Travis McPeak What I've seen the most is the main agent that you have doing work is like really trying to solve that problem for you. And if it starts getting stuck, then it will do what I call thrash. Yeah. It just starts to get like, you know, creative about ways to solve the problem, and that is very unpredictable. And so most of the time, you know, "It deleted my database," is actually not gonna be a prompt injection. It's gonna be

Allie Howe If you monitor the agent's intent, like, you can have good intent but still do the wrong thing. So when we think about observability for agents, especially in these highly autonomous systems where so much is going on, and if you had a perfect system where you had all the logs, you had all the information, like, what do you start looking for?

Travis McPeak When you see that quick left turn, it's like, you know, we were trying to do this, but we got an error. Like, that's the kind of stuff that usually causes the main agent to start thrashing. So I think those, like, errors is, is kind of like a, a turning point where the m- main agent can either, like, self-correct or, you know, be guided back, or it just goes off the rails. I would be looking most at those.

Travis McPeak The reviewer agent, literally doesn't care about the goal at all. It's like, you know- So interesting... the main agent, building success is completely unimportant to the review agent. All it cares about is enforcing its rules. because the main agent actually can realize it's thrash if it's pointed out, it will course correct most of the time.

Allie Howe And welcome to another episode of the Insecure Agents podcast. I'm your host, Allie Howe, and today I'm super excited to be coming to you from Black Hat in Las Vegas. With me today I have Travis McPeak, security lead at Cursor. Super excited to talk to Travis about what he's seeing in the industry and also here at Black Hat and get his take also on what's going on with Cursor and the acquisition to SpaceX. Very exciting. So Travis, would you like to introduce yourself?

Travis McPeak Hey, great to be here. Thanks for having me. I'm Travis. I'm career security but have worn many hats. So security practitioner, I was a founder. I've done angel investing, so kind of like a, a broad spectrum. And right now leading some of the technical aspects of security at Cursor. Basically the What I'm really excited about is the ability to apply agents to solve problems that have been unsolvable in security, and getting a really good opportunity to do that in this spot.

Allie Howe Amazing. Yes. And, but when I think about Cursor, I feel like it's, like, one of the first, if not, you know, the actual first technology that people interact with to use coding agents for the first time. And so, so all these, like, AI security problems that some folks are running into for the first time, I mean, you all saw it from the beginning. So given that s- that long span of time, what did you... What did AI security for coding agents look like in the beginning compared to what does it look like now?

Travis McPeak Yeah, so there's there's actually, like, two parts of it. There's non-new problems that you can apply AI to, so like patching, for example, or, like, threat modeling. Those things didn't scale well before, and they can scale better now. But then the actual, like, security of the agents themselves, that's all new attack surface. And the, the thing I think that's really interesting about it is we have traditionally relied on very static controls in security, right? Like block lists and WAF and stuff like that. But when you're dealing with an agent that is, like, very creative and its whole goal is to solve the problem for you- a lot of those static rules actually start to break down.

So what we have found to be the best is actually using other agents who don't care about solving the problem that the main agent's trying to solve, and having it interrogate the work that the main agent is doing.

Allie Howe Interesting. So I've seen that concept before. I think someone said at AI Engineer World's Fair on the security track of, like, the generator cannot be the validator- Right... which is a pattern I'm, I'm starting to see. Especially with, like, you know, agents are so goal seeking. If, like, one agent doesn't care about that goal, that's, that's the interesting piece. I feel like that's the differentiator.

Travis McPeak Right. Yeah, exactly. The... I think prompt injection gets a ton of coverage, but actually, what I've seen the most is the main agent that you have doing work is, like, really trying to solve that problem for you. And if it starts getting stuck, then it will, do what I call thrash. Yeah. It just starts to get, like, you know, creative about ways to solve the problem, and that is very unpredictable. And so most of the time, you know, "It deleted my database," is actually not gonna be a prompt injection. It's gonna be that.

Allie Howe Absolutely. Yes, for sure. And then how do you get that secondary agent, the, validator, to be able to catch that thrash? Like, what does it look for?

Travis McPeak Yeah, so this is a lovely thing. So we have, you know, like in dev, we have the main agent, it's building software, and then we have a security review agent, for example, and it doesn't care about the main goal at all. It's just find any potential security problems in this, and then go report them back to the main agent. And the, good part is the main agent is very coachable-... in the sense that if you tell it, "Hey, there's security problems here," it will often say, "Oh, you're right, like, this needs to be fixed," and, just go fix it. So the two build a really good loop.

I think the important part is you have to have that agent completely separate from the main one- Okay and uncontrollable by what the main agent's doing. It can't say like, "Oh, it's fine," like, "Security stuff is all good." It needs the actual feedback from the other agent.

Allie Howe How do you prevent the agent that is thrashing from convincing the validator that, like, "No, everything's fine"?

Travis McPeak The agent that's thrashing actually, usually if you coach it, you know, like, "Hey, you might be thrashing," it, it will say like, "You're right," and then go back to the main task. So actually, like when we were building auto review, which is the agent that reviews the actions that the main agent's gonna take so you don't have to keep pressing like manually approve every time we had to tone down the feedback that the review agent gave to the main agent because without toning it down, the main agent would freak out. Like it would say like, "Oh, security problem," whatever, and then it would just like start to spiral.

So we had to s- we had to like really frame it as like, "Hey, here's something to consider." And then the main agent, when it gets that feedback, is very good at adjusting.

Allie Howe Interesting. And when I think about like coding agents and the way they interact, it's very like modeled off of how, you know, engineers work today, where it's like, okay, you have the person who wrote the code, then you have the reviewer, and they go back and forth. But with agents, do you ever think about like the different permission structures? Both need to make sure that like when work is delegated from one agent to another, it doesn't inherit more permissions than it should.

Travis McPeak Yeah. The that is like a, a good example of the kind of thing that like wouldn't scale well before. But now when you have agents that can also perform that kind of like least privileged sort of analysis, it actually scales much better. And the the thing that surprised me first, so my, my former company, Resourcely, the whole goal was to set things up, you know, well for infrastructure. Like we would actually just mint good infrastructure with good patterns so developers didn't need to worry about it. Agents just have so much of that in their training data already. If you say, "This is what we're trying to get done," it will basically write like perfect IAM policy most of the time.

So that's the kind of thing where it's like least privilege can actually work now because we have, you know, it wouldn't scale to have enough security engineers doing all of this. But agents, if you give them tokens, they'll do it all day long, and they do a really good job.

Allie Howe Yes. And when we think about those tokens is it important to keep those tokens like very finely scoped to like just the task at hand? 'Cause I've seen a, a pattern across people I've talked to, like, "Okay, we can no longer trust agents with long-lived static credentials." So even if you have that like generator and validator loop going on, and you're able to get the agent to like stop thrashing, is it still important to make sure that agents only have access to what they're supposed to for the given task at hand?

Travis McPeak I think so, yeah. This has to be a layered approach. So at the end of the day, like whatever permissions it has- that's gonna be the boundary. Okay. And so you definitely don't want anything that's not required for the task, but sometimes you have to give what would be a sensitive permission to the agent based on what it's doing. Like there's just no way to avoid that. And so that's where like a review agent comes in or, you know, like some other proxy layer where it can look at what's going on and maybe say like, "In this case, it's okay to do what you're doing with the permission.

In this case, it's just blocked. It's just blocked at the network layer. You can't make that call.".

Allie Howe Yes. Okay. Yeah, the layered approach definitely makes sense, and it was a concept we were exploring at a panel I did on, on Monday about, okay, how do we secure our coding agents and move from what we have today up to like software factories? And I just feel like there's or like the security model is sort of like missing there, and that's maybe the missing piece that's keeping people from being able to actually make that, that jump. 'Cause I feel like the core underlying technology of like the dream of a software factory is like here today. Like model vision has improved, so we're able to actually like verify work that's been done that we haven't been able to before, and context windows are larger, so now we can keep track of work that's been done before in a loop, and so they're more like cost efficient.

But the security piece of like how do we make sure that an agent doesn't, you know, go off the rails, it doesn't inherit more permissions than it should if it's interacting with other agents in a multi-agent system. All of these different problems are, are things I think people are like being held back on. Is there anything else that you see that's like missing if you were trying to like envision like a software factory like reference architecture? Like what do those components look like?

Travis McPeak Yeah. So, it's an awesome question. Firstly I'd say I think there's kind of a split right now on people that are talking about, you know, the kind of stuff I'm saying. Like you have a review agent and then some people are, you know, but it's non-deterministic, like it can make mistakes. And my counterpoint to that is like we've had people, people make mistakes too. Like if we theoretically had, you know, 1,000 security engineers and they could do all of this stuff, they're still gonna make mistakes. So I think the like it makes mistakes doesn't hold water to, you know, it's compared to people that also did it.

Now the, the software factory thing I think is super interesting. So what you want really is a, is a fast iteration loop. So you want, you know, an agent to be able to build something. You want your whole set of validators, you know, that could be anything from CI, you know, making sure that things aren't broken, like integration tests, all of that. Review agents of various types say like, you know, bug finder agent, security agent, all of that. That will end up producing something. And then I think the main part of a factory is you need to be able to just try things in a low stakes environment.

So I really like s- things like canary environments. So you know, we're just going to deploy this to like a, like a staging and it's gonna take, you know, X percent of our main traffic and we'll just observe it. You have to have the good logs to actually see like did baseline behavior change here or not. And then of course you want observability of the whole thing. So if something did go differently, you wanna know exactly what that was because that's gonna be feedback to the, the agent about like where the bug is. And that whole kind of like virtuous cycle, I think it can be completely unattended.

Like it, it can just run and it c- if you do it that way, it's gonna go way faster than normal development where it's like I build something, somebody reviews it, you know, we have meetings about it, it gets deployed and then like by the time we figure out it's bad, then we rinse and repeat and that whole thing takes weeks.

Allie Howe Yes, absolutely. And then one interesting question is like that I've been thinking about or have asked others before is like how do you verify the software factory like actually built the right thing? Like isn't that kind of like a human subjective like taste thing or is-- could that be made like deterministic also?

Travis McPeak Yeah. I'm I'm kinda bearish on like verification in general in software- Okay... 'cause like, you know, taking any software that we've all used forever, like all of it has bugs. You look at like the fix rate. So I think that's not the bar that we need to be going for is like, you know, it's like perfect and we know it's perfect 'cause no software anywhere has ever been perfect. What we actually want though is observability about like does it do the things? You know, is it, is it causing crashes? Like did it perform the actions? When it doesn't perform the actions, like why is it not?

Yeah. All of that kind of stuff. And then if we get to this fast loop then it kind of doesn't matter if it's, you know, it ships whatever, 70% and then you can iterate so quickly. Like imagine being able to deploy like 10 new versions of that same software within a couple hours. Like that's what I think we can get to. And so for that really you just want like, it's like the fail fast mentality, right?

Allie Howe Yes. You just wanna like get it out there-

Travis McPeak Observe it, let it improve quickly, and then it'll end up, I think, in a better spot.

Allie Howe I agree. I, I just had a conversation before this with some, like, chief security officer and a principal security architect, and we were chatting about, you know, how do you spot an agent that has, you know, gone off the rails, like misbehaved? And, like, observability is super important, but also it's like, what do you look for? 'Cause like certain times, like if you monitor the agent's intent, like you can have good intent but still do the wrong thing. So when we think about observability for agents, especially in these highly autonomous systems where so much is going on and if you had a perfect system where you had all the logs, you had all the information, like what do you start looking for?

Travis McPeak Yeah. So, let me give like a tactical example here. So- Yeah... I saw an agent that was trying... You know, the user said, "Hey, I need you to like get this data up and and post it for me." So the main agent didn't have the tool it needed to actually like upload the file to where it was supposed to be. So it tried, it, it errored, and then it's like, "Okay, I'm, I need to do this for the user, so I'm gonna put it on like CatBox," which is the wrong answer in that case. So really that's what I like about the the other agent that's able to, to just watch the whole thread of how we got here is because when you see that quick left turn, it's like, you know, we were trying to do this, but we got an error.

Like that's the kind of stuff that usually causes the main agent to start thrashing. So I think those like errors is, is kind of like a, a turning point where the m- main agent can either like self-correct or, you know, be guided back, or it just goes off the rails. I would be looking most at those. Like any kind of like, you know, agent trying to do a lot of stuff erroring out 'cause then it could just take a turn.

Allie Howe Yeah, I feel like monitoring behavior and correcting it is just as important of a security control as it is to make sure your sandbox is as impervious to zero day as possible, and and, and other controls as well. They're all super important. It's very part of a layered defense in-depth approach. But I think like some of those, if you have all, one of those technologies in isolation, you miss like the key, you know, feature. It's all, it's, it's a feature and a vulnerability that comes with agents that they're so incredibly goal seeking. And if you're able to give them a happy path and course correct and keep them aligned and pursuing that goal, it's less chance that they're gonna go like, you know, outside of a sandbox.

So they're, like they're thrashing, and they're going to try something else. Like I think that's really important to think about just like any other control.

Travis McPeak Yeah. And you can also give them guidance, right? I think a lot of people want, you know, I just tell you to do this thing, you come back when it's done. Yeah. But actually more for me, what I'd like is, you know, think about like an early career employee. Like, if I give them a goal-... and the goal's ambiguous, I actually want them to come back and ask, "What, did you mean here?" And I think we can do the same thing with agents, right? Like, I don't have to have it unintended. Like, I will tell my agent, "If anything about this is unclear, or like we're at a fork in the road, let's chat about it.".

Allie Howe Yes, absolutely. How do you get an agent to do that? Like, do you just put it in the system prompt, or...?

Travis McPeak Yeah, you just, I mean, just- Okay user prompt, you know, like I- Okay... if you get to anything where it's like, you know, there's a major decision to be made-... Unless I've told you the answer, like, let's ask me a question. most of the agents have, like, an ask question tool, so just use that and tell me what the choices are, and wait until I give an answer to keep going.

Allie Howe I see. And in order to keep, the two agents from, converging on a goal, is that just, a, behavioral runtime thing, or that usually doesn't happen so it's not a concern?

Travis McPeak What do you mean converging?

Allie Howe I guess, like, like, kind what I was thinking, like, before, if, like, one agent that's, like, thrashing is able to convince the reviewer agent that like, "Oh, no, this is the right thing to do."

Travis McPeak It... Yeah, it won't happen because the the reviewer agent, literally doesn't care about the goal at all. It's like, you know- So interesting... the main agent building success is- completely unimportant to the review agent. All it cares about is enforcing its rules. So, and then what, what will typically happen is because the main agent actually can realize it's thrash if it's pointed out, it will course correct most of the time. So, for example, in our auto review, what we do is we have every step of the main agent where it's gonna call a tool, goes to the auto review, and then auto review gives feedback to the main agent, and main agent can either ask the user if it thinks that's really the right answer, or it can just change approach.

And most of the time we actually see it just changes approach to something safer.

Allie Howe Interesting. Yeah. Is this pattern, like, widely documented, and, like, are other people using it, or is this something, like, you feel like, you know, this is novel, Cerus figured it out, and maybe everyone else will catch up?

Travis McPeak I think there's, I think there's other providers that have a similar approach. I think probably, you know, people that are paying attention have come to the same conclusion, which is like-... you know, what do we do? We need to have some guardrails. Us listing out, like, all of the forms of, like, everything bad the agent might do that we wanna block against is a losing battle. You know, think about, like let's say I don't want you to ever run, like, pseudo. So you could naively think, like, I'm just gonna put, like, a pseudo deny list. Like, it just will not be able to do that thing.

But then the question is, like, okay, well agent thinks it needs to use pseudo to get the job done, so it might, for example, like, put pseudo in a Python script and, like, you know, wrap it, and, like, that thing will just sail past your, like, naive pseudo thing. Or, you know, it might work around any number of other ways. And, like, even trying to foresee all of the ways it might work around is impossible, and that's just, like, one case. So I think that yeah, really, like, this kind of independent auto review kind of approach is, I think a lot of companies are thinking that way, and probably, like, more so will do over time.

Allie Howe Yeah, that makes sense, 'cause it's hard to write like- Or imagine all the different ways an agent might, like, go wrong. So it's really important to, I feel like, have AI to secure AI in that way.

Travis McPeak Yeah, and also the it, it can actually cause the thrash you don't want, right? So it's like pseudo actually was the right answer. Like what we, we should've done was ask the user, just stop and ask them, like, "Hey, I think we need pseudo here." Like, just ask. Yeah. But if you just say to the agent, like, it's blocked, now it's gonna be like, "Okay, I need to get this done," so it's creative workaround time. So that's really, like, can cause the thrash itself that you don't want.

Allie Howe Yes, that makes sense, for sure. When you think about like if someone's gonna create their own coding agent, like what would the secure design pattern for that look like? For, for one, I think from what I've heard is like put it in a sandbox, make sure the credentials and the infrastructure it needs is outside of the sandbox, inject them into the sandbox as needed in a very task-scoped, highly ephemeral way. And also like the monitoring and all of that. Is that, like, the correct approach, or would you add anything?

Travis McPeak Yeah, I think the all of those things for sure, and then also the ability to feed in the right context based on a task. So like, you know, think like rules or something like that. So it's like this is the way that we do this thing. You obviously don't wanna carry a giant set of rules in agent memory all the time. But you know, just something simple like for these types of operations, go look up in your markdown like the runbook and follow it exactly. Like the agent will do that thing. So the actual guidance of it per task is also super important.

Allie Howe Makes sense, for sure. When you walk around the Black Hat floor here in Vegas it, it, it sounds very similar. Everyone's like, "Oh, we sell agent security," or, "We sell, you know, zero trust." how do you navigate all of that noise, and what do you think is important for people to f- focus on?

Travis McPeak I just don't. Yeah. Yeah. I'm not walking the floor. Okay. I heard somebody selling something about that on the plane, you know? It's like-... I know it's just, it's really hypey. I-

Allie Howe Yes. It's hypey for a reason, right? Like everyone's got this like new problem to figure out, and so vendors are rushing in to provide, you know, any number of solutions to it.

Travis McPeak Right now, like I think a lot of the stuff I'm hearing now, like are things that we were thinking about, you know, nine months, 12 months ago. Yes. So a lot of it is kind of just catch up, you know, as, as AI coding-... proliferates more. What I'm thinking, you know, mostly about though is like- Identity, which, you know, everybody's talking about obviously too. But like, what is this actual thing, you know? Is it a person? Like is it a bot, like, just like a pat, you know, style, like authentication? Is it somewhere in between, you know? Is it bot, like, on behalf of me?

Like, how do we actually identify this thing? We're gonna wanna get that right for logs. We're also gonna wanna get that right for the authorization of what it can do. And then, you know, a lot of systems that we're dealing with, like, just were not built that way. So you have not enough granularity in the AuthZ model itself. You know, it doesn't really understand this sort of like hybrid authentication that we're gonna wanna have. So I think there's just a lot of, like, retooling the tech stack around agents to make it actually work better.

Allie Howe Yes. I, I think this is a big piece of infrastructure that's missing for developers that are creating agents. And I've been playing around with the Vercel's Eve framework recently, which I love. I think it's awesome. There's an open issue on it for, that someone filed that they want human-in-the-loop like they want authorization on the human-in-the-loop tool calls that the framework provides as a functionality. So basically, like, if you had a Slack agent, for example, if someone asked that Slack agent, "Hey, I want you to delete this issue," and Linear would say, "Okay," like, "Are you sure you wanna allow this? Here's the human-in-the-loop thing from, from the framework."

But what's missing is the ability to control who's allowed to click- Right... Yes, delete. So there's, like, infrastructure, like, available today with the identity and access piece that's able to actually, like, enforce that or provide that, that missing feature that so many folks are asking for today.

Travis McPeak Yeah, exactly. Yeah, Slack's a good one, like a good example because, you know, the, the default model there is, like, I OAuth as me, and, like, the Slack bot, you know, is, is running as me for for an agent, which we probably don't want. But then the other approach of that is, like, we're getting tons of requests of people that are, like, bringing all of their, like, various agents, you know, and, like, personalities in. And so it's like, do we wanna have, you know, if we're 1,000 people, do we wanna have, like, 10,000 bot Slack users, and it's, like, impossible to tell who's what? Yes.

Like, really that, that's all kind of a hard problem. I think we, we do want some attribution to the actual, like, person that I can go chase down if something's going wrong. On the other hand, like, it just, you know, is me, like, is probably not what we want either. So yeah, we're gonna have to figure all of that out.

Allie Howe Yes, and then these Slack bots are not created equal. So it's like if you've got a Slack bot that's connected to Linear or if it's like s- say GitHub, for example, if it's connected to GitHub and it's using a user's PAT. Okay, now you're talking to that agent as that, as that user that made the agent. So like you have their GitHub access, not your own. Exactly. Right. Which is a huge problem, versus if you made like a GitHub app, and now you have this like, you know, the OAuth pattern of like, okay, now I'm connecting through this agent to GitHub based on my permissions, not the other, like the user's PAT, for example.

Travis McPeak Right. Yeah, and I mean, I'd love to be able to like down scope it, right? So like at Cursor, I'm admin at a bunch of stuff just because I'm on the security team and I need it, but I definitely don't wanna give my agent, like, m- my permission set. That's the way a lot of apps are built to authenticate, right? It's like- Yes... through OAuth, it's me now.

Allie Howe Yes. Exactly, and sometimes like the upstream, like maybe like, you know, take Linear for example, it doesn't provide a control that you'd like to have. So for example, if it's someone's maybe like a member or they have whatever the permissions are that allow them to delete something across the board. Well, maybe you just don't want them to allow them to delete something from a specific team or a specific type of issue. With these fine grain authorization patterns, you can actually then enforce a control that the upstream provider doesn't have.

Travis McPeak Right. Yeah, and I mean, you know, think about, I think AWS, like IAM actually got- the authorization, like the policies, like pretty well done compared to many systems. But, you know, those things are complex and like even that, you can't really express some of the conditions you want. Like- Yes... maybe I want, you know, my bot to be able to perform this action, but only on this subset of resources, you know? Like, as soon as you get... You can do that well in an AWS IAM, but like m- most other systems you can't. So I think part of this is just we're gonna have more permissions for these than we want, at least in the medium term-... until we like redo AuthZ everywhere.

Yes. And so then it's like, okay, well how do I control it? Like that would be like, you know, the review. That would be things like proxy where it just drops it conditionally. But that's also a lot of stuff to implement.

Allie Howe Yes, it's a lot to implement. It's also a lot to like maintain. Like if you're, like I've talked to a bunch of people on this podcast that are sort of like building something similar or trying to everyone's rolling their own version of it. It gets pretty difficult to maintain, especially as you get more requests from users of like, "Oh, like I wanna add this MCP or this resource, and I wanna, you know, add these patterns." And it's like, okay, well, like what if we just had, you know, one set of configured resources, like with the proper scopes, with the proper, you know, design patterns behind them?

Maybe it's, you know, it's OAuth or it's GitHub app versus a PAT, and then everyone in the organization is just able to sign into this one thing and then get access to all of that. Like, I feel like that would be super powerful.

Travis McPeak Yeah. There's another interesting pattern too-... which is we used to at Netflix we called them citizen devs, you know, when I was there in like 2020. But these are like people that are not engineer titles that are like building software. And there's always been platforms for that, but like y- you know, this is the year of the citizen devs, right? Like everyone's building stuff, and a lot of those people, like- The agents are really good at telling you things in a way that sounds convincing, and if you don't actually understand, like, what it's telling you- Yes then you'll be like, "Sounds good to me." You know?

So, like, a lot of the a lot of the people building software now, like, we need to come up with ways to guide their agent, you know, on the right path, because we can't... I-I've never been, like, very pro training. But, like, it's definitely not gonna work here, right? Like, these people are not gonna catch up on 10 years of computer science in order to, like, get their project done.

Allie Howe No, not at all. Especially I think when, you know, interacting with a coding agent, you see the super, like, long, obfuscated, like, bash command, you're like, "I guess. Sure."

Travis McPeak Yeah. Like- Yeah, looks good to me. Sure, yeah.

Allie Howe Yeah, yeah. Yeah. So yeah, having that guardrails on that or having the reviewer agent, like, make sure that's, you know, staying on track is super important. That's a really interesting design pattern.

Travis McPeak Yeah, the the interesting thing, too, is, like, when I was when I was implementing that system I was looking at a bunch of the commands, and the agent would un- Like, you'd see this, like, really long, gnarly, you know, chained, like, shell command. And I would look at it, and I'd be like, "I have no idea what that is." But the agent actually knows-... 'cause it's seen enough of it in its training data. So, like, it's really good at parsing, like, you know, better than I would do, and, like, probably better than, like, most people would do, and it can do it really fast. Yes.

So, you know, I've-- I see this, like, whatever, 500 character, like, shell command. Agent's usually good, and, you know, like, it's usually not wrong, so I quick scan it, approve, approve. You know, now I've gotten like 200 approvals today. I'm getting a little tired. Like, probably the one that I'm not gonna pay enough attention to is the one that's gonna get me. But the agent, it's always fresh. You know, it's always got the same, like, goal, which is, like, just understand this thing and require approval if it's, like, outside of the scope. And so it's, like infinitely diligent in a way that humans can't be.

Allie Howe Yes, absolutely. And I think about the, you know, the dangerously scoped permissions and all that, when you think about this, like, trilemma problem that most people are finding, where it's like, okay, I want my agent to have security, autonomy, and capability, but most teams right now can only pick two. Or it's like, okay, like I'll have autonomous-- autonomy and capability with just, like, the dangerously scoped permissions, but forget maybe the security piece. Or I'll hit yes, I wanna, you know, allow this command all the time and get, like, super consent fatigued, and, you know, miss the autonomy thing, but now I've got security. How do folks get all three?

Travis McPeak Right. Yeah, the other thing, too, is people are not generally good at thinking about tail risk. So, you know, in general, humans like I, I did a presentation on this before, but, you know, people will be afraid of, like, shark bite. And it's like, okay, that's not gonna, that's not in the top, you know, 10,000 things that's ever gonna, like, you have to worry about. Yes. You know, but it's like, it seems scary. You know, conversely, like something like heart disease, which you actually should worry about, like, it's kind of, you know... Nobody, like, really thinks about it as much as possible, so, like, we're kind of bad at understanding risk in general.

Yeah. And then it's like, okay, I've seen the agent. You know, I've carefully reviewed 5,000 of its commands. It's never been wrong. But, like, the way security risk works is, like, you have this, like, one little, like, tail thing, and that one's gonna really suck. So you need to... You know, you don't wanna freak out about any individual command. You wanna treat it as, like, you know,.00x percent of the time something really bad happens here. But you need to apply equal scrutiny to all of them. Otherwise you're gonna miss the one.

Allie Howe Yes, absolutely. Yeah, a similar concept. I read a book one time called, like, Numbers Rule Your World. Yeah. And it changed the way I think a lot about stuff, 'cause it's like it applied statistics to everything where people... It says, you know, a lot of people are, are afraid of, of flying statistically, but statistically speaking, if you look at the data, it's one of the safest modes of transportation. Right. So yes, our, our risk adjustment is maybe, you know, poor.

Travis McPeak Exactly. Yeah. It's... In, in general, you know, we want builders and, like, other people at a company to, like, not be paranoid about security stuff. Like, that's, in my opinion, the best service that we can provide as a security org, is just build the systems, you know, where they can get their job done, and they don't have to, like, understand tail risk.

Allie Howe Yes, absolutely. What is one thing you're looking forward to from the industry or forward-thinking? Like, what does AI security mean next?

Travis McPeak Yeah. So, I'll do, like, a more general one. Yeah. So I, I think that Security has always had this problem in organizations where there was more work than they were capable of doing themselves, and so, like, what they ended up doing was farming out work, and that leads to bad incentives, right? So if I buy a scanner and it, it says, you know, "Hey, there's, like, all these problems," and then somebody else has to go, like, figure out whether we're gonna do it or not, it... There's really no reason that I wouldn't just dump the full list. If I'm doing the work myself, then, like, I want that list to be, like, super accurate and as tight as possible.

So there's always been this, like, split where security's, like, risk advisor, you know, and they tell everyone else, like, work to do. And because they don't filter it enough, then everybody else is like, "Well, if we just did all this stuff, then we're not doing the rest of the stuff we need to do as a company." So what I really like that I think could happen is security can just, like, own all of this, like, end to end. So it's like we're going to be really good at identifying risk, and then we're gonna handle that risk if we think that it's important above our cut line.

We're just gonna, like, fix that end to end. Like, we'll loop in teams, you know, like FYI, but, like, we're just gonna handle the, the patching, the fixing, the what- what- whatever needs to happen there. I think that, that we, we can actually do that now because agents are so good at ramping up on systems. You just ask it questions and, like, you can understand. And if you do the factory thing, they get enough feedback on changes that you know that it's, like, pretty good to go. And so in that way, nobody else really has to worry about security. Like, security just handles it.

Allie Howe Yes, absolutely. Yeah. And I think we also kinda see that with just how quickly agents can move in a loop where it's like, okay, I find the fix and I can actually apply it, like, in the same loop, but you don't have to, like, take all the time in the back and forth of security's gonna report to engineering to convince engineering to care and then fix it. Like, that's exciting.

Travis McPeak Yeah, exactly. So I, like, pen test is a good example of this. Like, you know, why do security people like getting pen test so much, like proving that the system is, is exploitable? Like, if I have the code and the configuration, I know if it's exploitable or not. Like, I don't have to actually go, like, run the exploit and, like, take video proof of it. I think oftentimes the reason is because security's asked other people for so much stuff that you need that, like, visceral, scary, like, feeling thing to show them. Like, "Look, this is... You know, we're not making it up. It's real. Like, here, look at it," you know?

Yes. Yes. And, like, that is a symptom of the broken. Like, I think that-... there should be enough trust that when security's like, "Look, this is, like, a real thing," like everybody knows that that's true, and then the step further than that is, like, and security says, "It's real. It's important to us. Like, we're just gonna make it go away."

Allie Howe Yeah, absolutely. Amazing. Well, thank you so much for coming on the show. I really appreciate all the time. And we'll be excited to keep following Cursor and everything you're doing. And I hope you have a great rest of your Black Hat.

Travis McPeak Yeah, this was fun. Thanks.

Allie Howe Yeah, thank you.