Tech Talks · 1:05:16

Securing Code You Didn't Write: The AI Era's New Threat Model

Coding agents expand the software supply chain to include repositories, configuration, comments, connectors, and tool output. Rome Thorstenson examines reported attacks and outlines practical controls for permissions, secrets, prompt injection, and defense in depth.

Rome Thorstenson
Rome Thorstenson
Sep 17, 2026
Xin

Chapters

  1. 00:00 Welcome and session framing
  2. 00:01:30 Talk scope and threat model
  3. 00:03:18 Why Rome started Rafter
  4. 00:04:15 Vibe-coded software risks
  5. 00:08:45 Agents beyond autocomplete
  6. 00:12:11 Untrusted input meets execution
  7. 00:14:52 Supply chain risks and dependencies
  8. 00:17:29 Coding agents as attack surfaces
  9. 00:19:32 Poisoned agent configuration files
  10. 00:24:12 Prompt injection across coding tools
  11. 00:25:52 MCP and arbitrary command execution
  12. 00:31:09 Expanded agent threat surface
  13. 00:38:03 Vibe-coded apps and internal tools
  14. 00:43:44 Defense in depth for agents
  15. 00:45:33 Prompt injection beyond coding
  16. 00:47:57 Practical security takeaways
  17. 00:52:00 Q&A: baseline agent security
  18. 00:54:42 Q&A: security checks in CI/CD
  19. 00:57:17 Q&A: managing secrets safely
  20. 01:00:56 Q&A: future of agent security
  21. 01:03:50 Closing remarks and next session

AI coding security · coding agents · Software supply chain security · prompt injection · MCP security · Agent sandboxing · Secret management · CI/CD security · Defense in depth

Summary

The security boundary changes when a coding agent can read untrusted material and act with developer privileges. Rome Thorstenson maps that path across repositories, configuration files, comments, connectors, plugins, and MCP tools, using reported incidents to show how instructions can cross into execution. His practical guidance centers on reducing what an agent can read and do, keeping credentials out of chat and behind purpose-built tools, and applying defense in depth. Security feedback should also move into design, implementation, and QA rather than waiting for a final review or dependency audit.

Watch next

More from the studio

Operationalizing LLMs: From Prototype to Production1:02:51Tech Talks

Operationalizing LLMs: From Prototype to Production

Yogiraj Awati shares how Instacart moves LLM applications beyond prototypes through retrieval, offline and online evaluation, guardrails, observability, and provider fallbacks. Two case studies cover recipe ingestion and Carebot support workflows with API-backed actions and human handoff.

Yogiraj AwatiYogiraj Awati·Sep 17, 2026
Beyond the DAG: Building Agentic Workflows That Loop, Branch, and Scale1:17:55Tech Talks

Beyond the DAG: Building Agentic Workflows That Loop, Branch, and Scale

Agentic workflows loop, branch, retry, and trigger new work instead of following a fixed DAG. Santosh Kumar Radha explains how AgentField uses typed functions, structured outputs, stopping and escalation patterns, event triggers, and controls for scaling, identity, and authorization.

Santosh Kumar RadhaSantosh Kumar Radha·Sep 17, 2026
Building Trustworthy Financial AI: Governance, Bias, and Mechanistic Insights48:04Tech Talks

Building Trustworthy Financial AI: Governance, Bias, and Mechanistic Insights

Fabrizio Dimino examines why financial LLM recommendations can change when option order changes. He connects positional-bias tests and mechanistic interpretability with finance-specific red teaming, risk-sensitive scoring, model validation, and AI governance.

Fabrizio DiminoFabrizio Dimino·Sep 17, 2026