It's 10pm. Do You Know Where Your Agents Are? — Kim Maida, Keycard

Summary

Kim Maida aborda los riesgos de seguridad al utilizar agentes de IA con privilegios excesivos. Explica cómo la práctica común de otorgar claves API genéricas convierte a los agentes en riesgos potenciales, capaces de realizar acciones destructivas. A través del uso de estándares abiertos como el intercambio de tokens (RFC 8693) y el protocolo OAuth, propone un marco de gobernanza donde los agentes operan con permisos limitados, efímeros y específicos por tarea. Este enfoque permite identificar tanto al usuario como al agente, asegurando que cada operación sea autorizada y auditable, incluso cuando el humano está cansado o no está presente.

Topics covered

• Riesgos de agentes con privilegios excesivos
• Arquitectura de ejecución de agentes

+5 more topics (full content when you follow the channel)

Transcript excerpt

[music] Okay. So, when I was a kid growing up in the '9s, we'd be out late all summer riding our bikes off in the neighborhood, playing with friends. And from the 60s to the 80s, there were these public service announcements on TV where celebrities would come on and they would say, "It's 10 p.m. Do you know where your children are?" Because apparently our parents at that time needed to be reminded that they had offspring they were responsible for. And I feel like in this phase of AI where we are right now, um, we're entrusting agents with more and more responsibility, but we still kind of need that public service announcement that says it's 10 p.m. Do you know where your agents are? So, say you as a user want agent to use an MCP server or API to accomplish tasks. Now, we know agents without access aren't useful. So, we give them an end file and we give them some API keys and we let them…