Rethinking Agentic AI Security and Risks with Chris Hughes

Chris Hughes, Noma's VP of Security Strategy, joins Diana Kelley (CISO, Noma) for a wide-ranging conversation on what's actually involved in securing agentic AI today. They start with the autonomy spectrum: how much standing privilege an agent holds and how much a human stays in the loop, and how that should scale with data sensitivity and the potential blast radius of an agent's actions. From there, Chris explains why prompt injection isn't a bug to be patched but an emergent property of how LLMs process instructions and data together, and walks through the 2026 Open AI & Hugging Face incident as a real example of how hard it can be to tell an attack from a legitimate investigation. The conversation moves into the practical layer: the difference between soft guardrails like system prompts and classifiers versus hard, architecturally enforced boundaries, the risks introduced by newer AI supply chain pieces like MCP, agent-to-agent protocols, and third-party agent skills, and the unresolved state of non-human and agentic identity at a scale most security teams haven't dealt with before. Chris also talks about CSA's AARM standard, which he co-chairs, and why it focuses specifically on agent behavior at runtime rather than configuration alone. They close on zero trust for agentic AI, the overlap between securing agents and using agents for security, and why traditional threat modeling frameworks are being adapted, through newer approaches like MAESTRO and Phantom-B, for systems that behave less predictably than the software security teams are used to defending. The Blast Radius Podcast is brought to you by Noma.