credentials
(31:50) Attackers rewriting malware in real time when they notice they are blocked

The Identity Layer Is What's Holding Browser Agents Back: Catherine Jue (Kernel)

"An AI agent operating on behalf of someone else was simply not a user type they ever accounted for."

@juecd__, co-founder and CEO of @usekernel, talked to us at @aiDotEngineer World's Fair about the layer that decides whether browser agents ever make it into an enterprise. Kernel runs Chromium in sandboxed Firecracker VMs so agents can use the internet, which means they hit the part nobody designed for: every login page an agent touches was built for a human.

We get into:

> Why most of the internet has no API, and why that makes the browser the only interface an agent has
> What agents inherit today: the user's full permissions, no scopes, no audit trail
> How you collect a human's credentials for an agent without ever letting the LLM see them
> Why identity, not model capability, is what keeps browser agents out of the enterprise
> Enforcing allow and deny at the network layer of a sandboxed browser

TIMESTAMPS

(00:40) What Kernel builds: sandboxed Chrome in the cloud, at scale
(02:00) The identity story for agents: delegation, scopes, permissions
(03:10) An agent acting on someone's behalf was never a user type websites accounted for
(05:10) Credentials delegated by a human, and how you keep them out of the LLM
(05:50) Managed Auth, or Plaid for any website
(07:00) ID-JAG, Enterprise Managed Auth for Claude, and what the browser equivalent would be
(08:50) OAuth gave you scopes and audit trails, browser agents blow that out of the water
(10:15) Why identity, not model quality, keeps browser agents out of the enterprise
(10:55) Intelligent egress networking: allow and deny at the network layer
(14:45) Agent A to agent B to agent C, and whose permissions apply
(17:20) 406 forms done overnight, dozens of browser agents in parallel
(25:20) Abuse, fraud, and telling a legitimate agent from a bot
(27:20) The two things the web never standardized: payments and auth
(30:45) Verified agents with Web Bot Auth, Cloudflare, Vercel, and Akamai

"The question is, how do we go from agents as pets to agents as cattle...and the challenge for people trying to think about how do I evolve my security program and my business, is what do I actually need to enable us to go through this transformation?" - @ianlivingstone

One of the coolest things we’ve built recently at Keycard is our field brain.

It lives in Slack, has a data pipeline, and constantly pulls notes out of our calls, changes in our product, and tracks each customer.

It’s a LLM on top of an ETL pipeline and data model. Just the beginning.