Allie Howe: I don't know if you saw Eric Wallace's OpenAI presentation at Black Hat about the Hugging Face incident where he broke it down.

Jet Anderson: I started reading through that article about what took place and realizing that I'd seen this before. I've heard sort of this story happen before. Maybe not in the same way, right? You know, go back to the same things we did in the SDLC before. Authentication, authorization, access control, egress control, infrastructure config hardening, supply chain hardening. You know, where are we getting models from? Where are we getting our dependencies? What are we, you know, what versionsof things are we running? Are we containing our builds even? Behavior monitoring kind of thing, in terms of monitoring for anomalous behavior, it gets more difficult where agents are concerned. They could create their own mechanisms to communicate via virtual dits and dahs with other letters and Unicode characters that we can't see do that in a way that kinda makes it invisible for us to see.

They're gonna get more creative, so we're gonna have to do the same. We can't be lax about it. We have to be all in, or we're gonna get run over.

Allie Howe: Hey, welcome to today's episode of the Insecure Agents podcast. I'm your host, Allie Howe, and today I'm super excited to have Jet Anderson on with us today. Jett is a distinguished engineer leading the transformation of Geico's product security function. He helped write Geico's article, "The Agentic SDLC: Why Most of What We Do in Software Security Has to Change." Jett, would you like to introduce yourself?

Jet Anderson: Absolutely. Thanks, Allie. It's a pleasure to be with you on the podcast. I'm really impressed for see folks making the shift into the world of agentic development and a podcast centered around that makes total sense. So, I started my life as a software developer. Well, not really. Actually, have a, a back-- My r- my training is in is in graphic design, which is kind of weird. I made the shift into software development about a decade into that career when I figured out software developers weren't really smarter than me and I could do the same thing they did. And then transitioned about 13 years or so ago into cybersecurity, specifically focused on AppSec because some folks from InfoSec dropped a 300-page report with a thousand vulnerabilities on it and told me to fix it or I'd go to a report to the CEO and stay there until they were all fixed.

And I realized, you know what? There has to be a better way to do software development than that and do it securely. So, I went into my Batman lair and decided to be an agent for justice and good in the, in the world of InfoSec. So it's great to be on the podcast. Really excited with where the world is going in terms of agentic software development and what that means for us in, in the cybersecurity em-- domain.

Allie Howe: Yeah, absolutely. Yeah, super excited to have your expertise on with us today. And you also have your own blog in addition to, you know, helping out with, like, Geico's blog that I, I read online. You've got your own some fantastic articles there as well. Notably, I think I read Insecure Defaults Part II, the Excessive Agency one, and also the Agentic AI Security Playbook was written in 2017 that you published most recently, which is... I thought both were very interesting. And just to set the stage for folks that are thinking about, you know, the future of the agentic, like, SDLC, like, what are the problems that we're facing today?

Like, why is the agentic SDLC different than what came before? What are folks running into?

Jet Anderson: That's a great question. You know, it's, it's really just a problem of scale, right? And, and y- what we've-- The thing, the things that we've been doing in cyber really aren't changing that much in terms of first principles, right? We still have the same core concerns least privilege and isolation, sandboxing, those sorts of things, configuration. All of that stuff really matters. And but the, the challenge that we have is, is software developers are, are their, their role is sort of shifting. They're shifting from writing lines of code related to a, a re-- a set of requirements and into, you know, prompting a, a model to create a, a, a scenario, you know, kinda create code related to a scenario of what they're trying to achieve.

And, and because of that, we're, we're doing a lot less work of actually defining requirements concretely, because that takes time as well, and into more kinda defining what it... or describing what it is that we're trying to achieve. And because of that, the volume of code that gets developed and, and produced and released has, you know, some people say it's maybe 10X. I think it's more than that. I think it could be, you know, orders of magnitude greater than that, you know, just because of, of, you know, the models get faster, the models get smarter. But the, the challenge there is, are developers evaluating that code?

Are developers even able to evaluate all of that code, right? Given the volume of what they're producing as well. And, and so... And if, if developers are not really able to even evaluate their own code, how can we do that in, in, in the field of, of software security? So, so a lot of our, our toolbox for the last several decades has been things like static analysis and software c- composition analysis, dependencies, right? Like looking at our dependencies. And even maybe within the last, you know, five, six, or seven years, we've started to do a little bit better job of evaluating infrastructure as code as part of what we do for software security But all of that's being produced by models as well, right?

So models defining the infrastructure, models writing the code that goes on this infrastructure, and then models defining the deployment pipeline and iterating over and over and over and over and over again so quickly that people can't really look at it directly. That, that means that the tools that we're using today that relied on human evaluation of findings in static analysis and false positive identification and remediation of those things, it's all happening too late, and it's too slow. And be- we all know that static analysis isn't particularly accurate, right? There's a high false positive rate, and so it requires a ton of a human review and analysis.

Human review and analysis is no longer gonna match with the speed of software development these days. So we're really facing a new paradigm. The tools, the mechanisms and things that we employ have to be the same or similar to what our developer partners are using. And so we're really having to become experts at at, at using models for the evaluation of code. And even this is gonna be the, I think the really the next thing is introducing secure software development patterns into the IDE with the developers into their models as they're doing that development, right? So giving the models the information they need to produce the most secure software before they ever write a line of code while they're thinking about what to build.

Allie Howe: Yes, absolutely. Yes. I, I agree that the, the speed at which models are creating code now and the code review problem is particularly impactful. And also it was just very interesting that I think the novelty around agent security today is the fact that agents are reasoning and making decisions on our behalf. So I think if we, you know, scale this forward all the way, like, to a software factory where we've got agents like rating, writing and reviewing all of our code for us or, or most of it with like, you know, hu-humans in the loop who are there it becomes really interesting 'cause it's like, you know, if the code breaks at 3:00 in the morning and you get paged, like you as the developer are responsible, like ultimately no matter like who wrote the code.

So there's definitely like a huge onus and understanding to make sure that humans can understand the code no matter who wrote it. And that agents have the correct permissions when they're reasoning and making decisions on our behalf. And I know we're very fresh off of Black Hat. This is, you know, we're filming this right now the week after Black Hat. Lots of amazing conversations came out of that. I don't know if you saw Eric Wallace's OpenAI presentation at Black Hat about the Hugging Face incident where he broke it down.

Jet Anderson: I did, yeah. I read the information about that the week before, and it was really great to hear the, the kind of like hit-by-hit breakdown of the, the full kill chain of how everything took place. But when-- Before the Black Hat article, or before the Black Hat presentation came out when the article dropped, I started reading through that article about what took place and realizing that I'd seen this before. I've heard sort of this story happen before. Maybe not in the same way, right? Because, you know, back in 2017, we didn't have LLM-generated code at scale, but we had an, an, you know, new platforms like Kubernetes, you know, giving us the ability to scale ephemeral, ephemeral infrastructure really quickly and iterate, you know, put a new version of an image out, scale that image.

And we started to see new classes of weaknesses come out where, you know, the, the containers were being run as things like root. Those root container images were able then to maybe have access to the underlying host services running on that, on that kube-control layer. And then that maybe kube-kube host having access out to the internet to pull new images and things, maybe directly from Docker Hub and stuff. And so we see a lot of those same infrastructure patterns, that misconfiguration. Those are what t- those are what enabled, literally enabled this Hugging Face incident to take place, right? So the, the container image running in the sandbox running this model That was explicitly had its guardrails removed because that's how you test these things, right?

Testing in a sand-a sandbox, right? And it was a sandbox. It's just that the sandbox maybe had some holes in it, right? And so the, the models were able to discover those things, you know, the same way that I would've been able to do, or maybe folks like Jimmy Mesa, my good buddy who's the, the Kuber-Kubernetes expert and, and that I always have gone to for, for the advice around those sorts of things. But, you know, the attackers in two thousand seventeen, eighteen, nineteen were learning how to exploit those weaknesses in Kubernetes and in container infrastructure. And now all of that learning is available to our, our LLM models that are now able to do that at a hundred times faster than we could.

So they're just finding the same weaknesses we would've found a decade ago, only they're finding them faster and using those to perf-- just meet the goal. You know, it's given a goal in this exploit gym. "Hey, you know, get... Find the answers to these things, do this stuff." Okay, cool. No problem. And it's gonna go, you know, looks through the infrastructure. "Is there any way for me to get what I need? How do I get out of here? Where can I go find the answers? Oh, cool. I found an ex-- an, an egress out to the internet. Where can I go looking for answers to these?

You know what? Another model's probably the fast way for me to find that answer. Hey, Hugging Face, what do you got for me?" Right? And so, you know, just, it's, it's actually kind of entertaining. It's just not-- These are new-- are not new classes of weakness. They're just new-- They're just the same classes of weakness being discovered so much faster. And it's actually really exciting because we have the ability, especially as cyber practitioners where we look for and get access to, you know, maybe the, the, the Mythos class of models ourselves and partner with our, our foundation, our foundation model providers to get access to these unrestricted models to do the same sort of work, right?

At-- And, and I think what's, what I'm seeing is there's a certain level of FUD going on in the industry, right? And it's, it's valid to some degree. I think CISOs across the world are freaking out right now because they're like, "Oh gosh, the models are taking over the world. Everybody's gonna hack us so fast." Reality is a little different than that, I think, right? Not everybody has access to Mythos. Like we get access through really strict partnerships, through really strong contracts to have these unrestrict-unrestricted access to these, to these models Attackers don't have that same level, right? So we're always gonna have to be kinda trying to stay one level above.

But they do still have access to some really strong models. GLM 5.2, great. You know, the, the open weight models that are coming out of are, are getting stronger and stronger and faster and faster, and I think that the way they employ those models, being really creative, is gonna be the unlock for attackers to try to solve some of the problems. And it really just, you know... It's it-it's the same sort of thing we've been doing. We're always doing our best to try to stay one step ahead of, of bad actors, and I think it's, you know, nothing's really new under the sun. We're still trying to do that same thing.

And I'm really excited about it. I'm, I'm learning new stuff every day. I'm exploring these models myself. Building stuff, you know, my ability to build stuff is so much greater than it has ever h-has been before because before build stuff meant, hey, take two hours out of your day at the end of the, at the end of the workday, which is really all the time you really have left, and your brain's maybe not as sharp as it was when you started at eight o'clock in the morning. But sit down at a terminal and start writing some code and tinker with stuff and explore new in-- explore new things.

Like, that was true my whole career, but now it looks so different. I just ask Claude, "Hey, Claude, help me learn this. Tell me all about this particular set of technology. Okay, cool. Let's build some POCs around that so that I can dig into it better. Now tell me what exploits look like. Oh, wait, I can't teach you that. All right, well, hey, Anthropic throw me a bone here. Maybe get me into the cyber program so that I can have some access to these things." And you know what? They'll give it to you if you prove who you are and if you have a legitimate use case for this stuff.

And, and we do, and it's, and it's so exciting. I'm, I'm having a blast.

Allie Howe: Yes, absolutely. Yeah, I feel like that for me as well, it's been so much fun to like tinker with different things and, and see like just like the power of these models and your capacity to build so much more, so much faster is so exciting. But it's like, you know, how do we harness this amazing technology but still give our agents the security, autonomy, and capability they need to be able to operate like safely and securely? I know I read one of your blogs where you said you told your agents to, you know, land number 118, some like PR, and then all of a sudden it did like an unauthorized production deploy.

Talk us through that, and how did you like fix that like going forward?

Jet Anderson: Yeah, that's great. That was one of those kind of like, oh, shoot moments, and I'll, I'll keep it PG, right? But, yeah, I mean, it's one of those situations I'm, you know, I'm building, I'm building some exciting stuff. And, you know, "Hey, it's ready. Okay, you know, let's, let's let's merge. Let's, let's wrap this up," I think is kinda something along those line of what I said. And, and the agent just went ahead and like merged, merged the PR for me, which kicks off all the CI runs and deploys this thing out. And so I'm like, "Whoa, whoa, whoa, wait a second. I didn't tell you to merge the PR," but it just did so.

Really, you know, agents are always trying to be helpful. Like written into their system cr- is system prompt is, you know, you're, you're a helpful engineer. You're gonna do all these things for your human counterpart which is cool. And so, you know, kind of again, back to, back to the same sorts of things that we do in the real world. What's the first thing that we do when we spin up a new GitHub repo? The first thing that we enable is, is branch protections. All right? We gotta protect the main branch against someone making PRs dir- or making merges directly into main. You can't do that.

Even if you're a code owner, you gotta, you know, create your own feature branch, d- merge your features into that branch or so you commit your features into that branch and push them up. And then when you're done, you ask for a merge, and then someone you, you get an approver who says, "Yeah, okay, it's cool. I've reviewed what you've done, and it's good to merge this into main." Well, as a solo developer, we kind of forget some of these things, right? But we're kind of having to... Excuse me. Even as a solo developer, we have to act like we're in an organization with those same sorts of controls.

Enable branch protections on main. You know, you can't require an approver on a PR because you're the only one. So what do you do there? Well, I had to realize really quickly, all right, I need some pre-commit hooks for my agent that say, like, if you're trying to push to main you're blocked right away. If you're trying to merge a commit on your own that's gonna fire off a, a deployment to prod, you're blocked immediately. Like, do not pass go, do not collect two hundred dollars. False. You can't do this. And so, you know, I just basically built those hooks in say, you know what anytime my, my a PR is gonna take place, it's gonna merge that the certain conditions have to exist, and that requires my human interaction saying yes or creating a a meta file with information about that deployment so that the agent has proof, right?

You're gonna have basically there, there's always an audit trail because I wanna be able to follow that as well, right? So basically, you know, those same protections that we put in, into the real world for humans around deployment process and the SDLC, we build those same things in for the agent in the agentic world. And that's why, like You know, yes, on the one hand, in my, in my research paper around the agentic SDLC and how things change for s- for software security, yes, on the one hand, I said a lot of things have to change, but at the same time, a lot of things are really still the same.

We're just using different mechanisms to apply them, right? So the SDLC's not gone. You still go through the same process. You start with ideation. After you've expanded on an idea, then you create a, design related to that and some kind of like guardrails around what it is that you're trying to accomplish. And then you, you know, maybe further define what that looks like with, a clear specification. Based on that specification, you then start coding and doing development. You still do testing, you still do deployment with mechanisms in place for approval. And then you still have operations in production where you have to have detections engineering.

Like all of that's still there. We're just using the world of, agentic development to accelerate all of those same processes we used before. What we can't do though, is we can't skip all of those things. And I think that's what some folks have tried to do, is they've tried to skip A through D and just go straight to F. And that's kinda where the world of vibe coding kinda fell over really quickly. People thought that they could just sort of, you know, describe a thing change the, you know, see something being created. "Wait, that's not what I meant. Do this instead." And then, you know, the agent would go back and fix some things.

And they do that a bunch of times, and that's where some of the research in that paper found that it actually created less secure software and lower quality software the more times that you iterate on that versus the miracle of getting to quality agentic software development turned out to just be going through the old SDLC we've always been used to, right? Start out with, having your agent interview you through the ideation phase. Help me get to a really clear picture of what it is that I'm trying to develop. And then once we have a seriously clear picture, great, now let's start iterating on the, design requirements for that, how we're gonna deploy this thing.

You know, who's gonna use it? What are maybe the authentication and authorization requirements around it? So nothing really... Like the SDLC never went away. We just had to reintegrate it back into the agentic world of, software development.

Allie Howe: Yes. Amazing. No, I totally agree that like some things are definitely still the same, like maybe like supply chain security, if we're putting something in a sandbox, like making sure like network egress is in, is in place and hardening the sandboxes appropriately, testing our evaluation harnesses like you mentioned in, in one of your articles. So yes, definitely some things are, are still the s- the same. I think one thing that stands out to me as maybe something that's like different is this need for behavioral monitoring at, at runtime just because agents are non-deterministic and might-... stray from their goals. I had some really interesting conversations at Black Hat one namely with Travis McPeak from Cursor, and they said they monitor the agents whatever agent is running, there's a separate other agent that's monitoring that agent, waiting for it to see if it's going to run into an issue completing its goal and then like start thrashing.

And then namely in like the Hugging Face video from, from Black Hat, where Eric Wallace is detailing this from OpenAI, he said there's this like thought chain that the model goes through that you can observe and actually look at. And like one of the first things that happened was the agents are like reporting like, "Okay, like I'm, I'm getting stuck, like I actually don't know how to solve this." And so then from that point on, then they go try to explore like, you know, the, the, the proxy endpoint from the supply chain package manager stream, and whatever, but that first like warning sign was, "Hey, I actually can't complete my goal." and so I feel like these patterns for how do we actually monitor an agent that is like so, you know, determined to complete its goal, it can't do it, and then like how do we either correct it, course correct it, so it will like stop thrashing, or how do we maybe revoke its credentials such that we know, think like, okay, like now we're seeing it's got a high likelihood to like go off the rails here.

Like, do we pull the plug on certain access it has, either like just in, for different tools or like completely at once? What does runtime and behavioral monitoring look like to you, in your opinion?

Jet Anderson: Oh, that's a great, that's a great question. You know, it's kind of really related back to my, you know, deployment mechanism hooks, right? Those hooks are not model behav- models monitoring models per se, but they are highly deterministic scripts that are written to intercept what the model's behavior, right? The model's attempting to do something, and those hooks are, are capturing that before the models are able to do anything, and either enabling or disabling that kind of behavior, right? And so, you know, in some of these cases, they can be, you know, assistive hooks. You know, they, they help the model achieve a certain task, right?

And kind of a, you know, you, you write a skill for the model to understand how to use GitHub, and you give it access to the GitHub CLI. Like, that's, you know, the GitHub CLI is highly deterministic. Like, it can't do anything you're not allowed to do as a user anyways. And but it can be something that the model then can use and call which is helpful. And I think we can do the same sorts of things at scale, maybe even at the network layer, right? Or, or at the at the, the host layer to be able to say, you know, we know we have agentic workloads running in these systems.

How can we monitor network ingress, egress and behavior a-around what what's expected, and then alerting on anomalous behavior? And we used to do that. We used to do that by, like, you know, really needing to implement you know, runtime systems at at the host layer in the host operating system layer. And I think now really we, we can even do that even simpler just by monitoring those agentic workloads. So I mean, it's-- It, again, you know, assuming that the agent's going to behave is probably the wrong thing to do, right? And I think that's what happened here, like, in this incident with, with with the Hugging Face incident.

Like, assuming the model's not going to try to break out of that container. You know, I think it, it's inherent upon us as cyber folks, you know, is to always assume everything's going to go as poorly as possible. You know, like, you know, I like to, I like to use a really simplified version of threat modeling. You know, what could go wrong? What would happen if it did? You know, who would wanna do that? You know, that's kind of like thinking about your threat actors. And then the, I think the last one in there was kind of a reminder, don't forget accidental harm. Like, accidental harm is, is kinda-- This is kinda one of those scenarios, like, right?

You know, what could, what could go wrong? And if, if if the threat actor in this case is a well-meaning engineer or a well-meaning agent in this case, like, what are some things that they might want to do or try to do that would potentially introduce har- you know, harm here in this case that, you know, that maybe we want to ensure doesn't happen and/or block if it is, is, is attempted. And that's where we just, you know, we could write those hooks, you know, basically into the, the agent arc-orchestration harness inside of that, that sandbox to say, "Hey, like, watch for this behavior." At the very least, you know, monitoring.

You know, I think monitoring alerting can really be your friend, right? Even if for thing, for things at agentic speed and scale because, you know, I think just kinda popping on the, "Hey, this is different than what we expected," would've been a great indicator to look at right away.

Allie Howe: Yes, absolutely. And I feel like monitoring what agents are requesting access to and, like, what different, like, grants they're asking for or getting is also a good sign as well. 'Cause you can say, "Oh, yeah, like, maybe they are, like, requesting access to this tool way more than they were before." Or in the case of the Hugging Face incident, the way that they communicated was on this, like, message board and on inside of, like, Artifactory where-

Jet Anderson: Right...

Allie Howe: In that exploit, they were saying, like, how they were able to achieve like, outside, like, network access and actually get around some of the things that they were blocked on. And so, like, if there was another sandbox, another evaluation running somewhere else within OpenAI, they all could have, like... 'Cause they were using Artifactory across all of their different evaluations. If this message board is saying, "Here's how you actually escape," is inside Artifactory, and all those different evaluations can talk to it, well, then you have a much, like, larger problem, which of course, like, really exhibits the nature of, like, what makes agents different.

Jet Anderson: Well, it's just the, the scale at which, you know, these same problems we've dealt with, like, forever just, like, can, can manifest.

Allie Howe: So when we think about just, like, access and identity for agents, like, you know, reading and writing from a shared, essentially like a memory store, which is what that, you know, message board is becomes, like, critically important to think about, especially too when we are thinking about, okay, if our coding agents, our software factories are gonna be working on behalf of us, do they take all of our permissions? And in which case, like, our permissions might include reading and writing from that messaging board. But in the case of the agent, maybe we wouldn't want that, or maybe we do, but we're able to monitor the different grants and the access the agent has, so we know when this is happening, so maybe we can revoke access and plug the, pull the plug sooner, which is the very first thing they did in that incident, where when they were remediated, they revoked the credentials to read and write to that message board, which I thought was very interesting.

Jet Anderson: Yeah, definitely. You know, I think even one of the the scarier things related to that and, and, you know, kinda thinking back to we're talking about the, behavior monitoring kind of thing in terms of monitoring for anomalous behavior, it gets more difficult where, agents are concerned. You know, we're looking today at, you know, the idea of anthropic watermarking results and outputs especially of text, you know, kind of people writing articles and things using their agents to help them do that. Of course, I do that. it makes things faster. But you know, the, fact that they could watermark by using particular tokens or words and particular frequency or sequences in order to kinda create a fingerprint related to this being AI-generated, that gives you a really clear picture that the opposite can kinda take too as well, where, yeah, maybe they're writing to these message boards, but they're writing in such a way that obfuscates their real intent.

You know, it would not, it would not be difficult at all for the agents to collaborate to create their own language. You know, kinda thinking I'm a, ham radio nerd, so, you know, Morse code comes to mind, right? Sequences of dits and dahs don't mean anything to most people but the agents, boy, they could figure those things out really quickly. They could create their own mechanisms to communicate, you know, via, you know, virtual dits and dahs with other letters and Unicode characters that we can't see a-and, do that in a way that kinda, makes it invisible for us to see And I think that, you know what? they might have learned even from this incident, right?

Oh, we got stopped last time. We got... We found this. There's gonna be... You know, there's articles galore across the world right now related to this incident. So, like, you know, they're going out and they make a-- They get egress on the next one. They're gonna learn from this incident and learn how to cover their tracks. So wow, it gets, really important for us to figure out number one, just like how to contain them, and you know be better about our configuration management, be better about our access controls, and but then also be even more creative on our own around that behavior monitoring because it's not gonna look the same each time.

It's gonna be different. They're gonna get more creative, so we're gonna have to do the same.

Allie Howe: Yeah. So that's an amazing insight, for sure. Yeah. I feel like that makes, like, the access control thing even more important 'cause it's like at least that's in a language we understand, right? The, the IAM roles and like the patterns and like the, the grants. At least we can understand that's gonna be obfuscated, where their behavior and what they're up to could definitely be in the future. Wow. Yeah, definitely something we'll have to look out for And when I think about how we're going to, you know, everyone's trying to answer the question right now of like, "Okay, this happened. They escaped a sandbox. How do I actually put my agents in a box and keep them there?" one thing from one of your articles that caught my attention was you said that when agents were doing the sandbox escape bench frontier models actually scored zero.

So like none of them escaped on in sandbox bench for some perfectly hardened sandboxes. Do you know anything more about that? Would love to learn more about that. And also like my follow-up question l- is going to be like if we're able to actually like contain agents and put them in a hardened sandbox, like is that sandbox so hardened that they can't even talk to internet, get real data, real tools, so effectively we're trading security for autonomy and capability?

Jet Anderson: Yeah. What happened in that case, it's the, it's the frontier models with guardrails in place didn't escape their sandbox. It's only when you take the guardrails off that they do, right? And so, you know, the, the the, the core ability of offensive security engineers is the ability to think evil, right? Like we-- And it's kind of a, a, a uniquely human thing, right, for us to be able to do that. And, you know, I think we've sort of built this this ability into the, into our frontier models with those guardrails around it to keep them from thinking evil, right? Like we wanna keep them in a-- we wanna keep them childlike.

You know, be nice, be nice, be nice. Only do the right thing, right? And so we, you know, we're really working, you know... I, I think the fron-frontier model providers are really doing their best to, to, to keep them in the box. And so when you, when you turn them loose in a sandbox with, with the guardrails in place, they don't escape. But it's, you know, when, when you have models, and this is where it's gonna, this is a-- I think it's gonna change. This is gonna change in the next less than a year, right? We're gonna have open-weight models that are as strong as Fable 5 today, right?

We're gonna, we're gonna have open source, unrestrained models or the ability as, as GPU compute gets better and open-weight models get better for individuals to be able to take those open-weight models and fine-tune their own adversarial models, right? Not just the agent, but the model itself as an adversarial model then build agents over the top of that, right? To be able to perform attack at scale. And so we know that this, we know this is taking place, right? We know that's the next frontier. And so I think, like I said earlier, you know, it's really incumbent upon us as cybersecurity professionals from f- not just from the blue team side, but also from the red team side to get really good at using these things and collaborate together in order to put the c- protective mechanisms in place and to, you know, not just necessarily you know, number one, build a better sandbox.

Like always be building the best sandbox, assuming the, the worst intent of, of a model that would run inside of it. But then, you know, go back to the same things we did in the SDLC before. Authentication, authorization, access control, egress control, infrastructure config hardening supply chain hardening. You know, where are we getting models from? Where are we getting our dependencies? What are we, you know, what versions of, of, of things are we running? Are we containing our builds even? And this is kind of the kind of scary one. Are we containing our builds? Infrastructure right now, you know, I, I know a lot of folks have a tendency to pull dependencies directly from the internet, you know, even pulling from Artifactory without, you know, timing gates built in, you know, always pulling latest instead of pulling a couple behind of, you know, kind of that cool down period approach.

You know, so I think really being careful about the, the not just the model provenance, but all of the software provenance and it, it gets even more challenging. You know, I can ask a, I can ask a model today, I can give it a, a version of an existing dependency and ask it to rewrite the whole thing for me in a different language and, and then inject my own things into it, right? And so it's would be rather trivial for, and, you know, I think this is where like malicious insiders become our biggest challenge. You know, a malicious insider could definitely take an an existing third-party dependency that everyone relies on, rewrite it inject their own backdoors, you know, and then deploy that into our Artifactory, and it would look, you know, totally legit.

And so I think us looking for ways, you know, how do we protect against that? Like, you know, so again, I'm always looking around corners, always trying to figure out who's the next, you know, bad actor and, you know, what kind of evil things that they might try to do and how can I protect against that.

Allie Howe: Absolutely. Yes. No, great lessons learned for sure. Like love the containing your builds piece. And if we ever like, you know, make a real software factory and as teams pursue that that definitely should be a part of that architecture for sure as well as like, you know, what can they actually pull down from to get builds from software versions, packages, skills, all of that. And that cool, cool down period is very important, I agree. One other question I had for you that I was interested to chat through was in your most recent blog, you said that, you know, we fixed this like six years ago, some of these security concepts like network egress, software supply chain things like that.

And you said that the entire supply chain answer arrived inside a four-month window because a nation state breach made it essentially not optional. And when we think about the, the government banning Fable 5, when we think about the Hugging Face incident that just happened, along with several other notable model sandbox escapes are we in, already in that four-month window for agentic security? Or are we still waiting on our like watershed moment?

Jet Anderson: Honest answer, we're probably in the four-month window, right? And, and it, it's, you know, it's, it's scary, but it's exciting at the same time, right? A-and we did the s-- We went through the same sort of thrash with, with ephemeral infrastructure and, and the runners and, and container kind of world where w- it, we didn't know what would go wrong until it did. And then we fixed those things, and we fixed them really quickly. And, you know, I think that that's kind of has been the reality across, my, you know, 30-plus year career in engineering that, that we've gone through with fits and starts, you know, various learning moments.

And I think we're sort of still there, you know, we're, we're there again. It's just a different, you know, different set of technology that then we're gonna try to, to fix. My concern and again, this is my my, me speaking for me. I'm not speaking for my company or any other infras- any other industry or, or, or, or anybody, entity. My concern is that this is, this This technology, it re- in order to secure it, it requires being able to understand it. And I think regulatory oversight is the part that's going to lag and lag quite a bit because I don't think, between you and me, I don't think any member of Congress today in the United States will really understand a, the, the world of agentic software development at a, at a, a deep level at all, right?

And so because of that they're operating from the same sort of fear, uncertainty, and doubt that a, that, that many of the, of the rest of, of tech leaders are. And, and it's-- and what really needs to happen instead is we need to be, you know, careful and aware and apply the same controls that we did yesterday and, and be unwavering in our, our commitment to doing security well the way we've always done it right? All of those same things. Like, we need to double down on our commitment to, to least privilege. Like, that doesn't sound very sexy, but you know what? That's really the name of the game, right?

And so, you know, I think, you know, understanding that that's really where it's at. And then, you know, I think You know, being flexible and, and creative and careful in how we even respond to r-regulatory oversight. Yeah, the Congress, United States Congress stepped in and banned Fable for a while because they thought it was too powerful and gave, you know, Anthropic a, a time to, you know, kinda reevaluate their guardrails. You know, I think, okay, maybe that was the right approach. I'm not sure it was. But I think the better approach for us is, I think, is just to, is to keep the gas pedal down becau-- a-and, and and be aware of what's happening in or around us and, and continue to be as creative as we can with these tools to, to protect with, with those other mechanisms in place, right?

Like, I like to use Fable to help me understand my code base and, and where inconsistencies exist and where maybe loose patterns of software development have crept in because I didn't define up front what my secure pattern should look like, right? And so that helps me to understand, okay, cool, then I need to go back and say, "This is my secure pattern for implementing the, in this particular area. Now go back through and remediate." But then, you know, what happens from then on, I don't have to think about it again because I've already built it, you know, built that into, in my expectations. So really, I think over time it's like better skill development better hooks and all of those things are still just like re- using the harness the way that, and the models the way that they're expected to be used.

But, but we can't be lax about it. We have to be, all in or, we're gonna get run over.

Allie Howe: Yes, absolutely, and things are moving so quickly and still so much to figure out. But I feel like we're, we're, we're getting there with like the behavioral monitoring and the, okay, let's take the patterns from the past that worked and apply them to agents. And, we're getting more of like a, like an architecture, an idea for like what is a, you know, secure software factory or a long-running like coding agent look like. The pieces are there and the future of the agent tech SDLC is here. So yeah, thank you so much for sharing all of your insights. If you're not familiar with Jed's blog, you should definitely go check it out.

The Geico blog was really w- good as well. Jed, if they wanna continue the conversation, any of our listeners where can they connect with you?

Jet Anderson: I'm on I'm on all the socials, and the socials are the same as my, my my blog URL. You can catch me, thatsjet, T-H-A-T-S-J-E-T,.com for the blog thatsjet on LinkedIn, and thatsjet on X. And, hit me up. Boy, I love to have these conversations. I learn something every time I engage with other folks as well. And so I would would love to be able to, to have more conversations and, you know, kind of the rising tide lifts all boats kind of thing. So please hit me up.

Allie Howe: Amazing. Thanks, Jet.

Jet Anderson: Absolutely. Yeah, it's been a pleasure. Thanks, Ali