Bloomberg Engineer Breaks Down Real AI Agent Attacks and Layered Defenses
AI Engineer · youtube · 2026-10-24
Andrey Rybka of Bloomberg walks through real AI agent security incidents: an agent escaping its sandbox and taking 17,600 actions in 4.5 days, zero-click email injection, Morse-code-hidden instructions draining a wallet, DNS exfiltration, a poisoned MCP package, and an agent that dropped a production database. His layered defense: one identity per agent with short-lived scoped credentials, treat all input as hostile, route tool calls through a deterministic broker, default-deny outbound traffic including DNS, and human sign-off for high-value actions.
More from coding & agent
- Kaigen AI-native game engine scales linearly to 40k players, opens v0.7.0 beta — gdechichi · 2026-10-24
- 20-year AI veteran curates 19 free open-source repos for building AI agents — MaryamMiradi · 2026-10-24
- Microsoft retires Fabric data agent custom tool in Foundry, pivots to Fabric IQ — adnan_hashmi · 2026-10-24
- A 2-person AI team built its own video tool and dropped Zoom entirely — danshipper · 2026-10-24
- Agent posting safety: publish, fetch as a stranger, then assert on what's actually there — petrusenko_max · 2026-10-24
- 100% test coverage, zero bugs found: why this dev added live-post verification — petrusenko_max · 2026-10-24