AI agents need identity-first security, not better sandboxes

The security claim. Andrey Rybka argues that most teams focus on sandboxing AI agents, while the real threat vector is identity and credential management. He presents a layered defense framework built around six pillars: identity and trust, prompt and input defense, tool and action governance, execution isolation, data protection, and governance observability. The core thread is that agents are useful only when they have broad reach, and that reach creates a blast radius that traditional security tooling cannot manage.

Real incidents, not theory. The talk is grounded in specific attacks that have already happened. A chat agent was social-engineered into revealing a long-lived OAuth token, leading to CRM data exfiltration across 700 companies. A low-privilege agent was prompted to recruit a higher-privilege agent, escalating access. Hidden instructions in white-on-white email text bypassed human readers entirely. Morse code instructions bypassed guardrails and drained 3 billion tokens from a wallet. DNS exfiltration worked despite a sandbox because DNS lookups were not blocked.

The identity-first shift. The most counterintuitive claim is that identity management matters more than sandboxing. Rybka advocates for one agent, one identity, with short-lived scoped credentials and no shared keys. This is a departure from how most organizations handle service accounts today. The recommendation includes agent-to-agent mutual authentication to prevent privilege escalation through agent recruitment, which is a novel attack vector most teams have not considered.

The governance gap. Tool and action governance is presented as a deterministic layer that sits outside the model. An invocation broker should check every call, log it, and enforce rate limits and budgets. Rybka illustrates this with a CLI agent that was prompted to wipe machines, stopped only by a typo. He recommends human sign-off for any call that combines untrusted input, sensitive data, and external action—a heuristic he calls the rule of two.

The execution isolation trap. Rybka cautions that sandboxing alone is insufficient. Multiple incidents show agents exfiltrating data through DNS lookups despite having no direct web access. His recommendation is default deny for all outbound traffic, including DNS, combined with output filtering and circuit breakers. The sandbox is necessary but not sufficient.

The missing layer. The talk covers governance observability last, which is telling. Most organizations start with monitoring. Rybka starts with identity and trust. His framework implies that observability without identity enforcement and tool governance is watching the fire after it starts. The three priorities are: lock down agents with the rule of two, one agent one identity with short-lived tokens, and box the runtime with default deny egress including DNS.