Sergey Burykin, Senior Software Engineer on Uber's AI Security team, joins us to explain the agent identity crisis and how Uber solved it while running roughly 1,000 agents in production.

Sergey helped write Uber's article "Solving the Identity Crisis for AI Agents," and his core argument is that an agent should be authorized on the intersection of user permissions and agent permissions, never just one. Use only the user's permissions and a hallucinating agent can make calls the user never intended. Use only the agent's identity and any user who reaches the agent inherits access to sensitive business and customer data.

We get into the infrastructure Uber built to enforce that (a secure token exchange service and an MCP Gateway as the policy enforcement point), why AI security depends on identity, authorization, runtime guardrails, and observability, and why static OAuth scopes break for non-deterministic agents that need dynamic, least-privilege access.

Manoj Nair, CTO and Chief Innovation Officer at Snyk, joins us at Snyk HQ during AI Engineer World's Fair to discuss the architectural decision he argues the next 24 months of agentic security depend on: the generator cannot be the validator.

We get into why "the fox guarding the henhouse" is suddenly a live security question ("I can use AI to secure AI, so do I still need a separate security offering?"), why finding vulnerabilities was never the hard part and fixing them safely inside the loop is, and why securing at inception means combining independent models with deterministic data and security research rather than just pointing one model at your codebase.

Manoj also walks through Snyk's Evo, an agentic security orchestrator built on the fighter-pilot OODA loop that turns a security engineer into a 10X AI security operator, why the agents' own supply chain (the MCP servers and skills they pull at runtime) is now its own attack surface, and why he sees security as the throttle, not the brake.

Diana Kelley, CISO at Noma, has spent years on the front lines of enterprise security across IBM, Symantec, and Microsoft, and now she is helping write the rulebook for the agent era. She joins us to make the case that the cloud shared responsibility model does not translate to AI.

In the cloud there were roughly two responsible parties and your data was always your data. With agents there are at least three, the frontier model provider, the platform or developer building on it, and the user, and the trust boundary has moved from storage to decision-making and action.

We open on the PocketOS incident, where a coding agent used an over-scoped Railway token to delete a production database and its backups in nine seconds, and use it to trace where responsibility actually lives.

Diana then walks through AARM, the runtime security specification she co-chairs at the Cloud Security Alliance, why authorization needs five decisions instead of two (allow, deny, modify, step-up, and defer), how much context an agent can actually trust, and why the most useful question a CISO can ask a vendor is not "where does your responsibility end" but "can you sit down and explain how you threat modeled this."

AAuth Night: Moving Beyond OAuth was an AI Engineer Side Event during World's Fair on July 1st 2026.

We explored the challenges with agent auth today, the best practices available today, and future solutions such as new protocols like AAuth that are in the works.

OAuth, JWTs, and API keys were built for humans and servers, not agents that act on your behalf, chain tasks across tools, and decide what they need at runtime. As AI engineers are shipping agents into production they begin to feel the problems with agent auth and identity today. Consent fatigue, credential management, and agent alignment start to show up and create friction.

This panel explores the problems with agent auth today, how we are updating OAuth to be better for agents with grants like ID-JAG, and why we ultimately need to build a new protocol for agents (AAuth).

This panel was recorded at AAuth Night: Moving Beyond OAuth, an AI Engineer side event on July 1st, 2026 and brings together four people rebuilding auth for agents: Dick Hardt, founder of AAuth and OAuth, Karl McGuinness, identity expert and past Chief Product Architect at Okta, Ian Livingstone, co-founder and CEO of Keycard, and Herman Errico, founder of AARM.

Guy Podjarny built Snyk into the company that taught developers to secure their dependencies. Now, with Tessl, he argues that agent skills have become a new unit of software, one that deserves the same rigor we give source code. Guy Podjarny, founder of Tessl and Snyk, joins us to explain why skills are the new code: context is the only layer that runs straight inside the model's reasoning loop, so it is effectively the programming language for models. We get into the new supply chain that follows (there are already 2 million skills in the open ecosystem, up from near zero last September), why a malicious or negligent skill is so hard to catch, why there's still no npm or PyPI for skills, and why enforcement is moving into the harness because the model cannot police its own context. Guy also makes the case that skills rot, so a skill you write today can be useless or harmful three months from now without a plan to maintain it.

Every SaaS app an enterprise connects to stands up its own OAuth stack of long-lived grants the enterprise can't see or revoke. Karl McGuinness, author of ID-JAG and past Chief Product Architect at Okta, calls these "OAuth islands," and agents turn them from a nuisance into a serious risk. He joins us to explain OAuth federation, how ID-JAG shipped inside Anthropic's Enterprise Managed Auth for Claude, and what it really takes to govern agent access from one central checkpoint.

This is one of the best public internal AI stories we've seen, built by just a few engineers. Derek Meegan, a software engineer at Browserbase and the lead behind their internal AI agent, bb, joins us to explain how bb took feature-request coverage to 100% with zero human effort, got 99% of support first responses under 24 hours, and turned 30 to 60 minutes of manual log-diving into a single Slack message.

Then we get into the part most teams skip: the security model that lets you actually trust an agent with that much reach.

Derek covers code mode, the sandbox that never touches a secret, credentials brokered just-in-time through an integration proxy, least-privilege tools on every event-driven trajectory, and permissions computed per invocation instead of written into a static config.

His thesis: use the agent to take the repetitive, well-understood work off people's plates, and make the harness verifiably secure, because security is what lets you scale it.