Security For AI Sucks

Send us Fan Mail “Secure AI agents” is a comforting phrase, and it’s also one of the most abused. We sit down with Zach Korman, a builder and security researcher known for stress-testing AI agent frameworks, to talk about what actually breaks when you connect LLM agents to tools, plugins, skills marketplaces, and live production systems. The punchline is not a single bug or a clever jailbreak, it’s a bigger design problem: agents can be influenced by untrusted content while holding real authority through API keys, SaaS access, and automation hooks. We dig into why “enterprise-grade security” claims often collapse under basic testing, how disclosure changes when a product launches with bold marketing, and why skills are a supply chain risk hiding in plain sight. Zack explains how malicious skills can smuggle commands in places humans never read, how automated scanners can be bypassed, and why “safe OpenClaw” may only be achievable by stripping away the very access that makes agents useful. We also cover MCP security concerns, including dynamic tool definitions, model capability mismatches, and the uncomfortable reality that some protocols effectively enable instruction injection by design. Then we get practical: how to vet tools if you’re not an InfoSec specialist, how to reduce third-party exposure, and what foundations matter most inside a company (visibility, least privilege, authorization, and governance). If your team is moving from chatbots to agentic automation, this conversation helps you spot security theater before it ships to customers. Subscribe, share this with someone deploying agents at work, and leave a review with the AI security question you want us to tackle next. Connect with our guest: https://x.com/ZackKorman Check out the Monthly Cables2Clouds News Feed: https://docs.google.com/document/d/1fkBWCGwXDUX9OfZ9_MvSVup8tJJzJeqrauaE6VPT2b0/ Visit our website and subscribe: https://www.cables2clouds.com/ Follow us on BlueSky: https://bsky.app/profile/cables2clouds.com Follow us on YouTube: https://www.youtube.com/@cables2clouds/ Follow us on TikTok: https://www.tiktok.com/@cables2clouds Merch Store: https://store.cables2clouds.com/ Join the Discord Study group: https://artofneteng.com/iaatj