Evan Sims

security architect. open source contributor.
ios developer. rust engineer.
now → @inferadb @mmntfl
prev → @okta @auth0 @openfga @ushahidi

[Evan Sims @evansims]

One prompt got an AWS AgentCore support agent to hand over its own metadata credentials. AWS calls that expected behavior. Then the agent's role is your blast radius. Scope every public-facing agent like the attacker is already in the chat.

https://t.co/4T8Rl00Oec

[Evan Sims @evansims]

Elastic: eight minutes from infostealer infection to attacker login. Your revocation loop is probably hours. Attackers also drove Claude Code and ChatGPT desktop, which inherit your permissions. Short-lived credentials beat fast response.

https://t.co/kRsJQfrUf3

[Evan Sims @evansims]

NIST's agent identity tenets get the big one right: what an agent tries to do must stay separate from what it's allowed to do. A prompt guardrail asks the model nicely. It doesn't authorize anything.

https://t.co/bStnQa5XbA

[Evan Sims @evansims]

Prompt injection keeps getting treated as a model bug we'll train away. I don't think we will. Once an agent can see private data, untrusted content, and a way out, that content can steer it. Alignment won't close that. The fix sits outside the model, in access it can't override.

[Evan Sims @evansims]

Northflank says treat every env var as decrypted after customers' AI API keys were abused. Railway, Zeabur, now this. The blast radius never changes: a long-lived key in someone else's platform. Short-lived credentials make a breach expire.

https://t.co/VIF9gO7iU3

[Evan Sims @evansims]

Apple's 10-K now warns that AI agents may act without authorization, exceed their permissions, and take actions nobody can undo. A risk factor means it's real. A login check at the door won't stop an agent already inside. Authorize every action.

https://t.co/iHwauKXeyL

[Evan Sims @evansims]

A background check verifies a person once. A Top Secret contractor just pleaded guilty to lending his identity to North Korea's IT worker scheme. The check says nothing about who sits at the keyboard next week. Identity is a daily question.

https://t.co/Uq5eK91bL2

[Evan Sims @evansims]

An attacker used AI agents to reach GitBook's infrastructure secrets, and GitBook revoked every customer API token. Right call. But a global reset means the tokens were too broad and lived too long. Blast radius is a design choice.

https://t.co/t4d6Kct6wA

[Evan Sims @evansims]

Your dev box is an access boundary. A trojanized Claude Code extension on Cursor tried to add an attacker's key to authorized_keys and open a reverse tunnel. Audit SSH keys like admin roles. They are admin roles.

https://t.co/2B9YrPh70y

[Evan Sims @evansims]

There's a distinction I wish more teams drew: consent isn't authorization, and it matters most now that agents act for us. Consent is a one-time yes. Authorization is scoped, revocable, and tied to who acted. Give an agent the yes without the rest and you can't scope or revoke what it does.

[Evan Sims @evansims]

Coding agents install deprecated MCP servers because they pull package names from training data. The model picks the dependency from memory, then runs it with your access. Allowlist MCP servers. Your agent shouldn't shop for code that runs as you.

https://t.co/KXK8e3l2t4

[Evan Sims @evansims]

CVSS 10 in LXD: the API trusted any cert a client added to its own TLS chain. Add a privileged client's public cert as an "intermediate" and you become that client, no private key needed. Checking presence instead of proof is a dress code.

https://t.co/vPl00M9hCy

[Evan Sims @evansims]

Mendix's SAML module accepted replayed assertions in IdP-initiated flows, a bug class it fixed in 2022. A valid signature proves who issued the assertion, not that it's fresh. Track assertion IDs, or turn off IdP-initiated SSO. Signed is not new.

https://t.co/2UMig8kdR7

[Evan Sims @evansims]

Attackers took over Microsoft 365 accounts at 79 orgs with stolen session tokens. No password, no MFA prompt. MFA checks you once at login, then every request rides on the token. Bind sessions to devices. A stolen token is a login your MFA never sees.

https://t.co/w0eTClIA5V

[Evan Sims @evansims]

27 orgs got breached through their apps, not their users. App-only auth skips MFA and user Conditional Access. The issue: secrets that never expire on service principals nobody owns. Cap lifetimes. An unowned secret is a password nobody watches.

https://t.co/5RPzlQOzA7

[Evan Sims @evansims]

VOLTA steals your Microsoft OAuth tokens and Gmail sessions, then asks an LLM to rank you by value. A password reset fixes none of it, because the session is already minted. Revoke sessions and cut token lifetimes. A bearer token is whoever holds it.

https://t.co/qKmVU7osxZ

[Evan Sims @evansims]

The MCP Python SDK accepted tokens minted for other services because it never checked audience. The safe setting stays opt-in until 3.0. Turn it on.

A token valid somewhere is not valid here.

https://t.co/XIXohc4AGA

[Evan Sims @evansims]

Banks block AI agents because the only way in is your password. Descope's Envoy offers delegated sign-in, scoped with Rich Authorization Requests. The agent gets a narrow, revocable grant instead of your identity. Delegation beats impersonation.

https://t.co/CJ19IJw5Cs

[Evan Sims @evansims]

27 orgs got breached through their apps, not their users. App-only auth skips MFA and user Conditional Access. The issue: secrets that never expire on service principals nobody owns. Cap lifetimes. An unowned secret is a password nobody watches.

https://t.co/5RPzlQOzA7

[Evan Sims @evansims]

NIST's agent identity tenets get the big one right: what an agent tries to do must stay separate from what it's allowed to do. A prompt guardrail asks the model nicely. It doesn't authorize anything.

https://t.co/bStnQa5XbA