Agentic Development Security — Ezra Tanzer, Snyk

Summary

En este vídeo, Ezra Tanzer y Dan Arpino de Snyk analizan los desafíos críticos de seguridad en el desarrollo con agentes IA. Explican cómo la adopción de agentes autónomos introduce nuevos vectores de ataque, como la ejecución de código no probado, la sobreexposición de tokens API y el riesgo en la cadena de suministro de 'skills'. Presentan un enfoque de tres pilares: asegurar lo que los agentes generan, lo que utilizan y sus acciones. Además, realizan una demo de 'Snappy', una herramienta local que ofrece visibilidad, auditoría y guardrails en tiempo real para el desarrollo asistido por IA, permitiendo a los ingenieros equilibrar la productividad con la seguridad sin frenar su flujo de trabajo.

Topics covered

• Evolución de agentes y seguridad
• Limitaciones del protocolo MCP

+6 more topics (full content when you follow the channel)

Transcript excerpt

[music] I'm a product director here at Sneak and going to be talking to you about agentic development security and specifically talking about how we can gain confidence when we use agents um especially as we give them more autonomy. It's a very common theme we've heard in this track and a number of the other tracks um today. Um, I'm not going to go through the full history of LMS, but the model context protocol release was a really big moment. Until then, I don't know what you guys were doing, but I was very often copying and pasting between uh, Aenta clients and some other services. And with MCP, I think people really started to connect this and have a much more um, really connected AI system. U,, and I'm not saying that MCP is the end- all beall, and I may or may not have been amongst the people who were saying that MCP would die at some point last year. Um but it has been a gamecher i…