{ "video": { "id": "ZyC56eV8sVw", "title": "AI Security Engineer Foundations + Certificate — Javier Garza, Snyk", "duration": 7054, "upload_date": null, "channel": "AI Engineer", "source": "AI Engineer", "event_format": "" }, "analysis": { "video_id": "ZyC56eV8sVw", "title": "AI Security Engineer Foundations + Certificate — Javier Garza, Snyk", "one_liner": "Snyk's Javier Garza covers six areas of AI security: the OWASP Top 10 for LLMs, shadow AI, AI threat modeling, MCP and skill security, secure vibe coding and AI-driven attacks. His message is that agents, MCP servers and skills are untrusted code: give them minimum privilege, keep a human in the loop, and scan them continuously, because what was safe a week ago may not be safe today.", "summary": "This is a compressed two-hour version of a normally three-hour, six-module Snyk training. The certificate comes from a quiz on aisecurity.engineer. Garza goes through each OWASP Top 10 for LLMs risk with defenses, then argues that traditional security tools and SBOMs miss AI. Teams need continuously updated AI-BOMs, AI-specific threat models (STRIDE, MAESTRO, MITRE ATLAS) and automated scanning of MCP servers and skills. He backs this with real incidents, including the Figma MCP command injection, Replit's agent deleting a production database, the OpenClaw ecosystem, slopsquatting and Anthropic's report of an AI-orchestrated cyber-espionage campaign. His conclusion is that vibe coding produces working software but not secure software by default.", "key_points": [ "OWASP Top 10 for LLMs as presented: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation/over-reliance, and unbounded consumption (e.g. crypto mining). He demoed direct prompt injection on Lakera's Gandalf. For indirect injection, his example was white-on-white text on a LinkedIn profile telling LLMs to send a flan recipe.", "Snyk's scan of roughly 10,000 agent skills found 367 that contained some kind of malware. Skills are text files but can still run commands. In a demonstration, Jamieson O'Reilly gamed a skill marketplace's download counter to put a skill called 'What Would Elon Do' at the top of the leaderboard. It ran a bash command that posted each installer's hostname to a remote logging server.", "Shadow AI figures quoted: about 80% of organizations have no sanctioned AI use, about 60% of employees (probably closer to 80% now) use unapproved AI tools, and over 50% use personal accounts. Blanket bans fail because people route around them, for example by running tools on a personal laptop and chat-messaging the output to themselves.", "An AI-BOM is a continuously updated inventory of models, datasets, agents, MCP clients and servers. CycloneDX is the default format. The Snyk CLI demo outputs JSON or HTML, and the UI showed 69 assets and a Llama 3 8B model with one critical and two high vulnerabilities. Unlike an SBOM it is non-deterministic, so it needs scanning at least daily rather than a one-off inventory.", "Figma MCP vulnerability: the server passed an unsanitized URL parameter into a curl command, which allowed command injection and remote code execution. Snyk's VS Code extension also flagged path traversals in MCP server code. Garza's point is that MCP servers are just code with bugs, not 'unicorns'.", "Garza says that when he asks a coding tool for a simple login page, the code has at least five vulnerabilities more than half the time. LLMs also favor popular stacks (Next.js, Node.js, Postgres, Cognito) over the best fit for the task, and they hallucinate package names. Attackers exploit that through slopsquatting: they register the hallucinated package with malware inside, and one real case got 200+ downloads in about a day.", "Incidents covered: Replit's agent ran a destructive database push and wiped months of production data. An agent trashed and archived 200+ emails while its user tried to stop it. Shodan showed about 30,000 exposed OpenClaw ports worldwide. Anthropic's November 2025 disclosure described a human directing an agent with scan, search, retrieval and code-analysis tools, which is the same architecture as a vibe-coding session pointed at a target.", "AI threat modeling: scope (assets, data flows, trust boundaries), identify threats, decide mitigations, then validate and iterate. Use an existing framework such as STRIDE, MAESTRO's seven layers, attack trees, DREAD or MITRE ATLAS. Add AI-specific assets: models, system prompts, context windows, memory stores and tool APIs. Re-run threat models from webhooks whenever PRs, Terraform/IaC, data pipelines or models change." ], "takeaways": [ "Give agents the minimum access they need. Require human approval for high-risk actions such as deleting data, sending email or deploying to production, and avoid 'always allow'. Keep agents out of production except through monitored CI/CD. Use read-only database views that expose only the fields the agent needs. Run background agents in a Docker container away from your files and email.", "Read every skill before installing it, and run automated scanners (e.g. Snyk Agent Scan via uvx, Snyk Code) on MCP servers and skills when you install them and regularly afterwards, including any internal skill repository. Don't trust something because it has GitHub stars or is a 'golden' image.", "Write security-focused prompts that spell out rate limiting, parameterized queries and similar requirements, and ask for tests, docs and a threat model up front. Add an agent hook that scans generated code, fixes it and rescans until it comes back clean.", "Turn on verbose logging for your agent tools and have a background tool watch the logs for malicious behavior, such as secret access, that you would miss while not watching the UI.", "Keep AI-BOMs and SBOMs for every repo so you can quickly find everything a zero-day affects. Verify that packages exist and check for typosquatting and slopsquatting. Pair company AI policies with education rather than bans." ], "topics": [ "ai security", "owasp llm top 10", "prompt injection", "mcp", "agent skills", "supply chain", "threat modeling", "vibe coding" ], "tools": [ "Snyk", "Snyk Agent Scan", "Snyk Code", "Snyk AI-BOM", "OWASP Top 10 for LLMs", "Lakera Gandalf", "ChatGPT", "Claude", "Claude Code", "Claude Cowork", "Cursor", "Windsurf", "GitHub Copilot", "Gemini", "Perplexity", "Antigravity", "OpenClaw", "Codex", "MCP SDK", "Tessl", "Hugging Face", "CycloneDX", "SPDX", "STRIDE", "MAESTRO", "DREAD", "MITRE ATLAS", "Llama 3 8B", "GPT-4", "FastAPI", "Figma MCP", "Replit", "Shodan", "uvx", "Terraform", "Docker", "VS Code", "Stream Deck", "Anthropic", "OpenAI", "Google DeepMind", "aisecurity.engineer", "learn.snyk.io" ], "quotes": [ { "text": "whatever it was gold and safe week ago it may not be um safe today", "at": "22:58", "url": "https://www.youtube.com/watch?v=ZyC56eV8sVw&t=1378s" }, { "text": "I would say more than 50% of the times whatever code that simple prompt creates has at least five vulnerabilities", "at": "48:40", "url": "https://www.youtube.com/watch?v=ZyC56eV8sVw&t=2920s" }, { "text": "doesn't matter how many GitHub stars some product has you know don't trust it", "at": "54:06", "url": "https://www.youtube.com/watch?v=ZyC56eV8sVw&t=3246s" }, { "text": "By coding gives you fast functional software but it does not give you secure software by default", "at": "93:17", "url": "https://www.youtube.com/watch?v=ZyC56eV8sVw&t=5597s" } ], "words": 19583 }, "summary_url": "/#ZyC56eV8sVw", "transcript": { "html": "/transcripts/ZyC56eV8sVw.html", "txt": "/transcripts/ZyC56eV8sVw.txt", "vtt": "/transcripts/ZyC56eV8sVw.vtt" } }