Agentic Development Security — Ezra Tanzer, Snyk
Source: YouTube · AI Engineer · published Jul 20, 2026 · 27:32
The talk outlines a comprehensive framework for securing AI agents, arguing that confidence requires securing generated code, the agent's supply chain (tools/skills), and governing agent actions 2:00.
Key Takeaways:
• Securing Generated Code: Initial approaches using MCP servers and rules had limitations like latency and token bloat; the recommended solution uses Python-based hooks to asynchronously scan for vulnerabilities and trigger fixes only when new issues are detected 5:45.
• Supply Chain Risks: Agent skills and MCP servers present significant security risks, including high privileges and prompt injection; audits revealed that over 12% of developers had critical severity findings in their MCP servers 7:05.
• Governing Agent Behavior: To prevent destructive actions, systems must implement policies that either "steer" agents automatically (e.g., redacting PII) or "ask" for human approval for risky operations, with a move toward autonomous self-learning policies for background tasks 9:30.
• Local Visibility and Auditing: A demo showcased a local Electron app providing real-time visibility into running LLMs, MCP servers, and skills, allowing developers to set workspace-specific guardrails and audit agent commands to ensure trust 14:00.
As AI agents gain autonomy, robust security measures must evolve from static code scanning to dynamic, real-time governance and comprehensive supply chain monitoring to prevent catastrophic failures.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[music] >> I'm a product director here at Sneak and going to be talking to you about agent development security and specifically talking about how we can gain confidence when we use agents especially as we give them more autonomy. It's a very common theme I've heard in this track and a number of the other tracks today. Um I'm not going to go through the full history of LLMs but the model context protocol release was really big moment. Until then, I don't know what you guys are doing but I was very often copying pasting between uh agent clients and some other services and with MCP I think people really started to connect this and have a much more really connected AI system. Um and I'm not saying that MCP is the end-all-be-all and I may or may not may not have been amongst the people who wer…