Coffee, Chaos and ProdSec Ep 24 - AI Security Reality Check, When Agents Ship Faster Than Policies
Feb 11, 2026
They unpack how AI agents outpace security policies and create shadow AI across teams. Conversation covers provenance gaps that break incident response and automation that buries real breaches. They debate retrofitting security vs building controls into platforms and how identity chaining can escalate privileges. Practical talk on scaling security with internal agents, spec-driven prompts, and reusable secure platform patterns.
AI Snips
Chapters
Transcript
Episode notes
MCP Vs Skills: Same Problem, Different Form
- MCP servers and skills converge conceptually: both let AI orchestrate APIs and logic but differ in adoption and inspection needs.
- Security will need both code scanning and behavioral analysis to handle these evolving integration points.
Skills Are Often Just Short Prompts
- Cameron notes skills often look huge in marketing but are sometimes just short prompts.
- That mismatch raises real vetting challenges when importing skills into agent ecosystems.
Vet Skills Before Importing
- Build scanners and vetting tools for skills and agent artifacts; treat skill manifests like code to review.
- Use simple checks (endpoints, suspicious prompts) to quickly disallow dangerous skills before importing.