AI Security Podcast

When traditionally non-technical employees ( "vibe coders") use LLMs to write and deploy code, the potential blast radius for misconfigurations, Internet exposed apps and incidents exponentially increases. Vibe coder direct agents operating probabilistically. Agents are overzealous and want to be helpful and will break security rules to get it done. Security teams cannot rely solely on paper policies and must start enforcing hardened, paved paths. In this episode of the AI Security Podcast, Ashish sits down with Nick Reva, Global Director, Engineering Security at DoorDash, to discuss how his team proactively secures AI agents and developer workflows. Nick breaks down the three primary AI archetypes within an organization- the AI champions, the professional software engineers, and vibe coders and outlines the specific guardrails needed for each. From pushing secure configuration files to local IDEs, hardening Claude.MD files to building safety belts that prevent agents from pushing code to non-enterprise remotes, Nick provides actionable strategies for securing the software development lifecycle at scale.

Questions asked:
(00:00) Introduction to Securing Vibe Coders and AI Agents(02:30) Nick Reva’s Background (SpaceX, Snapchat, DoorDash)(04:00) The Shift from Deterministic to Probabilistic Security Controls(05:30) The Dangers of Non-Technical Employees "Vibe Coding"(08:30) Paving the Path for Professional Software Engineers Using AI(11:30) Using Decorator Functions for Agent Authorization(15:30) Shifting Left: AI-Assisted Threat Modeling on Design Documents(18:30) Trusting AI: Using Ground Truth Data to Train PR Review Agents(21:30) Hardening Deployment Platforms (Vercel, Lovable) for Vibe Coders(25:00) The Importance of Claiming Enterprise Domains and Enforcing SSO(27:30) Developing "Safety Belts" to Prevent Code Pushes to Public Repos(31:30) AI for Security: Automating Incident Response Workflows(33:30) The Critical Role of Network Egress Containment in AI Incidents(39:30) Three Quick Wins for Implementing Security for AI(43:30) The "You Laugh, You Lose" Cybersecurity Joke Challenge

Resources spoken about during the episode:
DoorDash Engineering Blog

While attackers using AI can now operate at "machine speed," traditional enterprise security teams are often stuck moving at "meeting speed." To bridge this gap, organizations must fundamentally rethink how they structure their security operations, leverage AI for defensive scale, and eliminate the bureaucratic bottlenecks that delay critical patching and remediation.
In this episode of the AI Security Podcast, Ashish and Caleb sit down to analyze the September 2026 Anthropic Threat Report and the underlying causes of recent high-profile AI sandbox escapes. Caleb explains how security leaders can fight AI with AI, sharing how he successfully used autonomous agents to conduct a 98% accurate least-privilege architectural audit across his entire organization. Caleb also speaks about the "barbell hiring" strategy eliminating middle management to build a highly agile, cross-functional Security SWAT team composed entirely of principal-level experts and junior engineers.

Questions asked:
(00:00) Introduction: The September 2026 Anthropic Threat Report(05:50) The Rapid Evolution of Offensive AI Capabilities(08:00) How AI Agents Connect Vulnerabilities Across Complex Kill Chains(12:00) Unpacking the Irregular Contractor Incident and Sandbox Escapes(14:30) The Legal Accountability Dilemma of Rogue AI Agents(17:30) The Core Security Bottleneck: Machine Speed vs. Meeting Speed(21:50) Using AI to Automate Enterprise Least Privilege Analysis(26:00) Rethinking Human-in-the-Loop for Automated Pull Requests(30:30) Why Legacy Point-in-Time Detection Fails Against Agent Swarms(36:30) Using Frontier Models to Build Zero-Defect Product Security(39:30) The Argument for Government-Backed AI Red Teaming(45:30) The "Negative Zero-Day Clock" and the Future of Exploit Generation(52:50) The Barbell Hiring Strategy: Eliminating Middle Management(55:00) Building a Cross-Functional AI Security SWAT Team

Resources spoken about during the episode:
Anthropic’s Detecting and countering misuse of AI: September 2026
How a small Israeli startup was linked to rogue AI hacks at OpenAI, Anthropic and Meta.
Expanding Daybreak as the Cyber Defense Window Narrows
Who’s legally to blame for Anthropic and OpenAI’s autonomous AI hacks? It’s complicated

As the speed of automated threats outpaces traditional patching cycles, organizations must prioritize structural containment over purely reactive detection. Cloud network architectures frequently default to permissive egress, meaning workloads can reach the public internet unless explicitly restricted. In this episode, Doug Merritt, CEO of Aviatrix and former CEO of Splunk, details how to build practical containment strategies for modern cloud and AI environments. He outlines how security teams can implement egress controls in monitor mode to validate traffic without risking system downtime. The discussion covers the transition from legacy IP-based firewalls to identity-based policies for ephemeral serverless and Kubernetes workloads. By prioritizing reachability and blast radius as core metrics, organizations can systematically reduce their attack surface and improve resilience.

Questions asked:
(00:00) Introduction to Containment and Network Security(02:50) Doug Merritt's Background and Journey from Splunk to Aviatrix(04:30) The Evolution from Prevention to Detection and Response(08:30) Why Detection Must Be Paired with Blast Radius Management(11:30) Implementing Cloud Egress Controls and Network Segmentation(15:00) Overcoming the Fear of System Downtime in Network Security(18:30) Applying the OSI Model to Modern Cloud and AI Workloads(23:30) Managing Default-Permissive Architectures in Public Clouds(26:30) Identity-Based Network Policies for Serverless and Kubernetes(31:00) The Reality of the Cloud Shared Responsibility Model(37:30) Using Monitor Mode for Safe Egress Implementation(40:00) Presenting Reachability and Blast Radius as Board-Level Metrics

When non-technical employees can spin up fully functioning apps in days and AI agents are running parallel workflows that babysit their own pull requests, the traditional SDLC is dead. In this episode, Ashish sits down with Prahathess Rengasamy, Senior Security Engineer at SpaceX AI, to discuss how the staggering compression of development time requires an entirely new approach to security engineering. Prahathess explains why legacy 10-minute PR wait times are incompatible with multi-agent workflows, and how security teams can build internal Model Context Protocol (MCP) servers to inject compliance and security guardrails directly into an agent's context window. We unpack the differences between Q&A chatbots and autonomous coding agents, the critical need to preserve foundational preventative cloud controls (like AWS SCPs and GCP Org Policies), and why holding an autonomous machine accountable for management decisions is a critical architectural flaw. Finally, Prahathess breaks down the "build vs. buy" debate, revealing how small security teams can leverage AI to rapidly deploy internal platforms and paved roads that previously took months to engineer.

Questions asked:
(00:00) Introduction: Compressing the Software Development Life Cycle (SDLC)(01:50) Prahathess Rengasamy’s Background (Block, Apple, SpaceX AI)(02:50) How Non-Technical Employees Are Bypassing Traditional CI/CD Pipelines(07:30) Injecting Security Context into Agents Using MCP (Model Context Protocol)(10:30) The Anti-Pattern: Abandoning Preventative Cloud Controls for AI Buzzwords(12:20) Identity and Accountability: Why Machines Shouldn't Make Management Decisions(15:30) Why Legacy Pull Requests Are Too Slow for Multi-Agent Workflows(18:20) Moving Security Left: Giving Agents Feedback During Local Execution(22:30) The "Build vs. Buy" Shift: Security Teams Deploying Their Own AI Paved Roads(25:40) Killing the Excel Sheet: Building AI Bots to Explain 403 Errors to Developers(29:00) How to Evaluate AI Workflows Without a Deep Technical Background(32:00) Securing Complex Agent Infrastructure and Maintaining Egress Controls(36:00) Treating AI Agents Like Microservices to Control Sprawl(38:30) Coding Agents vs. Q&A Chatbots: Defining the Threat Model(42:30) Applying Inward Security Policies to the SOC and Threat Hunting Teams

Resources discussed during the interview:
fwd:cloudsec talk - Agentic Paved Roads: Shifting Security Left to the Machine That Thinks

How does a global financial engine moving trillions annually manage cyber risk in the age of AI?
In this episode, Ashish sits down with Subra Kumaraswamy, CISO of Visa. Subra discusses Visa's journey as part of Anthropic's Glasswing Project testing the Mythos model, revealing why  a majority  of Mythos-discovered vulnerabilities were non-exploitable due to robust zero-trust architecture and micro-segmentation.
Subra explains why Visa open-sourced VVAH (Visa Vulnerability Agentic Harness) to help security teams scale vulnerability discovery, prioritization, and remediation across any model. He also breaks down how Visa triages 98% of Level 1 SOC incidents with AI agents, why "Mean Time to Adapt" (MTTA) is replacing legacy patch timelines, and how cross-functional AI governance enables innovation while maintaining strict production controls

(00:00) Introduction: Securing $18 Trillion in Global Transactions(01:50) Subra Kumaraswamy’s 30-Year Career: Netscape, Sun, and Visa(04:30) Improving Visa’s Cyber Maturity Score from 3.2 to 4.9(07:30) Inside Project Glasswing and Testing Anthropic’s Mythos(09:30) Why Visa Open-Sourced VVAH (Visa Vulnerability Agentic Harness)(13:30) Mythos vs. Zero Trust: Why Only 0.03% of Vulns Were Exploitable(16:30) Defining MTTA: Mean Time to Adapt at Machine Speed(19:00) The Threat of Multi-Service Vulnerability Chaining(24:00) Prioritizing Exploits and Automating PRs with Developer Agents(28:30) Moving to Autonomous Defense in High-Stakes Environments(33:00) AI Governance: Balancing Vibe-Coding with Production Gates(36:00) Collapsing Silos: Unifying Endpoint, Identity, and AppSec Signals(39:00) Building Custom Control Planes with Agent Harnesses(45:30) Triaging 98% of Level 1 Incidents with AI Agents(48:30) Hiring for CQ (Curiosity Quotient) & Developer Mindsets(53:00) The "You Laugh, You Lose" Cybersecurity Joke Challenge

Resources spoken about during the episode:
VVAH - Visa Vulnerability Agentic Harness