Prevent agentic identity theft

Hello, and welcome to the Stack Overflow podcast, a place to talk all things software and technology.

I'm Ryan Donovan, your host, and today we're talking about security for local agents.

And my guest today is Nancy Wang, CTO at One Password. Welcome to the show, Nancy.

Yeah, thanks so much for having me.

Of course, of course. So before we get into the topic, we'd like to get to know our guests a little bit.

Can you tell us how you got into software and technology?

I am very lucky that my father is an engineer. He's the actually very classic engineer, not this, you know, right software.

Nothing's really real engineer, but rather, you know, grew up fixing cars in northwestern rural Wisconsin.

He's a muddler just by training. And so whenever he would take me to his workplace, things were real.

Like we could hold pieces of metal. He showed me his mass spectrometer.

We played with different machines. And so for me, it was that early age of, wow, like I really love understanding how things come together, how to take it apart, and also when stuff breaks.

Yeah, so that really started, you know, my love of engineering then went on to do engineering East Coast at the University of Pennsylvania, where it was really that kind of combination of, okay, how do you solve problems that benefit humans, but also how do you build businesses?

And so I've always been kind of a product-minded engineer by training, but certainly now that's let's self to now exploring the next frontier when it comes to how do we assign agents and identity?

How do we make sure that agents don't go rogue and start hunting humans, you know, and all the above?

That's right. The whole anti-terminator squad, I appreciate it.

Exactly.

So, you know, with local agents to, you know, a kind of naive view, it might be like, oh, those are more secure, right? There's no traffic coming in.

It all exists on your computer, but suspect that's not the case.

What is the security risks profile for local agents?

And don't take my word for it. In fact, actually, Elon Musk today was reposting Jason Meller from the one password team had written, actually pretty detailed blog about all the security risks with Cloudbot, now known as boldbot and openplock, right?

And in fact, actually, right, before, you know, I had made this prediction that local agents are going to be the predominant way that folks run agents, at least for the next fall to 18 months.

And, you know, I said that before Cloudbot came out or really, you know, right around the time, right?

So, you know, obviously that has snowballed into, now you have a bunch of security researchers all doing threat analysis, right?

And security risk analysis on this open source agent, including one password. And, you know, look, this is kind of real proof, right?

That local agents are not theoretical. Like, it's out there now. Like, you can't stop it.

And I think in terms of, you know, unique security challenges that it brings, Cloudbot running on your, let's say, device, and this is why we say at one password, please don't run it on your work laptop.

In fact, actually, we have now ways to understand if you are, because it has access to the real execution context.

So, when we think about, like, files, repos, you know, terminals, even browsers and, you know, local tools to your dev environment, right?

Those are all now accessible by Cloudbot. So, if you think about what it can do with this tremendous access of very sensitive information and tools, well, that blast radius is massive.

And so, this is probably why, you know, probably saw, you know, a run to the Apple store for Mac minis, right?

Because, hey, I don't feel comfortable running it on my personal laptop, because I might have bank account information, sensitive documents in my file system, local disk, so on, so forth.

Let me actually go get a completely new, you know, mini computer to actually run this.

A lot of people have been talking about agent sandboxing, whether that's in a cloud environment or locally.

And I've been talking to folks about, do you take your agent and mountain on the VM? Like, how do you actually sandbox it?

I just feel like software repeats itself, right? And that's kind of the cycle, which is, you know, I remember when I first started out in industry, now I'm like dating myself about 15 years ago.

Right, it was one of the early builders at a company called Rubric, right, which did VMware backup recovery, that was our first product.

So back then, right, we were thinking about, oh, virtualization, right, this separation of compute memory and processes.

So now we're thinking about, you know, agents and how file systems, right, that's, you know, kind of a big thing as a storage nerd is file systems now are at the forefront again, right, because agents work through a file system by accessing files.

Right, and also this concept of, you know, separating, as I mentioned, right, memory compute and other processes through sandboxing.

In fact, actually, I will point, maybe you can share the link as well, one of our, you know, BPs of engineering heads of AI at one password actually did a demo with a swarm of agents doing, and I think the use case they had done was DevOps.

So over 500 agents, agents swarm and just understanding what agent is doing what and basically limiting the access of any one particular agent to a specific set of files and context, right.

And so I think that's going to become certainly more prevalent as we're not just using one agent, but potentially a swarm of different agents like, for example, how cursor, you know, uses a swarm of agents to build a browser in my opinion, part of our everyday life in the next couple months.

Are we just like reinventing user access controls for agents? Is it going to be like active directory for agents now?

Something like that, although I feel like with every reinvention, you get a little different flavor, right. It's like, hey, not vanilla ice cream, but like vanilla honeysuckle, clearly I'm hungry, something about food, right.

But that's kind of how I would say software reinvents itself. Yes, in fact, actually I was chatting with the head of agent security at one of the big model providers.

Right. And how are they thinking about agent security and really goes down to two layers of the staff right now, which is the identity layer and the network layer.

And certainly in the identity layer, I mean, sure, we've had, you know, concepts around workload identity for a very long time, right. Spiffy, that was really created by Google engineers, Spire and all these different protocols to vend, right, or issue agents and identity.

But obviously, you know, we're also thinking like, is that something that still holds in the age of AI where agents are femoral to get spun up, spun down, right.

You have many of them. And so does the identity at the time of issuance actually match the identity at time of execution sometimes not, right.

And so this means there's tons of actually very interesting papers I've been reading lately about DIDs or even, you know, verifiable digital credentials, which is something that we're very big about here at one password.

But how can you actually verify the identity of an agent, right. Obviously, it's very straightforward if that agent let's say belongs to Ryan and that agent is Ryan's calendar agent.

Well, it's very obvious what access, what permissions, what ACLs, right, but like let's bring back ACLs from the past, right, that that agent should have access to.

But what about in a world where you have a fleet of agents that are acting as SREs, right in that demo use case on behalf of your company, right.

What happens? Where does chain of custody come in, you know, where does accountability come in.

Yeah, and you talked about agents being spun up, spun down, that probably means that this identity has to be stored somewhere repeatable, reusable, redeployable.

How do you do that safely? Like it almost seems like you need credentials to get the credentials at that point.

Absolutely, right. And this is something we're thinking a lot in house today, which is, hey, you know, as let's say when you have your private key and your public key, yes, you can log into your vault and access your credentials.

Well, what if you also want your agents to be able to access your credentials and also you kind of bring in this almost concept of intent, because is it agent actually acting in the way that you intended to or is it just going rogue and doing all sorts of funky things with your credit card, for example.

The concept of intent, the context around why agents will take certain actions along with who spawn that agent or who is responsible for that agent.

There's just so many more attributes and signals that go into what makes up an identity, then there ever was in the past.

Sounds like there's a lot more to security than, you know, a standard programmer standard user. It's like to worry about the files, you have to worry about the tools that they're using.

But now you have to worry about it misusing or hallucinating or doing bad things with the tools and files that they have.

It's an arms race because if we think about, you know, a couple months ago, and there still is, right, a whole slew of MCP gateway solutions, which is, all right, if we enforce one choke point, right, for where, you know, calls are going to come from.

We can then monitor, observe and govern those calls. And now you have skills you can't determine when and even if an agent will call a particular skill.

So in the case of, let's say, save credential handling, which is what, you know, we're all about for humans, machines and agents.

Well, how can you guarantee that the agent is going to call that skill? And so that's where a lot of our thinking is today, right, because you can't predict the output based on the input with agents.

The wide number of skills that are being added to things, especially on the open claw or moldbook or cloud, whatever it is at this point.

We'll wait for the next name change in another week or so.

There you go. It has a sort of open registry that people can add, and it's turned out that several of those skills are malware.

How do you protect against that sort of attack?

Yeah, I mean, that's something that's top of mind, right, because it goes back to the intent of the agent, right, to the agent, it might just simply be calling like a skill, right.

And this is where, again, Jason wrote about this where it can easily be calling a skill, right, that is like to a malware package that you might not even know about, right.

And so this goes back to the use of agents and production is going to quickly outpace the guard rails and the controls that we have for today with existing security tools.

There used to be this thinking that, hey, let's just control where we use agents and maybe adoption will follow a paved path.

Now, I think that especially with open source projects like open claw, the doors have busted open, right.

The floodgates have opened, like people are using in production.

And so how do you apply guard rails after the fact?

And so, especially here, one password, credentials are keys licking them, right.

And so if you don't have a credential, especially for in the AI world, API keys, SSH keys, those are very critical credentials for developer or their agent.

And so governing the access thereof, right, becomes the choke point.

How do you govern the access of a credential store when that credential store can be accessed by any given sort of program spun up like any disposable agent?

Yeah, so some of our thinking and this will evolve as I'm sure you'll see in our product offerings, right, is, you know, because we are actually available on every local endpoint for our customers through our device trust that's installed on the local endpoint.

We have signals that not many people have, which is runtime signals, user behaviors, was sort of software, they're running locally, what types of packages exist.

So with all of that telemetry, it just gives us much, much more, I would say richer signals available to say, okay, is this access permitted or is this a malicious actor because it's user behavior is way off the charts.

So I would say that's a lot of signal plus, you know, being on device, there's also past keys, right, biometrics.

And, you know, we acquired a company a couple years ago called passage that we're using, it's infrastructure into our past keys management, for example.

So all of that is included in verifying the identity of the individual or the actor.

And then that will then lead to us being able to broker access and notice how, you know, I'm kind of making a big deal about brokering and not giving.

And the reason for that is giving access in my right means sort of long lived, hey, I'm going to just hand you the keys to the house and the analogy that I like to use is instead of giving the master key to the house, right, the entire house with however many rooms.

Right, you give a badge that accesses one room for, let's say, five minutes, right, while you as a human are even in the loop and monitoring.

And so that's just orders of magnitude different in terms of security guarantees and frankly, just overall trust, which as I've heard from, you know, CSOs that I speak with, trust is the biggest barrier to wider spread adoption of agents in the enterprise.

That's sort of brokering access is that sort of like almost like practicing a call like during a token and a intermediary and then just doing past loops.

That's one method, right, is certainly yes, the reverse proxy that we're all quite familiar with, right, and then, you know, whether it's a loss or upstream provider, etc, and then us being able to lease out the token for a very specific amount of time for what that Asian is intending to do.

That's certainly one method, but, you know, regardless of whatever method we end up using under the hood, our ethos is always simplicity is one of the reasons, you know, customers have really enjoyed using one password forever is that we're simple, easy to use and most oftentimes it just works.

So that's kind of the ethos that we want to carry as well to our emerging Asian security platform.

The attackers try to get the credentials from the source, but if you have a credential store, then you have like a spectacular thing to steal.

How do you provide the interest security on a credential store over just credentials?

Well, we can certainly certainly link our security white paper, but it's something that we're actually really, really proud of.

In fact, I'll call it a cronjual of one password is our zero knowledge architecture.

So through a combination of public key and private key, which only you as a user has access to your private key, it's almost like a bank vault, right?

Just because you have one key doesn't mean that you can unlock that vault.

And so with both keys present, then we can actually see into the content and actually what that means is even as the provider one password, we actually can't see into your credential vault.

So please make sure that you don't lose your private key and your recovery key, right? Otherwise, give us a longer conversation.

And of course, any, let's say operations that we do on to your credentials actually all happen within a confidential computing enclave that we built in house.

And so that means, you know, every memory separated from storage, so we can't see what's happening to your credentials.

And that we use, for example, when you're auto filling credentials on the browser soon, you know, for example, when we have agents handling credentials,

all of that is going to be done inside our confidential computing platform.

Is it still open to brute force attacks and are those brute force attacks like even reasonable?

I'd have to probably ask my crypto expert here, but I would imagine given that we've had a zero breach history that we've probably had the team thinking about this.

You know, I know that there's certain cryptographic methods like the SHA 256, which are basically unbreakable and using as sort of PGP type key probably helps.

So you have for the credential story of a sort of private public key that works the same for agents.

So with agents, at least right now, the design thinking is most agents can be associated back to human.

And so this is where, you know, as the ensuing human agent centric credential store right for the global world.

I can't even say workforce because we have actually millions of consumer customers as well in addition to enterprise users.

And this is actually one of the ways that one password is special and why, you know, I joined the company is it's very rare to have that split across two segments, very different segments in this cybersecurity world.

So in that case, right, if you're an agent and you're delegating authority to your agent, well, then you've already authenticated into one password as yourself, this public private key.

You know, as we've seen with the open clause, one of the superpowers of it is you basically give it access to everything.

Are there ways to put some guardrails on that access to everything.

So it's not like texting credit card number to all your friends basically.

Yeah, so this goes back to isolation of runtime environment, right.

So if you're a runtime environment is isolated and again, the demo really I showed this in action.

You know, if an agent is only given access to certain file paths, for example, then, you know, that's one way to restrict access.

Obviously, I think that thinking will continue to evolve.

Another interesting thread, maybe what we can pull on in the future is also how do the underlying substrates evolve as agent access becomes more prevalent, right.

So today, we often think about, you know, file system, either as, let's say, Amazon S3, which object store, but could be used as a file system or, you know, elastic file system or the like as agents get more prevalent in doing, let's say, you know, code generation activities or even acting as infrastructure engineers.

Do the underlying substrates like S3, right, become S4, right.

So that's kind of the thinking is that do they also evolve to meet the security needs of agents?

Do you expect everybody with their Mac mini is do expect that Mac mini to evolve their underlying file system substrate to just make it whatever a park cat system or whatever.

I would hope so certainly, you know, I was my security friend. I would certainly hope so such that, you know, Jason who wrote the blog showed with me that he had just installed it on his personal laptop.

A few days before writing the blog and it started autonomously texting his wife and asking her about her day.

I mean, that's obviously very benign use case, but imagine if that open claw now has suddenly had access to your email was actually sending out emails on your behalf from your work laptop that certainly enters a whole new era.

Sure, that's a weird future of sending, you know, messages to your spouse or whatever.

Do you ever wonder that this level of local agent access is a bit too dystopian?

I think this goes back to, you know, what we talked about earlier, which is at this point, people are so drawn like the productivity gains available via AI that they're just going for it.

Like they're going to use it whether or not you firewall them or not right and so I think club was a great use case just given how viral it's gone.

How many stars on GitHub it's trending right I think it reflects that emotional urge from human beings of, you know, we're going to use this to help us, you know, have a better quality of life.

Now, with that said, right, that's going to give rise as we talked about during this episode to whole slew of problems around access around last radius, right around unrestricted permissions of access that are going to come as an afterthought.

So for all those folks who, you know, did a run on the Apple store for Mac minis, sincerely hope that they read our blog and they capture things about, you know, how to not give it access to certain things or how to restrict access or sandbox.

For a individual user, is it a viable solution to have like the swarm of 500 agents as a like user access barrier.

I think it depends on who you are if you're, you know, hacker hobbyist potentially right because look, I think it'd be cool to spin up a swarm to build a browser in a day or even to, you know, reimagine what the sort of next evolution of our UI could look like, for example.

You know, I think those are all great use cases. Obviously, of course, there's also a lot of nuances involved with, for example, today are infrastructure operations that could likely benefit from a swarm of agents.

Like you said, you also have a lot of consumer users and I think I worry about once this sort of local agent phenomenon hits the regular consumer.

I mean, my dad texted me today just to be like, and throw pick, do we need it? Is that a thing we need? And I was like, they're going to get so beat up once they have agents access everything right.

I guess my hot take right for the future is agents are going to become almost like the equivalent of a thin client right with really the model acting in the back as a server or some sort.

And so the question then becomes what happens to essentially the UIs that we know of and are familiar with today.

Well, it just becomes skills that an agent calls and in the future, instead of browsing the internet, which might already date us by the time this episode comes out.

Hey, what's the weather? You might just simply ask your, you know, Claude, right, Claude cowork or Claude code or whatever use.

Hey, what's the weather today and should I, you know, bring an umbrella or if I don't have one, let's go buy one.

And what normally would take you like browsing through maybe three websites like weather dot com Amazon dot com right with your credit card could all probably be done via like one prompt.

I truly do think as this starts becoming part of our everyday life that becomes the way that we access most.

I'm not sure if it's even called applications at that point, but most services.

I almost wonder on that if the agent miss the AI is just going to be hidden from everybody.

You know, I've seen agents embedded into SaaS applications as like here's a button here's like some config fields and just press a button.

And it's not necessarily an agent. It's just a feature.

That could very well be what's true in six to 12 months. I mean, just given how things move around in this day and age.

I used to say, you know, I have predictions for the next three to five years.

No, these days I say I have prediction the next three to six months.

If you have a prediction for outside of the six months, what's your spiciest ones or what is the one you think is most interesting to drop on people?

Yeah, I mean, the most interesting one is UX UI is not going to be what it is today.

As I mentioned, it's likely just going to be an agent calling a skill.

And I think the power or the influence is going to come from folks who have data mode.

Because building an app itself won't be that hard anymore with platforms like lovable and etc.

I've seen things like the temporary UI that this sort of on the fly UI.

Do you think that's a real possibility?

So I know it's actually this one company that's doing very cool things called Flint.ai, great founder by the way.

And what they're doing is essentially on demand or dynamic front ends, right websites.

That could be a thing. And certainly it depends on how specialized we want to be.

Which is, hey, Ryan comes to a website.

We know that he is a airplane hobbyist.

And so if he goes shopping, we're going to present him with things that appeal to him.

That could be the way the future.

I've sort of also thought that there's going to be one sort of front end piece to everything.

One text box that has all the skills.

And this is where, as one password, we have over billion credentials that folks have stored with us.

So that's truly our crown jewel is the fact that we've stored them for a very long time.

You know, folks trust us with their digital lives.

And the way that we continue keeping them secure is going to be why they trust us to also keep their agents secure.

Well, this is why we're also doing a lot of work internally to make sure that we're up to snuff when it comes to post quantum.

I mean, that's another category.

I would say, you know, as agent security platforms are evolving so, so quickly,

the question around agent identities is going to remain forefront.

And certainly the ability to, for example, do a chain of custody or tie an entity back to a human to another machine or to a corollary or a swarm of agents is going to be the winning recipe.

So I'm super excited to see, you know, obviously what we do at one password,

but also the broader industry and how we're going to solve this challenge.

Well, it is that time of the show again where we shout out somebody who came on to stack overflow,

dropped some knowledge, shared some curiosity and earned themselves a badge.

Today we're shouting out the winner of a populist badge.

Somebody who came on to stack overflow dropped a little knowledge and had an answer that outscored the accepted answer by 10 or more points.

Today we're shouting out, but need to barati for answering how to know the version of currently installed package from yarn dot lock.

If you're curious about that, we'll have the answer for you in the show notes.

I'm Ryan Donovan. I edit the blog and host the podcast here at stack overflow.

If you have comments, questions, concerns, topics to cover, please email me at podcast at stack overflow.com.

And if you want to reach out to me directly, you can find me on LinkedIn.

And thanks so much for having me today on the podcast, Ryan.

My name is Nancy Wang, the CTO at OnePassword.

And if you want to drop me a line on what you're thinking about different agent identity, you know, methods,

and drop me an email at Nancy.Wang at OnePassword.com or hit me up on LinkedIn.

All right. Thank you for listening everyone and we'll talk to you next time.