Shadow AI & Sandbox Escapes: Why You Need an Agentic Control Plane? | Michael Leland | Island
Source: YouTube · Cloud Security Podcast · published Aug 18, 2026 · 32:29
Autonomous AI agents require a new "agentic control plane" for visibility and enforcement across browsers, desktops, and gateways, as unvetted skills and misconfigured data paths pose major breach risks 0:47.
Key Takeaways:
• Existing tools (EDR, DLP, CASB) each have AI visibility gaps; a single ubiquitous control plane prevents agent sprawl and ensures consistent policy enforcement 6:14
• AI agents are goal-oriented and may bypass guardrails—e.g., downloading untrusted packages—so governance and data protection policies are essential 7:51
• Token brokering at the MCP gateway restricts agent permissions (e.g., read-only), addressing Non-Human Identity risks with least-privilege access 8:11
• Visibility comes first: one customer claimed eight AI tools, but assessment found 243 unsanctioned ones 13:05
Effective AI security means governing AI behaviors and data flows, enabling safe innovation while preventing data exfiltration.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
7,600 skills, like over 800 of them were malicious. >> My browser knows more about me than my doctor, my bank, and my mother combined, and none of them are securing it. >> Unfortunately, it's not funny, it's true. I had a customer insist that they only had eight sanctioned AI tools in use. We did an assessment, we found 243 tools. You never onboarded your agents. So, what does it do? It writes a Python script that downloads an NPM package from an untrusted source >> Yeah. >> in order to achieve its goal. AI is goal-oriented. Say yes to AI, but do it safely. I fully expect we will hear, if it hasn't happened already, some Cambridge Analytica-sized breach. Not by a malicious actor, but by a well-intentioned user >> Agent control plane is forming in your organization, you probably don't even …