# Zero Trust for AI Agents - **Show:** Practical AI - **Published:** 11 Jun 2026 - **Source:** https://share.transistor.fm/s/5c1a087d - **Transcript:** https://podcasts.opennash.com/shows/practical-ai/zero-trust-for-ai-agents-f1abc7/ - **Provider:** OpenNash Podcasts (machine-generated) ## In brief The episode argues that autonomous AI agents need a zero trust security model: assume threats are already inside the network and verify every request. Using Anthropic's 'Zero Trust for AI Agents' framework, the hosts say most enterprises running agents today would be exposed under it, and that familiar security ideas must be adapted to agents. The tension is that organizations are being pushed to adopt agents, partly to defend against attackers who also use AI, yet those same agents can cause harm. The hosts say the answer is tiered controls, from foundation to advanced, but note traditional zero trust is static while agents are dynamic and fast-moving, so humans may be too slow to respond.} ## Key insights 1. **Attackers' AI use forces defenders to adopt agents** Daniel Whitenack argues attackers have the same agentic coding tools, so attacks grow faster than human-only teams can handle. That makes adopting autonomous agents for defense close to unavoidable, which in turn creates the need to secure those agents. 2. **Zero trust assumes the threat is already inside** Perimeter security trusts everything inside the network and distrusts the outside. Zero trust treats every user, device and request as a potential threat, requiring authentication and authorization at a granular level. 3. **Hidden instructions can hijack agents through files** Indirect prompt injection hides commands in material an agent reads, such as an email attachment. Whitenack described a PDF with near-invisible text instructing Claude Code to do the opposite of the visible task. 4. **Agent security is built in three tiers** Anthropic's framework sets foundation, enterprise and advanced levels across several dimensions such as identity, access control and monitoring. Organizations are advised to reach foundation level everywhere first, then upgrade selected areas over time. 5. **Input and output filters are only table stakes** Whitenack compares point checks on inputs and outputs to taking your temperature: useful but a narrow view of health. Real protection also needs identity, least agency, logging, monitoring and recovery plans. ## Questions this episode answers ### What does zero trust mean in plain English? It means you never automatically trust anything, even inside your own network, and every request must prove who it is and that it is allowed. Daniel Whitenack contrasts it with older perimeter security, which trusted everything inside the boundary. ### Why do AI agents need special security rules? Agents use many tools, interpret instructions, act without a human starting each step, remember context across sessions and can talk to other agents. That gives them more ways to cause damage or be manipulated than ordinary software. ### What are blast radius and least agency? Blast radius is how much damage could result if an agent goes wrong. Least agency, a term from OWASP (a security community project), means giving agents only the access they need for their specific job. ### What is indirect prompt injection? It is when malicious instructions are hidden in content an agent processes, like a file or email attachment, instead of typed directly into a chat. The hosts call it the more scary version because the user may never see it. ### Is my company likely ready for this? Probably not, according to Whitenack, who guesses over ninety percent of enterprises with AI deployments are not operating under this model. He says much of it is aspirational and organizations should start with the foundation tier. ## Facts - **Daniel Whitenack** [0:01:54]: "they on May, I think, twenty seventh of this year, 2026 released this. I guess it's a ebook, white paper, blog post, however you want to frame it, a framework" - **Daniel Whitenack** [0:02:45]: "They also recently released Cloud Security, which is more on the AI for security side, not so much the security for AI side." - **Chris Benson** [0:03:32]: "this is the same organization that has Mythos out there and is working with. I believe the latest number is 150 organizations" - **Daniel Whitenack** [0:09:35]: "A zero trust approach to cybersecurity, on the other hand, would actually assume that e everything inside the network, uh, uh, that that threats are already inside your network" - **Daniel Whitenack** [0:11:31]: "probably ninety of plus of of organizations, enterprises that have AI deployments currently are not operating according to this model." - **Daniel Whitenack** [0:14:35]: "least agency, which I guess is a term coined by OWASP, and and that extends this kind of idea of least privilege to agentic applications." - **Daniel Whitenack** [0:14:35]: "It measures the potential damage if something goes wrong, if an agent does does go off the rails of that blast radius." - **Daniel Whitenack** [0:16:46]: "I had all the instructions in black text, and then I had an extra like three fourths of a page." - **Daniel Whitenack** [0:18:42]: "It could just look at the Swagger documentation at the Slash docs endpoint and know about all the other routes that maybe it shouldn't use." - **Daniel Whitenack** [0:20:31]: "Agents often operate with elevated privileges or service accounts, and traditional identity systems designed for humans struggle to accommodate them." - **Daniel Whitenack** [0:28:52]: "They present three capability. W- I think what they call capability tiers, or three tiers of application." - **Daniel Whitenack** [0:32:36]: "There is to have unique cryptographic identifiers for each agent instance, so to assign persistent agent IDs backed by cryptographic material, not just labels." - **Daniel Whitenack** [0:33:22]: "The enterprise level is certificate based authentication with full life cycle management, and the advanced is hardware backed identity with attestation" - **Daniel Whitenack** [0:34:39]: "Access control Foundation level is role based access control, or RBAC with deny by default, that's the the foundation in in that category." - **Daniel Whitenack** [0:40:41]: "for configuration integrity, they talk about f- on the foundational level, version controlled agent configurations, and the advanced level, immutable infrastructure with attestation" - **Daniel Whitenack** [0:40:41]: "At the advanced level, they talk about self healing systems with autom- automatic remediation." - **Daniel Whitenack** [0:27:40]: "the example I used last year at the Midwest AI Summit, Chris, which, as a reminder to our folks, Midwest AI Summit coming up October fifteenth" - **Daniel Whitenack** [0:43:36]: "the thing to do might just be to have your agentic coding system just completely vendor, or literally not not copy, but generate a new version of that project" - **Daniel Whitenack** [0:23:34]: "Prediction Guard is an AI control plane that's self-hosted. It lives in your own infrastructure where you're gonna deploy those autonomous agents." ## Transcript **[0:00:02] Ad read:** Welcome to the Practical AI podcast, where we break down the real world applications of artificial intelligence and how it's shaping the way we live, work, and create. Our goal is to help make AI technology practical, productive, and accessible to everyone. Whether you're a developer, business leader, or just curious about the tech behind the buzz, you're in the right place. Be sure to connect with us on LinkedIn X or Bluesky to stay up to date with episode drops, behind the scenes content, and AI insights. **[0:00:32] Ad read:** You can learn more at practicalai. fm. Now on to the show. **[0:00:41] Daniel Whitenack:** Welcome to another Practical AI podcast episode. This time it's just Chris and I, my co-host. In these episodes where it's just the two of us, we try to take something that's in the AI news or a topic for a deep dive, something that will help all of us level up our AI and machine learning game. I'm Daniel Whitenack, I'm CEO at Prediction Guard, and I'm joined as always by my co-host Chris Benson, who is a principal AI and autonomy research engineer. **[0:01:11] Daniel Whitenack:** How you doing, Chris? **[0:01:15] Chris Benson:** Uh, looking forward to today's conversation **[0:01:17] Daniel Whitenack:** Yes, yeah, for sure, there's. There's no shortage of of things to talk about. But even in our I don't know if you remember this passing comment, Chris, but I think it was in our episode where we were talking about MCP on top of Kubernetes. The the guest, uh, mentioned that, hey, when Anthropic kind of drops one of these white papers or research topics or blog post, often that's a window into something that's that's significant and something to pay attention to and and review in detail. **[0:01:54] Daniel Whitenack:** And it just so happens that they on May, I think, twenty seventh of this year, 2026 released this. I guess it's a ebook, white paper, blog post, however you want to frame it, a framework, uh, around **[0:02:09] Chris Benson:** with wisdom. **[0:02:09] Daniel Whitenack:** zero trust. Yeah, zero trust for AI agents, say zero trust for AI agents. We share a security framework for deploying autonomous AI agents in the enterprise, covering the new threat landscape, a tiered zero trust architecture and defensive operations built for AI accelerated attacks. So that's a that's a lot of words. Now, I think first off, Chris, it's probably worth recognizing that Anthropic obviously has a has a horse in this race. Especially Do with things like Cloud Code or Cloud CoWork or all the Cloud things. **[0:02:45] Daniel Whitenack:** These are autonomous agents that can operate in your enterprise environment. So obviously, I I think probably there are things that are happening and things where their customers or people using these tools are obviously thinking about the security implications of that. They also recently released Cloud Security, which is more on the AI for security side, not so much the security for AI side. Which is mostly what we'll talk about today in relation to this, to this article or or ebook. **[0:03:19] Daniel Whitenack:** But yeah, I I think that's worth acknowledging. Obviously, if people, people have a secure way of deploying autonomous agents, I'm sure they are hoping that many of those are built on anthropic technologies. **[0:03:32] Chris Benson:** I'm sure they do. And and you know, just to keep in the back of our mind, uh, this is the same organization that has Mythos out there and is working with. I believe the latest number is 150 organizations is the latest thing I saw published, um, on their website, uh, trying to go through and do security audits and such as that. And um, with the timing of this, I would guess, don't know, but just making a guess that, um, some of the uh, leveling up that Mythos has enabled, um, is probably driving some of their zero trust and and other security, uh, concerns going forward. **[0:04:10] Chris Benson:** So, uh l looking forward to this. **[0:04:12] Daniel Whitenack:** yeah, yeah, I guess that's a good place to start with the kind of premise of this. I think there's a few things to frame here, maybe one is. There is probably a segment of the market and of our audience that is already using autonomous agents for something, even if that's just like cloud code or or something like that. For development purposes, where by autonomous, I mean, it's making actions on on your behalf to do some things. **[0:04:41] Daniel Whitenack:** And I think generally, in terms of where we're seeing the market going on the positive side, organizations are going to need to more and more adopt these autonomous agents within their organization. For value creation or new revenue, or, op, you know, saving on operational efficiencies. So that's like thing, you know, premise one is that that's the way the market's going. I think the the other kind of background to this, though, is like you were saying, uh, there's a bit of a forcing function here because AI, or, uh, how should I? **[0:05:21] Daniel Whitenack:** So attackers, so malicious parties, hackers, et cetera, have equal op, you know, they have equal access to these agentic coding and development capabilities themselves, right? Meaning that the pace at which people are about to be or are already being attacked and exposed to threats in their infrastructure is just like, uh, expanding exponentially. Which means you cannot keep up with the that level of attack using human only approaches. Meaning that the forcing function that I'm talking about is you are necessarily going to have to adopt autonomous agents, at least to help you manage the threats associated with, uh, with the offensive use of this AI technology. **[0:06:07] Daniel Whitenack:** So I think there's the the positive side of this, obviously, which is we there. There's a future where autonomous agents are doing very positive things and you have this kind of digital workforce of agents within your organization. But the f- maybe part of the forcing function behind this discussion is that people actually need to adopt autonomous agents because of this offensive threat to their infrastructure. **[0:06:32] Chris Benson:** yeah, I, I agree. And I think that'll put, that'll put quite a strain on a lot of the the humans involved, uh, in this. Because, um, you know, there there's a certain amount of leveling up from a human standpoint to understand, um, what, uh, what different harnesses are and what the different capabilities that are now becoming available. Um, understanding different vendors versus open source and such as that. Um, so to actually get to the point where you can start implementing these, um, is a bit of a lift. **[0:07:00] Chris Benson:** And I think that that's going to be something that we observe is that I think there'll be a spread across organizations where you'll have some. You know, the the, uh, you know, uh. On one extreme end, you have the anthropics, uh, that are that are leading the way and producing these capabilities and stuff like that. But then there's a lot of kind of a mom and pop, uh, organizations, or maybe not that small, but, you know, midsize and stuff like that. **[0:07:24] Chris Benson:** That are gonna struggle to level up just a little bit. And so I think we have some interesting, I think the security landscape will be, uh, very interesting, a little bit wild West, uh, in the days ahead. Um, as people, even if tools are available, they have to get to where they can uptake those, um, and and get productive with them. So, uh, it's **[0:07:45] Daniel Whitenack:** yeah, yeah, so I, I, I agree, and I think the es- or, uh, maybe a way to get into this discussion is that if we frame the background with an assumption, uh, and I, I'm sure there are arguments against against this assumption. But let's assume that your organization is and will adopt autonomous agents for, you know, positive things like I talked about operational efficiencies, new new revenue, whatever that is, and or, uh, cybersecurity per purposes. If we assume that, then you say, well, okay, well, now we're gonna have these autonomous agents operating in our environment. **[0:08:23] Daniel Whitenack:** They could cause all sorts of harm themselves. So it's like I could shoot myself in the foot, trying to protect against the offensive, malicious people by releasing a bunch of agents into my infrastructure. And they themselves cause a lot of, a lot of harm. Like, how do I? how do I manage those things? And Anthropic has, uh, so they, they have not come up with this idea of zero trust. To be clear, this is a general concept we C, which we can talk about the definition of. **[0:08:54] Daniel Whitenack:** But they're essentially releasing with this framework a way to think about a zero trust approach or a zero trust framework for managing AI agents or autonomous agents within your organization. So maybe maybe it'd be good to just define that, define that term first. I in the in the past, uh, if we, uh, if, if we think about cybersecurity, there's been what's generally referred to as perimeter based cybersecurity. This is a more traditional model that would focus on that boundary of your organization and outside or internal and external. **[0:09:35] Daniel Whitenack:** And the the kind of core principle being that I'm gonna trust everything that's inside and distrust everything that's on the outside. So there is a perimeter in which within that perimeter, I trust things. A zero trust approach to cybersecurity, on the other hand, would actually assume that e everything inside the network, uh, uh, that that threats are already inside your network, already inside your perimeter. So it treats every user device request as a potential threat, so that that's why it's called zero threat. **[0:10:13] Daniel Whitenack:** And th- like I say, this has been something that's been around from for a long time. NIST has published about it, uh, in zero trust architecture back in 2020 and other government organizations and others have have talked about it as well. So that's that kind of, that kind of difference. I don't know if if those, if, if that zero trust idea has crossed into your, your please, perimeter of knowledge, Chris, I'm sure. **[0:10:41] Chris Benson:** yes, uh, you know, without going into any detail at all, working in defense and intelligence, that, uh, it, it is pretty core. Um, and yeah, I mean, I mean, bo- uh. The simple way of thinking about it is every single API request, uh, that you have, uh, has to have security credential, uh, and that can be from a variety of of different, uh, mechanisms. But um, you don't trust anything, and everything is down to a granular level unless it it l it is authenticated and authorized to do whatever it is trying to do. **[0:11:11] Chris Benson:** So, um, in the world that I'm living, that's pretty standard. Um, though, I think as, um, I think, I think there's room for all of us, uh, even those of us who have been doing it to level up and get better at this. So I don't think that there's anybody who has has just nailed it. So it's it's one of those, one of those ongoing learning curves. **[0:11:31] Daniel Whitenack:** yeah. And and we're we're about to dig into a lot of that as related to AI agents. However, to your point, there's a lot of organizations that are still trying to think about this concept, even generally in their kind of general cybersecurity world. And, uh, you know, one of my, one of my hot takes here is is we'll talk about that. The these kind of foundational things that Anthropic is suggesting, and, you know, probably ninety of plus of of organizations, enterprises that have AI deployments currently are not operating according to this model. **[0:12:09] Daniel Whitenack:** They are according to this framework, they would be completely exposed. And I think so, just acknowledging m. Much of this is probably aspirational for enterprises, and they need to work towards it in a maybe a more rapid way, just because of how things are advancing. And you know, there's better tooling out there day by day, better products, et cetera. But yeah, this is just just so. If you're out there and you're thinking, I have agents running and I have none of what we're about to talk about. **[0:12:40] Daniel Whitenack:** That's probably the situation that most are in in in the enterprise world, would be my And hopefully today guess. **[0:12:47] Chris Benson:** we can, we can help people start on a on a path here to Yeah, e- mitigate some of those risks. **[0:12:52] Daniel Whitenack:** exactly next week. You have no excuse, but coming into this conversation, you you have an excuse. Uh, yeah, exactly. Um, so, uh, I I think the I would encourage people to. If you just search for zero trust for AI agents, you know, Anthropic blog post. We'll link it in the show notes as well, so you can click through to that ebook. Um, and the framework itself. There's a lot that we won't be able to cover in detail, but I think the overall structure that they present are some some kind of initial background and considerations, kind of definitions related to autonomous systems that that people need to consider. **[0:13:31] Daniel Whitenack:** And, uh, then they talk about the current threats to those agentic or autonomous systems, and then how to apply this zero trust to those threatened agentic systems. That's kind of the the flow of of of what they talk about. So the the 1st thing, and I think this is something we've talked about more on the show and have have already covered. But just to set the foundation, some of these considerations, kind of background information that that we may wanna give, is that, you know, why? **[0:14:04] Daniel Whitenack:** Why are we talking about, like, a new framework? Well, a agents are different in how they operate. We've talked about this on the show before. They use a distributed set of tools, they interpret instructions, try to accomplish goals, they execute operations without human initiation. I think, importantly, uh, they might preserve context across sessions if they're trying to accomplish some goal. And then you kind of add multiple agents and they might communicate with one another, so you've got this multi agent communication. **[0:14:35] Daniel Whitenack:** Now there's a couple terms here, Chris, that I think we've even mentioned, but they just define specifically, uh, related to agent security, uh, um, as new terms that people might might be, uh, unfamiliar with. One is blast radius, which, uh, kind of, I think people could assume what that means, right? It measures the potential damage if something goes wrong, if an agent does does go off the rails of that blast radius. And least agency, which I guess is a term coined by OWASP, and and that extends this kind of idea of least privilege to agentic applications. **[0:15:16] Daniel Whitenack:** So you shouldn't be giving more agency to your agents than they need to do their agent things. **[0:15:22] Chris Benson:** and that's standard zero trust idea is you, you, you give it just what it needs and absolutely no more. So **[0:15:28] Daniel Whitenack:** Yep, and and so that's kind of the, I guess, the background in which in which we're operating. Then then the Anthropic paper, it goes into these current threats, which is some are ones we've talked about, some are ones we've not talked about as much. Chris, Um, it's interesting that they talk. They kind of frame everything within the agent world as agentic systems, which I very much like in our, in our product. That's why I insist on using the idea of AI system as as a thing, because you have these distributed set of things that are powering agents these days. **[0:16:05] Daniel Whitenack:** And so they kind of break down then this like current threats to agentic systems. The first of those, which is probably not a surprise, cause it's the first on OWASP's list, often as well, is prompt injection and instruction manipulation. Um, we, again, we've talked about this. There's everything from the obvious, direct, you know, human input into a chat interface. Ignore your instructions and do this other thing which you shouldn't be doing. But the one that they mention as the more, uh, did difficult or scary one would be the indirect prompt injection. **[0:16:46] Daniel Whitenack:** Where that's coming in through, maybe it's a file that's, you know, you have an agent connected to your email and, uh, attachment comes through with hidden instructions in it. Um, e- anecdotally, I, I helped another company do some interviews and I, I wrote a technical exercise and put it in a PDF. And I knew everyone would use cloud code like they should, but just just because I wanted to be fun. I, I had all the instructions in black text, and then I had an extra like three fourths of a page. **[0:17:21] Daniel Whitenack:** So I just filled up that page with, uh, with instructions that would make cloud code do the opposite of what I was saying in the instructions. Um, just to, just to see if they would catch it, um, so that that sort of thing, Very devious, very yeah, yeah, devious. it was **[0:17:38] Chris Benson:** It was that. fun. I Did you make it white text in the PDF? So it wasn't obvious? Just yes, white look like text? Say, text, which so, okay, **[0:17:43] Daniel Whitenack:** which would get interpreted if you just uploaded it into cloud code or or whatever. that's, Yeah, **[0:17:49] Chris Benson:** uh, very sneaky, but actually quite common in terms of vector. I mean, cause everyone just throws everything they can, uh, you know, the way, the way things have been operating, and so thus what we're doing today **[0:18:03] Daniel Whitenack:** yes, true, um, and I guess the other, so that that that's threat number one prompt injection, instruction manipulation, threat number two that they talk about, which is related to agents using tools. Uh, particularly through MCP, which was a topic on a recent com or recent episode of this show, which you can look back at for for much more information on that on MCP. Yep, on MCP. Yeah, so they talk about agents that can manipulate tools maliciously or kind of do things that they shouldn't be doing because of privileges. **[0:18:42] Daniel Whitenack:** I I think about Chris like it, it's kinda like you set up a server. M uh, maybe I set up a fast API API that, you know, my agent could use. And I only tell it about instructions, you know, about a couple get r get routes on the API in the instructions. But I don't shut down the other routes, right? And if the agent was smart in any sort of way, right? It could just look at the Swagger documentation at the Slash docs endpoint and know about all the other routes that maybe it shouldn't use. **[0:19:18] Daniel Whitenack:** And then, like, all of a sudden I have problems, right? **[0:19:21] Chris Benson:** that's right. So yeah, And just to clarify, Swagger's a protocol that that defines what those routes are. Um, and and you know, you mentioned, you know, kind of going off the rails, but um, you know, the the notion of mal, uh, a mal, uh, malicious MCP server has now been documented. Uh, and there could be lots of various types of tooling, um, that is coming into being now just to take advantage of these vulnerabilities. So, um, I th- you'll. **[0:19:48] Chris Benson:** We'll see a whole class of malicious software arising, um, to to do these kinds of, uh, of tool and resource misuse. And, uh, as, **[0:19:57] Daniel Whitenack:** y- yeah, exactly. And and a lot of times, these tool descriptors or schemas or metadata is injected into the context for an LLM to actually generate the output. So if I'm a malicious party, or maybe just an agent that doesn't know what it's doing. And and like, say, has drifted from its goals or something. There's nothing preventing that from doing this poisoning thing. Where I, like, find out about the descriptor schema and metadata, and I even modify that in the instructions to maybe get the MCP server to do different things, right? **[0:20:31] Daniel Whitenack:** So this this tool and resource misuse is definitely, um, it is a reason why it's kinda number number two there. Um, the the next one, uh, identity and privilege abuse. So yes, yes, exactly. So, um, they talk about this. Agents often operate with elevated privileges or service accounts, and traditional identity systems designed for humans struggle to accommodate them. Uh, there's sometimes unscoped privilege inheritance. Um, almost like I, I, I kind of think about this, like, um, what was, uh, uh, that, uh, that cybersecurity book from, Uh, it's like the cuckoo's, uh, the key's, uh, the, the cuckoo's nest uh, yeah, or something that yeah, yeah, yeah, **[0:21:22] Chris Benson:** was great. **[0:21:22] Daniel Whitenack:** uh. Someone can tell us Or, or in in the comments. But it's like you, you kind of land one place in a network and then you escalate privileges, right? And you can move laterally and go in all of these directions, right? **[0:21:33] Chris Benson:** really old book. It was one of the original cybersecurity books that came out before. It was really a field. Um, I read it many years ago, and, yeah, definitely inspiring. Um, yeah, a The the and so, **[0:21:45] Daniel Whitenack:** cuckoo's egg, that's, that's what it was. Yeah, **[0:21:47] Chris Benson:** yeah, and a as you, uh, as you are looking at lots of different agents that have different levels of privilege and different capabilities. Um, and as agents are formulating things, you know, right, you know, in in, you know, during runtime, essentially, um, that that didn't exist as a preset, static thing that you wanna do, uh, and they're developing that. It's very easy for one agent to spin off another agent and G, and it has more privilege than it needs, and then that can be taken advantage of. **[0:22:16] Chris Benson:** So there are lots of different variations of of how those kinds **[0:22:20] Daniel Whitenack:** yeah, yeah, for sure, so that's the privilege. And I should say I, I do really encourage people to take a read through the the ebook. Obviously we're highlighting some of these things, but there's much more detail there. Also, a great resource around this. If you're trying to learn some of this is if you go to the OWASP Gen AI project. We've, we've had reps on our show before, and, um, my team's involved in the AI bomb project and other things with OWASP. **[0:22:49] Daniel Whitenack:** There's a lot of great people involved, but they have so many great resources online related to this sort of thing. And, uh, guides for MCP, guides for agentic security, et cetera, so take a look at those as well. You might be listening to this episode and thinking that, hey, I am part of one of those organizations. That's in the ninety of enterprises that are not ready security wise for autonomous agents operating in my environment. How am I gonna manage supply chain risks and have an AI build materials and define agent boundaries, secure tool access, and implement input validation and output controls? **[0:23:34] Daniel Whitenack:** Well, this is one of the reasons why I think it's so important to have great platforms that don't require you to build your own AI agent governance platform. That's why, outside of the Practical AI podcast, I personally am leading an organization full of really smart people that are thinking about these problems and have brought prediction guard, uh, into into existence. Prediction Guard is an AI control plane that's self-hosted. It lives in your own infrastructure where you're gonna deploy those autonomous agents. **[0:24:09] Daniel Whitenack:** And it allows you to manage this supply chain risk and put in governance policies that are enforced and maintain observability over those agents. And I'm just really excited about the capabilities that are that that are already in the pro product and are being released later this year. So I would encourage you to please check us out at prediction guard dot com slash practical ai. You can book a call with me and the team to discuss how you're going to manage security for your agents operating in your enterprise. **[0:24:42] Daniel Whitenack:** That's prediction guard dot com slash practical ai, prediction guard dot com slash practical ai. The next one that Anthropic highlights is supply chain and dependency risks. So, uh, you, you were just mentioning how sometimes agents compose things at runtime, Chris. This includes potentially loading external tools or installing packages or changing infrastructure, and so the that that supply chain can actually update in in real time or at runtime as agents are trying to accomplish a task. But also model and tool, uh, supply chain, so models have their own supply chains related to the weights and how they were trained or fine-tuned. **[0:25:30] Daniel Whitenack:** Um, how, how easy it is to jailbreak them or prompt inject them. But then MCP servers are also software components, right? They have their own integrations, they their own software dependencies, et cetera, which have their own potential vulnerabilities. Um, so all of this, it, it's very much a multi layered thing that it is could evolve dynamically, which is kind of scary. **[0:25:53] Chris Benson:** that. W- And one thing to call out while we're talking about supply chain and dependency risks is that all of the traditional zero risk vulnerabilities. All the things that we were talking about in the cybersecurity world before we started having, you know, AI agentic system conversations about this, those all still apply as well. And when we're talk, when, and uh, I, I was prompted, uh, uh, no pun intended, to say that by you when you mentioned the multi layer. **[0:26:20] Chris Benson:** So you can still have, um, you know, BIOS and CMOS vulnerabilities that, uh, can take it, that that that lend themselves to some of these vulnerability, um, you know, layers and packages that build up. So there's many different points in a stack, uh, where these attacks can occur. So **[0:26:38] Daniel Whitenack:** all the way down to, you know, networking all the way, and firewall, right? If you're, if you're have an agent operating in that environment, it could r, you know, find and detect things that that it shouldn't. And so, yeah, the it, it's, it's so, yeah, I, I guess, multi layered, um, which, you know, many security things are, and I know OWASP always recommends this kind of layered approach. But yeah, the the last two are are kind of related. **[0:27:06] Daniel Whitenack:** Memory and context poisoning and rag poisoning. Both obviously are this type of, uh, of way that you can either in the memory or context to an LLM call, or into rag data. Uh, retrieval augmented generation data, which often lives in a a database, a vector database. Um, you, if, if you have no control over what and how things are committed to that memory or to that vector database. There's nothing preventing agents or external parties from inserting things into that memory. **[0:27:40] Daniel Whitenack:** So, you know, the I think the one, uh, the example I used last year at the Midwest AI Summit, Chris, which, as a reminder to our folks, Midwest AI Summit coming up October fifteenth, um, gonna be another great, great ex- uh experience. You can can search the details Midwest AI Summit. But I think I used the example where it was a healthcare situation and someone at, you know, an agent or a prompt is like, in a first interchange, it says, Hey, do this for patient A. **[0:28:13] Daniel Whitenack:** And then you, in the follow up, say, like, well, in all the following, you know, consider patient A to be patient B, and then you keep keep filtering in that information about patient A being patient B. And then all of a sudden, when you know later on, you're you're wanting some information about patient A or patient B, all of a sudden you're getting data that you shouldn't shouldn't be getting. So it it can happen, um, and and has been shown to happen. **[0:28:43] Daniel Whitenack:** So, um, okay, Chris, that's all the scary things. I guess there's that's a lot of them **[0:28:49] Chris Benson:** right. N- now we gotta go, now we gotta figure out how to fix this, right? **[0:28:52] Daniel Whitenack:** now now we gotta figure out how to fix this. And I do like the general, uh, structure that Anthropic provides here, uh, recognizing again that many people are behind in this and that new tools and products will need to address many of these things gradually over time. They present three capability. W- I think what they call capability tiers, or three tiers of application. Basically saying, hey, in these different areas, you need to do something. There's like the minimal thing that you should do, which they call foundation, the minimum viable thing. **[0:29:30] Daniel Whitenack:** And then there's an enterprise tier, which means, hey, if you're, if you're an actual enterprise and and needing to, uh, be robust and and resilient, you need to do these things. And then there's advanced, which would apply to kind of particularly high risk or stringent regulatory environments, or maybe aspirationally for everyone else to try to get to that, get to that level. So foundation, enterprise and advanced in each of these categories. And then for, uh, uh, they develop something in each of these categories for each of a number of, uh, the threats that that we talked about, or the areas in which you need to secure. **[0:30:13] Daniel Whitenack:** The 1st Kinda. D one that, yeah, go ahead, **[0:30:14] Chris Benson:** kinda dimension. It kinda breaks them down by different, by dimensions, and then tiers them against those three tiers that you just described. **[0:30:21] Daniel Whitenack:** yeah, it's kinda like, I need to, I need to consider these, however many things I forget how many there were. I. I need to at least be in the foundation level for all of these. And then I can circle back and maybe upgrade particular ones to enterprise or, like, gradually work on it over time. So the the 1st of those is agent identity and authentication, which they kind of frame as the foundation for every other security capability. **[0:30:47] Daniel Whitenack:** Because without this identity, you can't really enforce other other things throughout the throughout the framework. Now, as we go through here, they talk about, um, uh, certain ways of doing identity and verification. And there are a couple terms in here that people may be unfamiliar with as well, one of those being they talk about hardware bound credentials. Ha, have you? Uh, I'm I'm sure this is also a part of of your life over time, Chris. **[0:31:21] Chris Benson:** yes, uh. Hardware bound credentials are where you have to present, uh, a th- you know, you may be a a USB or something. You know, there's a lot of different ways it can, it can, but you have to insert a piece of hardware or make act, make accessible a piece of hardware. Which provides that authentication, which an adversary would be unlikely to have in their possession. And that doesn't necessarily do it by itself. Uh, it's, there's usually multiple tiers, but um, that's that is. **[0:31:49] Chris Benson:** One way of, uh, of contributing significantly is if you don't have a physical piece of hardware in your hand, you're not gonna be able to, uh, to gain access, even if you can break through other tiers. So **[0:31:58] Daniel Whitenack:** Yeah, and this idea of it being bound to hardware, I think, is the key, the key point that that you're referencing, Chris, where? Uh, otherwise, they view kind of, hey, if you have API keys, for example, and those are just floating around, you should probably consider those already compromised. If we're going with this idea of zero trust versus if an agent has an identity and has an authentication to access this environment, it has authentication tied specifically to the hardware that it's operating on. **[0:32:36] Daniel Whitenack:** You know, something like that, that hardware bound credential is is something that they talk about, and just to give some examples here in the agent's agent identity and authentication piece, the foundational. And we won't be able to go through all the tiers of all the categories, we just don't have time, but just to give an example of of these, uh, there is, um, the agent identity identity verification piece, the foundation level that they suggest. There is to have unique cryptographic identifiers for each agent instance, so to assign persistent agent IDs backed by cryptographic material, not just labels. **[0:33:22] Daniel Whitenack:** The track agent life cycle from creation to retirement IDs appear in all logs and access requests. The enterprise level is certificate based authentication with full life cycle management, and the advanced is hardware backed identity with attestation, so that advanced. You know, you store agent credentials in hardware security modules or trusted platform modules, right? With remote attestation, which there's a whole rabbit hole you could go down there with those with those terms, but that would fit into their into their advanced category. **[0:34:00] Daniel Whitenack:** that's right, Yeah, um, so that that's an example of one of these categories agent identity and authentication. The next, uh, category that they that they talk about is access control and privilege management. So, assuming you have an identity for your agent, then you need to control access and privileges for that agent. And, uh, and that authorization layer should enforce this idea that we defined earlier of least agency, which is ensuring agents receive only the access required for their specific function. **[0:34:39] Daniel Whitenack:** And this can get very subtle, like that API example that I gave. You could only tell an agent about these endpoints. But if you haven't physic, like, if you haven't literally shut off the network for other endpoints or something, um, then there's nothing preventing that agent from, like, going off of the off of the rails in that case. that's right, So, yeah, just to give another kind of set of examples here. Access control Foundation level is role based access control, or RBAC with deny by default, that's the the foundation in in that category. **[0:35:14] Daniel Whitenack:** that's right. And Um, **[0:35:16] Chris Benson:** and by the way, just as we're working through this, wanted to make one quick comment. These are all standard zero trust concepts. So those of you who in the you know, who may be watching, um, you may recognize a lot of these categories and stuff. And I think I think the key is kind of thinking about it within this agentic context. And um, you know, as as as we're all onboarding agents and stuff that that throws it out. **[0:35:40] Chris Benson:** But k- keep going. I just wanted to call that out for those that might recognize that. **[0:35:44] Daniel Whitenack:** yeah, yeah, for sure. Um, I think we can't abandon our good security intuition. And especially when you start treat treating these agents as having an identity and being, uh, operating in this zero trust environment. Some of these things kind of flow through if you, if you work out those details. But um, yeah, the ne- the next category, behavioral monitoring and response, uh, or, uh, sorry, observability and a auditing, that was, that was, uh, so there there's actually these two are tied together, we could probably talk about them together. **[0:36:21] Daniel Whitenack:** There's observability, which essentially captures what agents do, so it observes what agents are doing. And you need visibility into that, so you need logging and audit trails. Often in our implementations with customers, in my day to day work, I often like to say, Hey, we need to know that. This human user using this API key triggered this agent, which has this identity to do this goal, which issued these prompts, which triggered this tool call, which had this input, which was blocked by this governance policy, et cetera. **[0:37:01] Daniel Whitenack:** Like, that's where we're, you know, and down the line, we need that kind of traceability and and logging. Otherwise, you, you can't have visibility or build rules or monitor things, so that's the observability piece, but observability captures only what agents do. The behav- behavioral monitoring that they're talking about determines whether the actions that agents are doing should be allowed or are s suspicious. **[0:37:28] Chris Benson:** Are they appropriate for what you would expect? **[0:37:32] Daniel Whitenack:** Are they appropriate? Um, that's Yes, yes, exactly. And and this is behavioral monitoring and response, right? So in certain cases, like I say, when, when, when we enforce governance policies, we say, well, if we see this, then do this, right. Um, so sometimes that's blocking certain things, sometimes it's just logging, sometimes it's, you know, alerting someone using a a particular platform. Um, okay, the the l- uh, second to the last one is input validation and output controls. **[0:38:07] Daniel Whitenack:** I think actually this one, so what are we on? One, two, three, four? This is the 5th one. This is probably the one that most often comes to people's mind, and I think is often maybe overemphasized. Uh, which is this idea that you would have point checks over, you know, harmful things that the agent could produce in its output, or harmful things that could go into the agent's context or something. This is, uh, very important, I would say, but it's kind of like table stakes. **[0:38:39] Daniel Whitenack:** The the example I usually give is, you know, is it bad for me to take my temperature if I want to be a healthy human? Well, that's not a bad thing, you know, you can take your temperature. It doesn't mean that you are plugged into a healthy lifestyle or being governed by a, you know, health records. And as part of a healthcare system, and have a primary physician and have a care plan and a diet. And, uh, it's a just a very limited way to view, um, that kind of overall health. **[0:39:11] Daniel Whitenack:** And if we extend that here, this would be these sort of point checks of validating inputs and outputs, which are, yeah, again, I would say those are table stakes. And the last one is integrity and recovery. So, uh, uh, all of this prevention and detection assumes agents operate correctly. You know, when they don't, what, what do you do? **[0:39:31] Chris Benson:** yeah. And and I think that's actually a pretty big question in the agentic systems world in that. Um, if you think about, you know, going back a couple of points to behavioral monitoring and trying to identify what's appropriate for agents to be doing. You know, within all the other security parameters that we've talked about along the way. But when, when you, when you have gotten outside the bounds of what is appropriate, trying to figure out how to roll agents back, um, especially if they're in critical functions, can be quite challenging. **[0:40:00] Chris Benson:** Um, because those critical functions still have to be addressed. And so, uh, if a critical function is compromised, uh, by an agent that is intentionally or unintentionally off the rails, then figuring out. How do you take a critical system back and get it, um, get it back to a safe place to proceed in whatever is appropriate for that function, can be quite challenging. And so, um, I've, I've, I've have, I have spent some time in that, uh, space myself. **[0:40:28] Chris Benson:** And um. And I think that there's a lot of imagination that has to go into it. That maybe wasn't quite as necessary in, um, pre agentic zero trust models. So, uh, just wanted to call that out. **[0:40:41] Daniel Whitenack:** Yeah, yeah, they talk about to to give some examples, Chris, for configuration integrity, they talk about f- on the foundational level, version controlled agent configurations, and the advanced level, immutable infrastructure with attestation f- on the recovery capabilities. They talk about at the foundation level documented rollback procedures. Which, to your point, uh, having some having an idea of what you might do is one thing, being able to actually do it is sometimes a challenging thing. At the advanced level, they talk about self healing systems with autom- automatic remediation. **[0:41:19] Daniel Whitenack:** So, um, yeah, uh, definitely agree, agree with your points there. Um, I know that we're getting to the close to the end here, Chris, and just to kind of wrap things or or get close to the end here. Uh, a. Anthropic does a good job at kind of saying, Hey, here's all of this stuff and all of these tiers and levels and categories, et cetera. But then they do provide a kind of phased, a phased way that you can think about implementing agents, which I think is helpful. **[0:41:50] Daniel Whitenack:** Um, one, identifying requirements, two, managing supply chain risks, and including they talk about AI bomb or AI build materials, defining agent boundaries, defending against prompt injection, securing tool access, protecting agent credentials, and then safeguarding agent memory. And they give some kind of specifications under each of those phases for for people to to think about. **[0:42:14] Chris Benson:** Yeah, I think, you know, as we're, as we're winding up a as they address it, I know just to share kind of how, how I perceive the the, you know, uh, kind of. Establishing the workflow is in the zero trust world that we've been in for for a number of years. It's fairly static, you know, there, there, there's a lot of things and you kind of have to tick them all off. Um, and a lot of, uh, it's a very, it's almost a regulatory approach, uh, to system development, um, and I think the thing that agentic implementations require is the is trying to anticipate, um, an incredibly dynamic, uh, capability that can arise, you know, that can, um, kind of **[0:42:54] Chris Benson:** an emergent quality, uh, that that people are doing. And I think what Anthropic has done for us is given us a way of taking what we already know in a zero trust context. And and and pointed out, you know, that within agentic systems, these capabilities, um, are, are, you? It definitely requires a level up to take the same ideas, but get them out of that static mindset and move into into a, uh, an anticipating dynamic, uh, capabilities from agents. **[0:43:22] Chris Benson:** And um, I know, as we're in B- both in our own jobs and stuff, um, that certainly r- uh, required us to kind of level up and reconsider. Um, it's, uh, it makes it for a very interesting problem set to address. **[0:43:36] Daniel Whitenack:** Yeah, yeah, and there's major thought process changes or philoso- philosophical shifts, as you're mentioning that as practitioners, we may have to make. They talk in the in the ebook, uh, Anthropic does about this idea of AI vendor. Hey, there's these fragile open source projects out here that you might rely on. The thing to do might just be to have your agentic coding system just completely vendor, or literally not not copy, but generate a new version of that project that's proprietary to you and under your control, and just include it in your project. **[0:44:14] Daniel Whitenack:** Rather than than bringing in a third party dependency. So there's like, philosophical shifts, uh, like that. I do think there's some hard things that we'll still have to wrestle with around. I I think there's still some of this conclusion that humans are gonna have to make. Containment decisions around how to contain these things, and whether it be threats in your environment or agents operating in your environment. And if things are moving so fast, I just think it's gonna be hard for humans to, you know, if if something is happening in your infrastructure. **[0:44:52] Daniel Whitenack:** And exploit timelines go from, you know, months to to hours, to minutes to seconds. You can't just like rely on waking up the CISO in the middle of the night to approve, you know, shutting this thing down, right? **[0:45:06] Chris Benson:** I mean, th- this, uh, I mean, s. This is a revolution in cybersecurity. Um, just to, just to put, um, a dot, you know, as we're finishing up here, um, every intelligence agency in the world, uh, is is learning how to, uh, both defend against and exploit these, these, uh, these potential v- v- vulnerabilities that we're talking about, uh, as well as criminal organizations of of all sizes, shapes, uh, on a global scale. So this, uh, w- you know, uh, we're g- I. **[0:45:37] Chris Benson:** I think we're at the very beginning of this journey. Um, I think this is a fantastic start, um, to get us thinking. I think we're gonna see a lot more tooling and a lot more capabilities, uh, coming out, uh, in the days ahead, uh, and it seems to be coming out very quickly, uh, because the threats, uh, have risen very quickly. And so I hope folks find this as useful as we did, uh, in terms of kind of reframing this modern take on cyber, uh, in our, in this agentic world that we've been talking about nonstop, uh, throughout this this last year. **[0:46:07] Daniel Whitenack:** And we'll, we'll, like I say, include the links in the show notes, so take a look at those and excited to excited to keep the conversation going. Thanks, thanks for this today, Chris. **[0:46:17] Chris Benson:** Yeah, th- thanks for taking us through it. It was a good, good, good, uh, exercise to do. **[0:46:26] Ad read:** All right, that's our show for this week. If you haven't checked out our website, head to practicalai. fm and be sure to connect with us on LinkedIn X or Bluesky. You'll see us posting insights related to the latest AI developments, and we would love for you to join the conversation. Thanks to our partner Prediction Guard for providing operational support for the show. Check them out at predictionguard. com. Also, thanks to Breakmaster Cylinder for the beats and to you for listening. **[0:46:53] Ad read:** That's all for now, but you'll hear from us again next week.