# Built Fast, Broken Faster: MCP & AI App Security—with GitGuardian’s Gaetan Ferry

Page: https://stenobird.com/podcast/cyber-sentries-ai-insight-to-cloud-security-6706117/built-fast-broken-faster-mcp-ai-app-security-with-gitguardian-s-gaetan-ferry
Text version: https://stenobird.com/podcast/cyber-sentries-ai-insight-to-cloud-security-6706117/built-fast-broken-faster-mcp-ai-app-security-with-gitguardian-s-gaetan-ferry.md
Podcast: [Cyber Sentries: AI Insight to Cloud Security](https://stenobird.com/podcast/cyber-sentries-ai-insight-to-cloud-security-6706117)
Published: 2026-03-04T11:00:00+00:00
Episode link: https://share.transistor.fm/s/90e71c22
Audio file: https://op3.dev/e/media.transistor.fm/90e71c22/fea5ea68.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/cyber-sentries-ai-insight-to-cloud-security-6706117/episodes/built-fast-broken-faster-mcp-ai-app-security-with-gitguardian-s-gaetan-ferry
Duration seconds: 2324

## Resource

When “Ship Fast” Meets “Secure by Design” in AI Apps AI-driven development is moving at breakneck speed—and attackers are taking advantage of the shortcuts. In this episode of Cyber Sentries: AI Insights for Cloud Security, host John Richards sits down with Gaetan Ferry, security researcher at GitGuardian, to unpack how modern AI tooling, MCP servers, and cloud platforms are reshaping the security landscape. The core problem: the same agentic workflows that boost productivity can also multiply identities, credentials, and blast radius if something goes wrong. After John and Gaetan set the stage, Gaetan walks through a real-world-style vulnerability chain involving smithery.ai, an MCP server registry/hosting platform. It’s a practical look at how “classic” web issues can still show up in brand-new AI ecosystems—and how one small weakness can cascade into bigger supply chain risk. Along the way, they explore why secret sprawl is accelerating, what attackers are hunting for, and why observability is becoming as essential for identities and tokens as it is for infrastructure. Why MCP Servers, OAuth, and Secret Sprawl Are Colliding A big theme is the tension between usability and security: teams want agents that can “do everything,” which often means broad permissions and long-lived credentials. Gaetan explains why adopting OAuth is directionally better than static API keys, but still not a silver bullet in a world where agents need delegated access and tokens inevitably “live somewhere.” John pushes on what builders can do now—especially when new frameworks (and new hype cycles) keep resetting hard-won security practices. The conversation lands on pragmatic guidance: reduce blast radius where you can, inventory identities and secrets, and invest in observability so you can…

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/cyber-sentries-ai-insight-to-cloud-security-6706117/episodes/built-fast-broken-faster-mcp-ai-app-security-with-gitguardian-s-gaetan-ferry/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/cyber-sentries-ai-insight-to-cloud-security-6706117/built-fast-broken-faster-mcp-ai-app-security-with-gitguardian-s-gaetan-ferry.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.