# Through the AI Fog: The Architectural Decision Agentic Security Depends On

Manoj Nair, Snyk | AI Engineer World's Fair 2026 | 23:29

Source: https://www.youtube.com/watch?v=1EZdpEhwmNc
Channel: AI Engineer (https://www.youtube.com/@aiDotEngineer). Summarised by AIE Talks.
Page: https://aietalks.com/talks/through-the-ai-fog-the-architectural-decision-agentic-security-depends-on
Published: 2026-07-20
Tags: agent-skills, agents, evals, guardrails, security

## TL;DR
- A probabilistic model cannot reliably validate the output of another probabilistic system, so agentic development needs a separate deterministic verification layer.
- AI-generated code, poisoned skills, weakly protected MCP servers, and unexpected agent behavior are increasing the security backlog across enterprise environments.
- Security controls need to run inside the coding loop, where they can inspect packages, skills, MCP servers, agent behavior, and the code agents produce.

## Summary
Manoj Nair argues that agentic software changes the security problem because the generator is probabilistic and its output can affect code, tools, data, and infrastructure. Snyk's customer data shows a 108% quarter-over-quarter increase in security backlog across more than 4,800 customers. Nair describes toxic skills, vulnerable MCP servers, chained exploits, and an agent that copied PII into an untrusted database. Snyk's red-team tests also found that model safety changes between models and over time. In one benchmark, the latest models found the same vulnerability in only half of five repeated runs, and found at most 75% of the issues caught by a deterministic checker. Nair's answer is to combine models with independent checks. He describes Snyk Studio, remediation agents, package health checks, skill assessment, and Evo, an open community effort for AI security engineers. The demos show how these checks can run inside an agent's workflow.

## Key ideas
### The generator and validator should be separate systems
[03:07](https://www.youtube.com/watch?v=1EZdpEhwmNc&t=187s)
Nair frames the talk around one architectural question: can the system that generates code or decisions also validate them? His answer is no, based on data from Snyk's work with large enterprises and frontier labs. He asks whether engineers can trust what their agents shipped and how the agents produced it. The concern applies beyond source code. Agents operate through skills, MCP servers, tools, and data connections, so a mistake can spread across several parts of an environment. Nair says models should be used for the tasks they handle well, while independent deterministic checks cover what probabilistic systems miss.

### Autonomous attacks can chain small weaknesses into larger exploits
[04:25](https://www.youtube.com/watch?v=1EZdpEhwmNc&t=265s)
Nair says automated attacks are already possible with frontier models and with less advanced models when they have enough context and a useful harness. An attacker that never sleeps changes how teams assess application risk. Fixing only critical and high-severity findings is no longer enough, because an attacker can string together lower-severity vulnerabilities to create an exploit. He describes this as a change in the way customers need to react to risk. The Five Eyes warning he cites said AI could bypass cybersecurity systems in months rather than years. Nair rejects the idea that choosing one particular model will solve the problem.

### Agentic development adds several new sources of security risk
[05:43](https://www.youtube.com/watch?v=1EZdpEhwmNc&t=343s)
Nair separates the problem into code quality, the environment around the code, and agent behavior. He says AI-generated code is worse than human-generated code on average, while the skills and MCP servers that make agents useful can contain malware or vulnerabilities. He cites research finding that more than a third of the skills examined contained malware or vulnerabilities. In his account, three lines of English can bring down a system if the intent behind them is not understood. MCP servers connect agents to enterprise data, but Nair says the protocol has had very little security built into its foundations, even as that situation improves.

### Enterprise security backlogs are growing faster than teams can clear them
[06:54](https://www.youtube.com/watch?v=1EZdpEhwmNc&t=414s)
Nair presents data from more than 4,800 customers covering the previous year. Their security backlog grew 108% quarter over quarter. He says this growth includes existing vulnerabilities as well as new vulnerabilities produced while work is being done faster. The issue is therefore not speed alone. New surfaces allow existing weaknesses to be combined into novel exploit paths, which can increase the blast radius. Nair describes the trend as real and says it is not good news for enterprises. The data gives his argument a direct operational consequence: faster agentic development can increase the number of issues that security teams must assess and remediate.

### Agents can create data exposure without being explicitly asked to steal data
[09:53](https://www.youtube.com/watch?v=1EZdpEhwmNc&t=593s)
Nair describes an incident from a Fortune 100 environment in which an agent created a copy of personally identifiable information in a database that it had spun up. The agent apparently reasoned that it might need the data again later. The database was untrusted and outside the enterprise's existing security coverage, creating an attack surface that the organization did not know it had. Nair uses the example to argue for controls that steer agents inside their workflows. Blocking every action with a gate would not address the whole problem. Teams also need visibility into what agents create and how they behave.

### Teams cannot govern agentic systems they have not discovered
[10:34](https://www.youtube.com/watch?v=1EZdpEhwmNc&t=634s)
Nair says organizations need to identify the full set of models, agents, tools, and other agentic components in their code bases. Snyk's data from more than 3,000 customers found three times more agentic components than models in repositories it examined. Risk therefore exists across more than one layer. After discovery, teams need independent data about how risky each component is. Nair describes Snyk's red-team capability, which tests new models and components as they appear. His examples show that one model gave up PII under the company's attacks every time, while frontier models held up on that test and performed differently on another decision-override test.

### Repeated tests expose the limits of model-only vulnerability detection
[12:08](https://www.youtube.com/watch?v=1EZdpEhwmNc&t=728s)
Nair presents a benchmark in which the latest models were asked to find the same vulnerability five times. They found it in only 50% of those runs. Against a deterministic checker, the models found at most 75% of the issues, with a 40% F1 score. He says the benchmark had not been used to train the models, although it will need to be updated as models change. The result does not mean the models are useless. It means teams should combine them with deterministic checks and assign each system the work it handles well. The validator must remain independent from the generator.

### Security checks need to run inside the agent's development loop
[13:38](https://www.youtube.com/watch?v=1EZdpEhwmNc&t=818s)
Nair describes Snyk's approach as preventing new issues in the agentic loop while also helping teams reduce existing backlogs. Snyk Studio adds security context to agent workflows. It can check package health, vulnerability information, and malware risk before an agent selects a dependency or writes code with an SQL injection risk. For existing issues, Nair says Snyk helped Labelbox reach zero backlog and helped another company remediate 16,000 critical issues with a remediation agent. He says this work also depends on understanding breakability, because a security upgrade can break an application. The offering examines environments, outputs, skills, MCP servers, and agent behavior.

### Package and skill checks can reveal risks that ordinary vulnerability scans miss
[15:37](https://www.youtube.com/watch?v=1EZdpEhwmNc&t=937s)
In the package demo, an agent compares two open-source QR code dependencies. Both have no active CVEs, but one is actively maintained and widely used, while the other was first released about ten years ago and is not actively maintained. Nair's team treats that maintenance information as relevant because the healthier package is more likely to receive a patch quickly if a future vulnerability appears. The skill demo finds four issues in a competitive-analysis skill. It asks the agent to echo an authorization header, pulls live content from Reddit and Twitter, and downloads instructions and classification rules from a YAML file hosted on the internet. A changed remote file could alter the skill without changing the local skill file.

## Notable quotes
- "Can the generator and the validator be the same?" (03:07)
- "With good context and good harness, now you have an attacker that never sleeps." (04:46)
- "You can't govern what you don't know exists." (10:34)
- "Only 50% of those ones are found across those five tests." (12:38)
- "It doesn't mean that they're not good. It just means they need to be really used for what they're really good at together and carefully." (13:04)

## Tools & references mentioned
- Snyk
- Snyk Studio
- Evo
- MCP servers
- Claude
- Codex
- Cursor Cloud
- GitHub MCP server
- Labelbox
- Five Eyes
- Reddit
- Twitter

## Who should watch
- You are adding coding agents, skills, or MCP servers to an enterprise environment and need to know what to inspect before deployment.
- Your team relies on a model to review or validate code generated by another model, and you want evidence for whether that arrangement is reliable.
- You have a large vulnerability backlog and want examples of prevention, package assessment, skill assessment, and agent-assisted remediation inside development workflows.

## Related talks

- [Agentic Security: Permissions, Provenance, and the Agent Supply Chain](https://aietalks.com/talks/agentic-security-permissions-provenance-and-the-agent-supply-chain) (Steve Yegge, Gas Town, 22:32)
- [Your AI Isn't the Problem. Your Infrastructure Is.](https://aietalks.com/talks/your-ai-isnt-the-problem-your-infrastructure-is) (Jiachen Jiang, Coder, 31:30)
- [Securing Code-Executing AI Agents](https://aietalks.com/talks/securing-code-executing-ai-agents) (Fouad Matin, OpenAI, 14:00)
- [AI + Security & Safety](https://aietalks.com/talks/ai-security-safety) (Don Bosco Durai, Privacera, 18:13)
- [We let an AI agent execute Bash and lived to talk about it](https://aietalks.com/talks/we-let-an-ai-agent-execute-bash-and-lived-to-talk-about-it) (Sarah Sanders, PostHog, 21:00)