low
Interview: KloudStax CTO outlines identity, credential and network controls for securing AI coding agents
1 fonte(s)
·
1 atualização(ões)
·
publicado 02/11/2026 03:30
·
coletado há 1 hora
In a Help Net Security interview, Vinay Thakker, CTO of KloudStax, sets out practical guardrails for deploying AI agents. He recommends that agents run under their own identity, with the requesting person's identity attached when acting on their behalf, rather than borrowing user logins. He advises against long-lived secrets, favouring short-lived, call-scoped credentials attached by a proxy, and warns that proxies concentrate authority and become confused deputies if poorly designed. The piece is guidance, not a report of a specific incident.
Detalhes técnicos
- Identity: the agent gets its own identity; user-delegated tasks carry both identities so effective permissions are the intersection. Separate permission to propose a change from permission to apply it.
- Credentials: avoid long-lived secrets; use proxies that verify agent identity and mint short-lived scoped tokens; bind tokens to the requesting machine or container; watch for refresh tokens stored next to tokens; avoid a shared credential behind the proxy and a vault on the same host as the agent.
- Ten-line command policy: a disposable single-repo workspace, an allowlist of approved commands, no credentials in the environment, blocked secret files (.env, SSH keys, cloud credential files), network off except an internal mirror and named hosts, packages only from an internal artifact repository, commits only to its own branch with PRs, human approval for infrastructure or data changes, no privilege escalation or self-modification of policy, and full logging with a spend/runtime cap. Branch protection, firewall rules and identity controls should be enforced outside the agent.
- Exfiltration: the risky combination is private data, untrusted content and an outbound path. Deny network by default, list exact hosts, and use internal artifact repositories. URL query strings to approved hosts remain hard to stop at the network layer, so require human approval for outbound data or consequential actions after the agent reads untrusted content.
- Red teaming: test the system around the model, assume prompt injection eventually succeeds, and automate known-path tests whenever a tool or connector is added. Tabletops should rehearse quiet, staged data leakage rather than loud cost-overrun incidents (he cites agents on one engineer's account spending about $500,000 in roughly 36 hours).
Remediação
- Run agents under dedicated identities with least privilege and logs showing both agent and user.
- Use short-lived, call-scoped credentials via an allowlisted, per-agent proxy.
- Enforce policy in the harness, version control, firewall and identity system.
- After an incident, clean everything the agent can write to (memory, shared config files, reply templates), not only revoke credentials.
Linha do tempo
-
Interview: KloudStax CTO outlines identity, credential and network controls for securing AI coding agents
ler a análise desta fonte ocultar
In a Help Net Security interview, Vinay Thakker, CTO of KloudStax, sets out practical guardrails for deploying AI agents. He recommends that agents run under their own identity, with the requesting person's identity attached when acting on their behalf, rather than borrowing user logins. He advises against long-lived secrets, favouring short-lived, call-scoped credentials attached by a proxy, and warns that proxies concentrate authority and become confused deputies if poorly designed. The piece is guidance, not a report of a specific incident.
Technical Details
- Identity: the agent gets its own identity; user-delegated tasks carry both identities so effective permissions are the intersection. Separate permission to propose a change from permission to apply it.
- Credentials: avoid long-lived secrets; use proxies that verify agent identity and mint short-lived scoped tokens; bind tokens to the requesting machine or container; watch for refresh tokens stored next to tokens; avoid a shared credential behind the proxy and a vault on the same host as the agent.
- Ten-line command policy: a disposable single-repo workspace, an allowlist of approved commands, no credentials in the environment, blocked secret files (.env, SSH keys, cloud credential files), network off except an internal mirror and named hosts, packages only from an internal artifact repository, commits only to its own branch with PRs, human approval for infrastructure or data changes, no privilege escalation or self-modification of policy, and full logging with a spend/runtime cap. Branch protection, firewall rules and identity controls should be enforced outside the agent.
- Exfiltration: the risky combination is private data, untrusted content and an outbound path. Deny network by default, list exact hosts, and use internal artifact repositories. URL query strings to approved hosts remain hard to stop at the network layer, so require human approval for outbound data or consequential actions after the agent reads untrusted content.
- Red teaming: test the system around the model, assume prompt injection eventually succeeds, and automate known-path tests whenever a tool or connector is added. Tabletops should rehearse quiet, staged data leakage rather than loud cost-overrun incidents (he cites agents on one engineer's account spending about $500,000 in roughly 36 hours).
Remediation
- Run agents under dedicated identities with least privilege and logs showing both agent and user.
- Use short-lived, call-scoped credentials via an allowlisted, per-agent proxy.
- Enforce policy in the harness, version control, firewall and identity system.
- After an incident, clean everything the agent can write to (memory, shared config files, reply templates), not only revoke credentials.