# Security for agents A pack of 10 talks from the AI Engineer YouTube channel, in the order to watch them. 3h 37m of video. Page: https://aietalks.com/packs/security An agent can return a reassuring answer after it has already leaked a credential, crossed into another user's data or deleted something real. The threat model becomes concrete in Casco's security test of 16 public YC agents. The controls follow the paths those attacks used. Sandboxes isolate execution; default-deny capabilities limit what code can reach; credential and network gateways keep secrets outside the agent while enforcing policy on its traffic. OAuth and production MCP design add identity and scoped authorization once the runtime boundary is sound. Another risk arrives before execution: coding agents can invent dependencies, while shared skills can carry dangerous instructions or permissions. Generated code and agent components therefore need a separate security review before anyone runs them. ## This pack is for you if - Your agent can run code, call internal APIs or touch customer data. - You put credentials inside a sandbox and are no longer sure what the boundary protects. - Your team shares MCP servers, skills or generated dependencies without a security gate. ## The talks, in order ### 1. I've Never Seen Anything Scarier Than an LLM with Tool Calls Erik Meijer, LiveNet Labs | 21:13 | AI Engineer World's Fair 2026 Video: https://www.youtube.com/watch?v=-CnA2lGfymY Summary: https://aietalks.com/talks/ive-never-seen-anything-scarier-than-an-llm-with-tool-calls.md Why start here: Meijer gives the pack its threat model: tool calls give a model claws, while private data and untrusted input complete the lethal trifecta. Brandel follows with what those abstract ingredients look like in systems people had already shipped. ### 2. How We Hacked YC Spring 2025 Batch's AI Agents Rene Brandel, Casco | 17:33 | AI Engineer World's Fair 2025 Video: https://www.youtube.com/watch?v=kv-QAuKWllQ Summary: https://aietalks.com/talks/how-we-hacked-yc-spring-2025-batchs-ai-agents.md Why here: Meijer warns that unsafe actions can hide behind a safe-looking answer. Brandel finds the ordinary routes to those actions: cross-user ID traversal and an SSRF request that leaks repository credentials. Matin comes next because both attacks get worse when the agent can execute code or reach the network freely. ### 3. Securing Code-Executing AI Agents Fouad Matin, OpenAI | 14:00 | AI Engineer World's Fair 2025 Video: https://www.youtube.com/watch?v=w7IMuYsBNr8 Summary: https://aietalks.com/talks/securing-code-executing-ai-agents.md Why here: Brandel shows custom execution environments exposing the infrastructure around them. Matin answers with an agent's own isolated computer and strict network access, then Agrawal makes those two controls concrete by asking exactly which capabilities the code needs. ### 4. Why, and how you need to sandbox AI-Generated Code? Harshil Agrawal, Cloudflare | 38:27 | AI Engineer Europe 2026 Video: https://www.youtube.com/watch?v=AHtGAgQ0Q_Q Summary: https://aietalks.com/talks/why-and-how-you-need-to-sandbox-ai-generated-code.md Why here: Matin establishes the sandbox and network restriction as system-level controls. Agrawal supplies the operating rule: enumerate what to allow and keep every real secret outside the sandbox. Guercio then shows how a network gateway can provide the missing access without handing the credential back to the agent. ### 5. What if the network was the sandbox? Remy Guercio, Tailscale | 24:29 | AI Engineer Europe 2026 Video: https://www.youtube.com/watch?v=BM2JX9hqsVQ Summary: https://aietalks.com/talks/what-if-the-network-was-the-sandbox.md Why here: Agrawal keeps secrets in the host and proxies the calls that need them. Guercio moves that idea to an identity-aware network gateway, where every request can be seen and limited. Dahl follows because HTTP and model traffic are not the only routes out of an agent. ### 6. Security Firewall for Agents Ryan Dahl, Deno | 19:06 | AI Engineer World's Fair 2026 Video: https://www.youtube.com/watch?v=MkRYPFIMCSA Summary: https://aietalks.com/talks/security-firewall-for-agents.md Why here: Guercio controls credentials and observes requests at an LLM gateway. Dahl drops the policy below HTTP, where it can catch a psql subprocess trying to delete a table on the wire. Hanson comes next to explain how legitimate access should be issued and carried once the dangerous routes are blocked. ### 7. How to Secure Agents using OAuth Jared Hanson, Keycard | 18:59 | AI Engineer World's Fair 2025 Video: https://www.youtube.com/watch?v=blmAkayzE8M Summary: https://aietalks.com/talks/how-to-secure-agents-using-oauth.md Why here: Dahl keeps credentials outside the agent and enforces what each connection may do. Hanson supplies the authorization model behind that boundary, replacing static keys with scoped tokens that follow a chain of services. Shwe and Frenay then apply the same problem to an MCP server headed for production. ### 8. Your Insecure MCP Server Won't Survive Production Tun Shwe & Jeremy Frenay, Lenses.io | 24:34 | AI Engineer Europe 2026 Video: https://www.youtube.com/watch?v=BurJvbqFr4c Summary: https://aietalks.com/talks/your-insecure-mcp-server-wont-survive-production.md Why here: Hanson explains the OAuth roles and the chain of authorization between agents and services. Shwe and Frenay show why that is necessary but insufficient for MCP: every exposed tool is another door, and long-lived keys can turn the server into a confused deputy. Yegge widens the security review from services to generated code and its dependencies. ### 9. Agentic Security: Permissions, Provenance, and the Agent Supply Chain Steve Yegge, Gas Town | 22:32 | AI Engineer World's Fair 2026 Video: https://www.youtube.com/watch?v=yWS0udrIOc8 Summary: https://aietalks.com/talks/agentic-security-permissions-provenance-and-the-agent-supply-chain.md Why here: Shwe and Frenay reduce what an MCP server exposes and control who may call it. Yegge turns to what the coding agent pulls in, including invented package names that attackers can register, and argues that security needs its own pass. Palma ends the pack with a working review gate for one fast-growing class of dependencies. ### 10. We Vetted 2,000 AI Skills Before They Reached Developers Lucas Palma, Nubank | 16:24 | AI Engineer World's Fair 2026 Video: https://www.youtube.com/watch?v=iKQ78wyJEXU Summary: https://aietalks.com/talks/we-vetted-2-000-ai-skills-before-they-reached-developers.md Why end here: Yegge asks teams to give security a separate pass over generated code and dependencies. Palma shows the institutional version: treat shared skills as dependencies, scan them deterministically and in context, then stop serious findings before they reach the marketplace. The pack ends with a gate a real organization has already put into use. ## Editor's note Guercio wants every request visible, while Palma sends findings into an existing security process. Both depend on evidence from a specific run rather than the agent's account of what happened. Kitaru records agent runs so a team can inspect and replay the sequence that reached a dangerous tool call, including the inputs and tool results around it. Written by the AIE Talks editors (the Kitaru team), not by any of the speakers.