Episode
Built Fast, Broken Faster: MCP & AI App Security—with GitGuardian’s Gaetan Ferry
- Published
- Mar 4, 2026
- Duration seconds
- 2324
- Processing state
not_requested- Canonical source
- https://share.transistor.fm/s/90e71c22
Actions
POST https://stenobird.com/v1/public/podcasts/cyber-sentries-ai-insight-to-cloud-security-6706117/episodes/built-fast-broken-faster-mcp-ai-app-security-with-gitguardian-s-gaetan-ferry/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/cyber-sentries-ai-insight-to-cloud-security-6706117/built-fast-broken-faster-mcp-ai-app-security-with-gitguardian-s-gaetan-ferry.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
When “Ship Fast” Meets “Secure by Design” in AI Apps AI-driven development is moving at breakneck speed—and attackers are taking advantage of the shortcuts. In this episode of Cyber Sentries: AI Insights for Cloud Security, host John Richards sits down with Gaetan Ferry, security researcher at GitGuardian, to unpack how modern AI tooling, MCP servers, and cloud platforms are reshaping the security landscape. The core problem: the same agentic workflows that boost productivity can also multiply identities, credentials, and blast radius if something goes wrong. After John and Gaetan set the stage, Gaetan walks through a real-world-style vulnerability chain involving smithery.ai, an MCP server registry/hosting platform. It’s a practical look at how “classic” web issues can still show up in brand-new AI ecosystems—and how one small weakness can cascade into bigger supply chain risk. Along the way, they explore why secret sprawl is accelerating, what attackers are hunting for, and why observability is becoming as essential for identities and tokens as it is for infrastructure. Why MCP Servers, OAuth, and Secret Sprawl Are Colliding A big theme is the tension between usability and security: teams want agents that can “do everything,” which often means broad permissions and long-lived credentials. Gaetan explains why adopting OAuth is directionally better than static API keys, but still not a silver bullet in a world where agents need delegated access and tokens inevitably “live somewhere.” John pushes on what builders can do now—especially when new frameworks (and new hype cycles) keep resetting hard-won security practices. The conversation lands on pragmatic guidance: reduce blast radius where you can, inventory identities and secrets, and invest in observability so you can…