On LinkedIn
AI agents need a whole new security playbook.
That’s what I expected at the SANS Community Night in Amsterdam this week.
I came home with two very old problems instead.
Luca Cipriano invited me back, like old times, hauling his trademark backpack: impossibly heavy, holding whatever a human or a hacker could ever need. Old faces too, including folks from the Dutch Tax Administration I’d met at WHY2025, doing seriously cool work. A good catch-up with Dennis Hazewinkel. Talks by Rob van der Veer on AI security standards and Jean-François Maes on building offensive tooling with LLMs. Really, really fun.
Problem one: what does it know? After all this time, context management still weighs heaviest. Skills, harnesses, MCP servers: strip the branding off and nearly all of it exists to get the right context to the model at the right moment. A million-token window is not a million tokens remembered. And whatever it does read, it can leak. Or obey.
Problem two: what may it touch? Jean-François put it better than most vendor decks: treat every agent like an insider you hired yesterday. Scoped access, a human who says yes before money or production moves, and a log of everything it did. None of that is new. The insider is.
The room also agreed, loudly: even the vetted AI tools for red and blue teaming keep refusing. Grok doesn’t. Grok is unhinged. One model blocks your pentest, the other blocks nothing. So the guardrails can’t live in the model. Your new insider might not have any.
Your newest colleague started yesterday and has already read everything. In your shop, what’s the first thing you’d take away from it?
Credit where it’s due: Rob van der Veer (SIG) on the OWASP AI Exchange, the open framework feeding the EU AI Act security standards, and Jean-François Maes on building offensive tooling with LLMs. Thanks SANS for hosting.
Free and worth a look: the OWASP AI Exchange. Start with its threat advisor.
On “a million tokens is not a million tokens remembered”: see Liu et al., Lost in the Middle.
For the doers: pick one agent you run, list every token, API and mailbox it can reach, and cut one today. It won’t complain. That’s the problem.