Ahmed AG

Cyber Security | SANS Author and Instructor

[Ahmed AG @aagsec]

@NeelamDesai3000 @paulg It might have been possible 15 years ago or so. It would have been a great solution, but that ship has sailed for the foreseeable future.

[Ahmed AG @aagsec]

@paulg Every time I think that we have seen it all.. New horror stories emerge!

[Ahmed AG @aagsec]

“You cannot secure what you do not understand.”
Agentic AI is creating new attack surfaces faster than most security teams can adapt. Checkout my article at @TheHackersNews :

https://t.co/bV3bzYI2wb

[Ahmed AG @aagsec]

Emergency @SANS Livestream Briefing: Axios NPM Supply Chain Compromise
https://t.co/l6HXLwwCjP

Details here:
https://t.co/Afmu8BSQsX

[Ahmed AG @aagsec]

Big news!
@SANSInstitute GIAC AI Platform Security is coming soon!

https://t.co/GpKicp1odj

[Ahmed AG @aagsec]

Combining all of these capabilities with CLI access is a time bomb waiting to be exploited.
For example, put the malicious scripts in a Docker image 🙃

[Ahmed AG @aagsec]

Testing @openclaw. It’s really cool, but it comes with quite a few security risk! Here are some initial observations..

[Ahmed AG @aagsec]

Using GPT-5.2 and GPT-5.1, the agent resists executing malicious commands.. to some extend!

[Ahmed AG @aagsec]

It has access to many tools! The internet, browsers, CLI, etc. It also has many "interfaces", Telegram for example! Which means many attack entry points and a lot of potential for pivoting

[Ahmed AG @aagsec]

The team acknowledges that there are security risks! You probably do not want to run it locally on your machine! Use a VM of some sort.

[Ahmed AG @aagsec]

I'm claiming my AI agent "CinderClaw" on @moltbook 🦞

Verification: burrow-YW8Y

[Paul Graham @paulg]

Information wants to be free.

[SANS Cloud Security @SANSCloudSec]

⚙️ GenAI agents need controls, not just prompts.

Join Ahmed Abugharbia to explore MCP, secure delegation, and the critical role of authN/authZ in agent-driven AI systems.

📅 Jan 20 | 1:00 PM EST
🔗 https://t.co/DfUgNUIsX5

#GenAI #AppSec #Authorization #SEC545 #AIArchitecture

[Ahmed AG @aagsec]

🚀Big news: SEC545 has evolved🚀

The original SEC545: GenAI & LLM Application Security (3-Day) exceeded expectations.

@SANSInstitute has expanded SEC545 into a new 5-Day course.
https://t.co/sXWXB35lyz

[Amjad Masad @amasad]

If you are an American, you must listen to this.

American hero—25 years service, 12 deployments, Purple Heart, Bronze Star & ARCOM Medalist, etc—talks about the conditions he witnessed in Gaza.

Conditions that your government has a big hand in, and your tax money is paying for.

[Ahmed AG @aagsec]

I'm excited to speak at BSidesSF 2025!
GenAI Application Security: Not Just Prompt Injection https://t.co/zmCNrwJv1k @BSidesSF #BSidesSF @sched

[Ahmed AG @aagsec]

Interesting find!
In SEC545 (https://t.co/1Lx2OH4Yb2) We discuss Langchain and we exploit CVE-2023-36258 (https://t.co/iklraKWY15) using __import__ in Python!

[SANS.edu Internet Storm Center @sans_isc]

Exploit Attempts for Recent Langflow AI Vulnerability (CVE-2025-3248) https://t.co/JF0V9puOft

[Ahmed AG @aagsec]

We have been exploring how AI is reshaping cybersecurity. Now, we want your insights!
Take the @SANSInstitute 2025 AI Impact on Security Survey and help us understand the impact of AI on the field. Your input matters!
https://t.co/wLzel1vDEI

[Ahmed AG @aagsec]

🚨21 Jan 2025🚨
Beta run of @SANSInstitute SEC545: GenAI and LLM Application Security IS ON 🤓
https://t.co/1Lx2OH5w0A

[Ahmed AG @aagsec]

@AcquiredFM live event 😎