Episode
Reducing Attack Surface & Evaluating Efficiency in Agents - Itamar Apelblat, David Goldschlag - ASW #389
- Published
- Jun 30, 2026
- Duration seconds
- 4359
- Processing state
not_requested
Actions
POST https://stenobird.com/v1/public/podcasts/security-weekly-podcast-network-audio-319755/episodes/reducing-attack-surface-evaluating-efficiency-in-agents-itamar-apelblat-david-goldschlag-asw-389/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/security-weekly-podcast-network-audio-319755/reducing-attack-surface-evaluating-efficiency-in-agents-itamar-apelblat-david-goldschlag-asw-389.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
SquidBleed reveals another vuln that's been lurking for decades, but its real lesson is in managing an attack surface. Regardless of whatever programming language you use, removing code is one of the best security steps you can take, followed by changing default configs to turn off uncommon features and ancient protocols. The Linux kernel's removal of strncpy is another example of managing attack surface by replacing a notoriously misused and ambiguous function with more specific versions that better match the developers intent. It was a six-year journey for the kernel, but one that should remove a class of vulns and, importantly, improve performance. Then it's on to agents with a discussion of the newly released OWASP AISVS and yet another example of evaluating LLMs as code reviewers. Agentic AI Has an Identity Problem AI agents are already running inside enterprise environments, operating on credentials, API tokens, and cloud roles that most security teams have never inventoried. When an agent acts autonomously across production systems, the security question is no longer just what it can do but who it is and whether that identity is governed at all. Itamar Apelblat, Co-Founder and CEO of Token Security, discusses why identity is the right lens for understanding agentic AI risk and what practical steps security teams can take now. Segment Resources: https://www.token.security/product https://www.token.security/lp/ai-agent-identity-security-buyers-guide-ebook https://www.token.security/enzo https://www.token.security/ai-agent-calculator This segment is sponsored by Token Security. To lean more, visit https://securityweekly.com/tokenidv Blended Identities and the challenge of IAM for AI AI agents aren't quite human and aren't traditional machines. So how do you secure…