Tanya Janca | Shehackspurple

Secure Coding Trainer, Best-selling author of Alice and Bob Learn Secure Coding & Alice and Bob Learn Application Security. #AppSec she/her 🌻

[Tanya Janca | Shehackspurple @shehackspurple]

**Not everything needs to be a damn AI agent.**

There. I said it. And I will keep saying it.

Warning: hot takes ahead.

Recently, I was teaching a secure AI class, and one of my students was telling me about an AI agent they were building.
1/16

[Tanya Janca | Shehackspurple @shehackspurple]

@talesbytim 💯

[Tanya Janca | Shehackspurple @shehackspurple]

**Not every damn thing needs to be an AI agent!**

There. I said it. 😂 Again.

I've been having conversations with people who are building AI agents and worrying about how to secure them.

And sometimes I find myself wondering...
1/6

[Tanya Janca | Shehackspurple @shehackspurple]

@talesbytim And 10,000% more risk

[Tanya Janca | Shehackspurple @shehackspurple]

https://t.co/3WETqeh8p5

#AIAgents #AISecurity #AppSec #DevSecStation
6/6

[Tanya Janca | Shehackspurple @shehackspurple]

I talk about this (and a whole lot more about least privilege and agent permissions) in the latest episode of DevSec Station:

🎧 *What Permissions Should You Give an AI Agent?*

Watch on YouTube or stream/download it on your favourite podcast platform.
5/6

[Tanya Janca | Shehackspurple @shehackspurple]

@ZackKorman Loooooooool

[Tanya Janca | Shehackspurple @shehackspurple]

Guess who's in the nation's capital this week? 😉🤗💜

#TanyaExplores

[Tanya Janca | Shehackspurple @shehackspurple]

@deeponailabs Filesystem or harness (the control between the agent and OS)

[Tanya Janca | Shehackspurple @shehackspurple]

**Telling your AI agent not to do something is NOT the same as preventing it from doing that thing.**

Imagine giving an AI coding agent access to your entire filesystem.

Then you tell it:

"Only modify files inside this project directory."

Very clear instructions, right?
1/5

[Tanya Janca | Shehackspurple @shehackspurple]

@florescodes Don't use an agent.. Instead use regular software to do what you need. A lot of the time, that's enough, and it's less risk + easier to control. 🌞

[Tanya Janca | Shehackspurple @shehackspurple]

@jacobdevhq The filesystem. Filtering the requests would fall to the harness.

[Tanya Janca | Shehackspurple @shehackspurple]

🎧 Watch on YouTube, stream, or download on your favourite podcast platform.
https://t.co/12WYqlRAGr

#AISecurity #SecureCoding #AppSec #DevSecStation
5/5

[Tanya Janca | Shehackspurple @shehackspurple]

Question: **How are you restricting your AI coding agents?** Are you using sandboxing, limited tool permissions, approval gates, or something else?

This is one of the lessons in the latest DevSec Station episode, *What Permissions Should You Give an AI Agent?*
4/5

[Tanya Janca | Shehackspurple @shehackspurple]

@SymoneBeez Congratulations! Wowza!!!

[Tanya Janca | Shehackspurple @shehackspurple]

@securestep9 @owasp 💜💜💜💜💜💜💜💜💜💜