Max Corbridge, an moral hacker and pink teamer who’s co-founder and CEO of Safe Agentics, speaks with SE Radio host Amey Ambade about how AI brokers get attacked and what engineers can really do to defend them. Drawing on years of offensive safety work, Corbridge frames brokers as a brand new and largely undefended assault floor: the business has handed AI techniques autonomy and the flexibility to behave in the actual world whereas carrying ahead immediate injection, a flaw the frontier labs themselves describe as successfully unsolvable. He likens the second to the early, lawless days of the online, when SQL injection was all over the place and adoption ran far forward of safety.
The dialog builds from first rules as Corbridge explains what separates an agent from odd software program and why three properties make them laborious to safe: they’re non-deterministic, their language-model core may be coerced, and they’re more and more interconnected by way of MCP servers, different brokers, databases, and electronic mail. Turning to the assault floor, Corbridge lays out his “deadly trifecta” (a weak core, dense interconnection, and safety tooling that has not caught up) and contrasts the a long time of layered defenses defending an odd electronic mail inbox with the skinny safety round brokers that take autonomous actions on essential techniques.
The center of the episode is protection. Corbridge orders practices by leverage: least-privilege entry and privilege separation, sandboxing the place possible, imperfect-but-useful guardrails as one layer of protection in depth, and human-in-the-loop for irreversible actions (which he notes is contentious and doesn’t scale). The dialogue closes on detecting a compromised or drifting agent, the worth of watching an agent’s chain-of-thought reasoning alongside its actions, the open-source tooling panorama (together with Corbridge’s personal mission, Adrian), and his central recommendation: construct safety in proactively, outline what good agent conduct seems to be like up entrance, and keep away from bolting it on after brokers have already unfold throughout the enterprise.
Delivered to you by IEEE Laptop Society and IEEE Software program journal.
Present Notes
Associated SE Radio Episodes
Hyperlinks and References
- Safe Agentics (and Adrian, the open-source runtime safety mission): Runtime Safety for AI Brokers | Safe Agentics
- Max Corbridge on LinkedIn (search “Max Corbridge”)
- OWASP Prime 10 for LLM Functions, LLM01: Immediate Injection: LLM01:2025 Immediate Injection
- OWASP GenAI Safety Venture, Agentic Safety Initiative (supply of the agentic top-10 work referenced within the episode): Residence
- “The deadly trifecta for AI brokers,” Simon Willison: The deadly trifecta for AI brokers: personal information, untrusted content material, and exterior communication
- Mannequin Context Protocol: What’s the Mannequin Context Protocol (MCP)? – Mannequin Context Protocol
- Gemini CLI prompt-injection discovering (Tracebit), “Code Execution By Deception: Gemini AI CLI Hijack”: Code Execution By Deception: Gemini AI CLI Hijack | Tracebit
- Zenity Labs “AgentFlayer” zero-click agent exploits (Black Hat USA 2025): Zenity Labs Exposes Widespread “AgentFlayer” Vulnerabilities Permitting Silent Hijacking of Main Enterprise AI Brokers Circumventing Human Oversight
- postmark-mcp malicious MCP server (Koi Safety, the primary publicly documented malicious MCP server): First Malicious MCP within the Wild: The Postmark Backdoor That’s Stealing Your Emails
- Postmark’s personal advisory on the malicious bundle: Safety Alert: Malicious ‘postmark-mcp’ npm Package deal Impersonating Postmark
- Information-poisoning analysis (Anthropic, UK AI Safety Institute, and Alan Turing Institute), “A small variety of samples can poison LLMs of any measurement”: A small variety of samples can poison LLMs of any measurement (paper: Poisoning Assaults on LLMs Require a Close to-constant Variety of Poison Samples )
- Chain-of-thought monitoring (Max references analysis from OpenAI and Google DeepMind on monitoring an agent’s reasoning alongside its actions): OpenAI, “Detecting misbehavior in frontier reasoning fashions” (Detecting misbehavior in frontier reasoning fashions ) and the multi-lab paper “Chain of Thought Monitorability: A New and Fragile Alternative for AI Security” (Chain of Thought Monitorability: A New and Fragile Alternative for… )