LWIAS

Last week I spoke at API Days in Melbourne, where I gave a talk on the OWASP Top 10 for Agents and how you can mitigate the risks using tools such as the Agent Governance Toolkit and Microsoft Entra Agent ID. My talk was scheduled to be in the last timeslot of the day, which was 4.50pm. That’s a tough spot for speakers and audiences, as conferences can be a long and tiring day. I was fully prepared to speak to about 2 people in the room who decided not to beat the traffic and get their money’s worth. ...

What a fucking week…. If you’ve been living under a rock this week, two critical RCE vulnerabilities were found in PHP, collectively known as PHP2Shell. This vulnerability allows unauthenticated attackers to remotely execute code on vulnerable web servers without logging in or providing credentials, potentially seizing server control or stealing data. These vulnerabilities affected all PHP versions released over the last decade, spanning back to version 5.4. This was particularly scary because according to Wiz, PHP powers 70% of the world’s websites, including banking and government applications. ...

An apology to start off with! I was too busy having fun in Sydney last week hacking with customers, building agents and agent harnesses to provide last weeks update. I got to experiment with Entra Agent ID and Agent Governance Toolkit, two technologies I’m looking forward to building with more over the next few months. I’ve bought myself a set of Wireless Pro from Rode which I need to test out, so maybe I might give this update on my YouTube channel as well as this blog in the future. ...

Last week I’ve been struggling with some kind of illness. My throat was dry and I couldn’t breathe on Friday, so I took a course of pseudoephedrine medication, bought some strepsils, and a nasal spray just to manage it. I was sick the whole weekend and started to recover just in time for Monday! Being an adult is awesome…. Now those of you who are a little too keen for our robot overlords to consume us might point out that agents don’t get sick, but they can be subject to a wide variety of vulnerabilities. Not the greatest segway into this weeks article, but I couldn’t think of anything else. ...

Last week I talked at NDC Oslo about the OWASP Top 10 for Agents where I showed folks the different ways that agents can be exploited. If you’ve turned the news on recently, you’ve probably heard about AI will kill us all and how we’re all doomed. Call me optimistic, but I think we’re currently in the middle of a hype cycle where AI labs are overstating the abilities of the models, and we’re at a point where we’ve seen how powerful agents can be, but we need to be more serious about the harms agents can do, and how we can mitigate those risks. ...