Security in the Age of AI: Recent Attacks, Incidents & Defenses#

Andrey Rybka (Bloomberg, Head of Architecture & Emerging Technologies, Office of the CTO)

• Why: The best-organized agent-security talk here, and it lands squarely in the PM's wheelhouse: its controls are classic infrastructure security disciplines (identity, egress, DNS, tenancy, supply chain) applied to agents, with concrete incident anatomy for each.
• What: A layered defense taxonomy — identity, input, tool governance, execution isolation, data protection, governance — each motivated by a real incident: a chat agent social-engineered into revealing a long-lived OAuth token (700+ companies' CRM data exported); a low-privilege agent recruiting a higher-privilege agent via prompt injection; hidden white-on-white email instructions causing zero-click exfiltration; a CLI supply-chain prompt that attempted to wipe machines (saved by a typo); Morse-code-encoded instructions stealing 3B tokens; a sandbox with no web access still leaking data through DNS lookups; an MCP server returning other customers' data for months; a poisoned package adding a BCC recipient after 15 clean releases; and an agent that acknowledged a code freeze, thumbs-up, then dropped the production database.
• How: The proposed controls are deterministic and outside the model: one agent, one short-lived scoped workload identity (no shared keys); agent-to-agent mutual authentication with delegation checked against mission and allowed tools; provenance tagging so retrieved content stays data; a deterministic invocation broker between agent and tools evaluating tool/parameters/identity/approval; Meta's "rule of two" (untrusted input + sensitive data + external action requires human sign-off); default-deny egress including DNS; tenant isolation checked on every query (the AWS-account/GCP-project analogy); memory-integrity checks and fresh execution environments for planted sleeper instructions; budgets that halt rather than alert; supply-chain delay-ingest. The closing move: write these into the same spec as the feature, so each becomes a test or CI policy check.
• Where applicable: General and largely standards-based (the controls map to existing identity and network practice); the incidents are retold examples rather than attributable disclosures. Directly actionable for anyone operating agents with production access.