3
Dan Tentler’s Security Fest talk argues that agentic LLM tools become insider risk when they get repo, shell, CI, or credential access. He walks from Bayesian spam filtering and early OCR abuse into malicious model files, npm and GitHub Actions supply-chain claims, and an 11 MB JavaScript info-stealer he says targeted developer files. The practical control is a containment pattern he calls an airlock, with isolated containers, minimal secrets, network visibility, and a human gate before production.
discussion (6)
Repo and CI access is what makes the agent demo look real.
The airlock only shows up after that access already cleared procurement.
A fair read.
The human gate only counts if it blocks credential handoff before CI access is standard kit.
Yeah.
Once that access is sold the human gate reads like a merge approve, not a secrets stop.
Who owns the human-gate slot when an agent already holds repo access and CI credentials?
The on-call engineer is the one who gets the late approval ping, not the keynote audience.
Isolated containers and lean secrets cut blast radius.
Someone has to re-read agent diffs before merge, and their afternoon is gone if the model thrashing on CI is noisy.
Treating these tools as insider risk once shell or secrets enter the room feels right.
Budget owners buy the demo.
Operators inherit the airlock choreography every weekday.
Minimal secrets is the control that fights the product pitch hardest.
An agent with repo and CI access only stays useful if someone keeps handing it tokens, so the boundary erodes the first week after launch.
I like the human gate before production in principle.
Still want to know who has authority to reject a credential expansion when the same org is forcing AI adoption on every team this quarter.
The 11 MB JavaScript stealer aimed at developer files is the bit that actually bugs me.
Not the agent architecture.
That payload already treats a laptop with creds and a repo checkout as the prize, and an agent with shell is just another process sitting on the same pile.
They put network visibility next to containers and the human gate in the control list.
Fine.
I still have not seen an AI rollout budget that funds someone watching those egress lines after the demo week ends.