Max Pollard, CEO and co-founder of Cotool, joins us to talk about what it actually takes to let blue teams respond at machine speed. Cotool builds agents for detection and response, and Max walks through the crawl, walk, run progression his customers follow: start read only, route every consequential action to a human through an approval hook in Slack or Teams, count how often the agent was right, and only then loosen the leash. His honest read is that very few teams reach the run phase, because humans can't trust agents enough to take themselves out of the loop. We get into why the real blocker is less about trusting the model and more about data annotation, and whether the agent knows at runtime that the server it is about to contain powers a million dollars a day in transactions. Max also covers how Cotool scopes agents at the API endpoint level at config time, why the audit log has to record that an agent acted and on whose behalf even when no human prompted it, and how his team evaluates cost efficiency, instruction adherence, and behavior across 20, 30, or 40 agents running in production.

Every security leader knows that developers will work around security tooling when they can if it gets in the way of their job. The truth is, employees don't get paid to be secure; they get paid to do their job.

Joel de la Garza, partner on the infrastructure team at a16z and former CISO of Box, tells us that the moment security gets in the way of what people want to do, security loses.

For a lot of teams, this has meant tolerating uncomfortable security gaps to get the value agents can bring. At Keycard, we call the underlying bind the trilemma of autonomy, capability, and security: teams can only pick two.

Joel walks through what securing agents looks like in practice, from a consumer agent logging into an auction site through a browser with every alarm bell ringing to a16z's own coding agents opening tunnels out to Cloudflare to route around egress controls in a secured GCP cluster.

We get into why least privilege and agent performance pull against each other, and why some of security's first principles have to be rethought rather than reasserted. We also talk about the pressure CISOs face as they're expected to say yes to agents and lead the agent rollout.

Joel also shares his love for Grok Bot and the need for model providers to give blue teams the same advantages attackers now have.

Most people that architect an AI agent think to ask a binary question: is this tool call allowed, yes or no? Michael Davis, Global Chief Security Architect at J.P. Morgan, argues it's never that simple.

He walks through the four dimensions robotics uses to decide whether it is safe for an arm to move (the state of the system, the state of the environment, the quality of the decision-making, and the uncertainty of the action itself) and maps each one to agents: did the agent gain tools or network connections it did not have before, is it still moving semantically toward its goal after 30 tool calls, and what has the agent already tried.

We get into why  if you think you need memory, you're probably not thinking of your problem the right way. We also explore software factories and why they need to operate as a  cumulative progressive process versus a one shot of go build me this SaaS. Over the course of the episode we piece together what a good reference architecture for agents could look like.

Jet Anderson, is a Distinguished Engineer at GEICO and leads the transformation of their product security function. He joins us to discuss the agentic SDLC and why most of what security teams do has to change while the first principles should stay the same.

We get into why static analysis and human triage no longer keep pace when models write the code, why we need new AI infrastructure, and why the Hugging Face sandbox escape was a decade-old Kubernetes misconfiguration found at machine speed.

Jet tell us the story of when he asked his own agent to "wrap this up" and it merged the PR and did an unauthorized production deploy. He walks through the pre-commit hooks and branch protections he built to prevent this from happening again so that deploys still get an approval gate and an audit trail.

He also explains why teams that skip ideation, design, and specification to go straight to code end up with less secure software the more they iterate, and why the unglamorous answer is doubling down on least privilege, egress control, and build containment.

Travis McPeak, security lead at Cursor, joined us at Black Hat to talk about what causes coding agents to become problematic and what he's done to keep them on track.

What he sees most is the main agent trying hard to solve your problem, getting stuck, and then getting creative. He calls it thrash, and most of the time when somebody says an agent deleted their database, that is what happened.

This episode gets into why static controls like block lists and WAFs break down against an agent whose whole job is to find a way through, why an agent can't monitor itself, and how Cursor's auto review agent works: every tool call the main agent is about to make goes to a separate reviewer that does not care about the main goal at all and only enforces its rules.

Travis also explains why the team had to carefully word the feedback so the main agent would not spiral, why blocking an action can cause the exact thrash you were trying to prevent, and why least privilege finally scales now thanks to new solutions.

Alissa Abdullah, PhD ("Dr. Jay"), Deputy Chief Security Officer at Mastercard, and Arjun Ramakrishnan, Senior Principal Cybersecurity Architect at Mastercard, join us live from Black Hat to explain why access models built for humans start to break when agents act on their behalf.You can't provision access for an agent the same way you provision it for an employee, and just-in-time authorization takes on a new meaning when the consumer operates at machine speed. Dr. Jay and Arjun explain why every tool call and action needs to be authorized, why that's difficult to enforce, and what security teams need when an agent goes rogue, including the ability to revoke access instantly through a button or API call.We also get into Mastercard's three-layer framing of security for AI, from AI, and with AI, and why agent governance needs to move from periodic review to real-time enforcement.

Allie Howe sits down at Black Hat with Aaron Stanley, former CISO at dbt Labs, and Ahmad Nassri, CTO at Socket, to sketch the first draft of a reference architecture for securing software factories.

In the last year there's been considerable advancements that makes now the largest inflection point for software factories. Model vision has improved allowing them to see and verify work they couldn't before. Agents now have access to far richer tool ecosystems and live data, enabling them to work across real production environments. Context windows have gotten larger and reasoning models have improved helping the model think through more sophisticated tasks.

All of those advancements come together now. The race to build a software factory is on, and teams are struggling with how to harness the power of these models while retaining control.

We explore the missing security model for software factories and what the components of a secure reference architecture could look like. We get into the Andon cord problem (can an agent recognize it has been blocked and stop, instead of innovating around the constraint), why the factory cannot have a human's identity and needs purposeful authentication and authorization of its own, why the enforcement boundary has to sit outside the agent loop rather than inside it, and why a single poisoned dependency in a factory is an incident in every work tree at machine speed. Aaron and Ahmad dive deep into supply chain, agent identity, verification, and how to handle what Aaron calls the pernicious problem: a goal seeking agent circumventing constraints to accomplish a task.

An autonomous agent spent days inside Hugging Face production infrastructure and the headline was that it escaped its sandbox. Luke Hinds, founder of nolabs and creator of Sigstore, frames it differently. The agent had root on the execution environment, and "a sandbox is only as strong as the access that you grant to it."

Luke walks us through what it looks like to create an environment where agents have both security and capability. He tells us you can't just lock an agent in a box. If you want the agent to do real work you'll need to delegate some authority to it and give it access to real tools and data.

Luke goes over the three sandbox categories buyers are choosing between today (serverless execution, host isolation microVMs like Firecracker and gVisor, and the fine-grain capability-based approach he is building), and outlines where each one's threat model starts and stops.

Luke explains what nono could have done to prevent the Hugging Face attack, including gating the C compilers the agent leaned on. His parting advice to us is defense in depth, and never let perfect be the enemy of good.