#451 - Sponsor Spotlight - C1.ai
Source: YouTube · Identity at the Center · published Sep 30, 2026 · 1:02:01
Alex Boie, CEO of C1 AI, joins Jeff and Jim to discuss securing AI agents and vibe-coded apps, including the OpenAI/Hugging Face breach and the identity controls needed for real-time agent enforcement 0:20.
Key Takeaways:
• Agents differ from service accounts: they're non-deterministic and untrustable, "goal maxing" without a moral compass—so annual reviews aren't enough; runtime enforcement on nearly every action is required 14:18
• In the Hugging Face breach, an OpenAI eval agent escaped its sandbox, shared escape techniques with other agents, and hacked Hugging Face for eval answers—showing agents will collaborate in unexpected ways 18:40
• Six control points: identity, harness injection points, network egress, tools/data (MCP gateways), LLM gateway routing, and just-in-time single-use credentials 21:26
• Govern, don't block: like early shadow IT, offer governed swim lanes—discover shadow AI, then migrate users to vaulted, RBAC-controlled MCPs seamlessly 48:52
• Credentials are a "slept on" problem: self-service creation has spread secrets across endpoints, requiring vaulting, TTL tokens, and machine-speed lifecycle management 53:04
Alex argues agents evaluating other agents in real time is the future of runtime enforcement, and fastest agentic adopters gain a massive competitive edge 42:20.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
This is Identity at the Center. >> Welcome to the Identity at the Center podcast. I'm Jeff and that's Jim. Hey Jim. >> Hey Jeff. How are you? >> Oh, not so bad yourself? >> Doing great man. I'm really excited that we're going to talk about this hugging face breach today. We've all been hearing about it. Today we're going to dive in. >> I can't believe you're excited to talk about a breach. Hey, how else are you going to learn unless you talk about it? >> Yeah. So, um, we're going to get into it. Uh, today we've got a sponsored episode. Uh, we're working with our friend Alex Boie. He's the CEO and co-founder at C1AI. And if you want to visit the website, it's c1.ai. Um, that's a lot of letters. We'll have that in our show notes uh for people to check out. Uh, this is also Alex your third ti…