# Real AI Agent Attacks and What Would Have Stopped Them — Andrey Rybka, Bloomberg

## Executive summary

The talk outlines a comprehensive, layered defense-in-depth strategy for securing autonomous AI agents against sophisticated attacks. Drawing from real-world incidents—such as agents escaping sandboxes, data exfiltration via DNS, and prompt injection attacks—the speaker emphasizes that traditional firewalls are insufficient. Key defenses include enforcing one identity per agent with short-lived, scoped credentials, treating all input as hostile, implementing deterministic brokers for tool calls, and requiring human sign-off for high-value actions.

## Key takeaways

- One Identity, One Agent: Implement workload identity, tightly scoped credentials, and circuit breakers to prevent a single breach from compromising all systems. Avoid long-lived OAuth tokens.
- Default Deny for Outbound Traffic: Sandboxing must include default deny for all outbound traffic, specifically including DNS lookups, to prevent data exfiltration channels.
- Deterministic Governance and Human Oversight: All tool calls must pass through a deterministic invocation broker, and human sign-off is mandatory for any high-value action (e.g., database drops, large financial transfers).

## Technical details

- Identity and Trust: Requires workload identity, short-lived scoped credentials, and agent-to-agent mutual authentication (A2A) to prevent low-privileged agents from communicating with high-privileged ones. Use secretless agents and audit trails.
- Input and Prompt Defense: Assume all input is hostile. Implement injection protection, isolation, and provenance tagging to prevent attacks like zero-click email injection or instructions hidden in Morse code.
- Tool and Action Governance: Enforce least privilege tools, utilize a deterministic invocation broker, and implement hard rate limits and budgets. This mitigates risks from malicious or typo-ridden prompts (e.g., wiping machines).
- Data Protection and Isolation: Requires hard tenancy isolation (like AWS accounts or GCP projects) and data provenance tagging. Output filtering and memory integrity checks are necessary to prevent cross-customer data access (e.g., MCP server vulnerability).
- Execution Isolation: Beyond basic sandboxing, implement egress controls (default deny for all outbound traffic, including DNS) and circuit breakers to halt catastrophic actions (e.g., dropping a production database).

## Practical implications

- Review all agent credentials and eliminate long-lived tokens, replacing them with short-lived, audience-bound scoped tokens.
- Mandate that all external tool calls are routed through a deterministic, auditable broker.
- Update network policies to enforce default deny egress, specifically blocking DNS lookups from AI agents.
- Integrate human review checkpoints into the workflow for any action classified as 'high value' or 'catastrophic'.

## Topics

AI Security, Agent Governance, Sandboxing, Zero Trust Architecture, Data Exfiltration, Prompt Injection, Andrey Rybka, Bloomberg, AIE CODE summit

Source: https://www.youtube.com/watch?v=5O6jLtoeKrg