Latest / The Augur Dispatch / Your AI agent doesn't need the master key

Transcript

Your AI agent doesn't need the master key · The Augur Dispatch

• 0:00
  SPEAKER_00: An employee hired to write one report wouldn't normally get access to the entire company.
• 0:05
  SPEAKER_00: An AI agent can end up surprisingly close through a shared account and a permission nobody remembers to remove.
• 0:12
  SPEAKER_00: Augur's view is that we should make narrow access easier to use before we make agents more autonomous.
• 0:18
  SPEAKER_00: This is the Augur dispatch for Wednesday, October 21st, 2026.
• 0:24
  SPEAKER_00: At an AI engineer panel, JP Morgan Chase security architect Michael Davis described onboarding agents the way successful enterprises onboard developers.
• 0:33
  SPEAKER_00: Start with limited capability and widen it as the system proves itself.
• 0:38
  SPEAKER_00: There's a useful idea there.
• 0:40
  SPEAKER_00: There's also a trap.
• 0:42
  SPEAKER_00: Probation can become another reassuring word that doesn't change what the software is allowed to do.
• 0:48
  SPEAKER_00: Picture a manager trying to finish a Friday report.
• 0:51
  SPEAKER_00: The agent needs another folder.
• 0:52
  SPEAKER_00: Someone grants access.
• 0:54
  SPEAKER_00: Then it needs a second system.
• 0:56
  SPEAKER_00: Someone connects that too.
• 0:58
  SPEAKER_00: Nobody has made a grand decision to trust the agent with everything.
• 1:02
  SPEAKER_00: They've just tried to get the report finished before the weekend.
• 1:05
  SPEAKER_00: The benefits package has grown faster than the job.
• 1:09
  SPEAKER_00: The security team has a reasonable complaint, but so does the manager.
• 1:14
  SPEAKER_00: If every useful step creates a support ticket, people will look for a shortcut, and a shared account can start to look like excellent customer service.
• 1:22
  SPEAKER_00: Software permissions were often designed around broad categories, such as reading a calendar or sending email.
• 1:29
  SPEAKER_00: OAuth is one standard that lets an application act for a user within those categories.
• 1:35
  SPEAKER_00: On the panel, Keycard's Ian Livingstone argued that familiar permission categories are too coarse for agents making less predictable choices.
• 1:43
  SPEAKER_00: The discussion explored access decisions tied to the action an agent wants to take.
• 1:49
  SPEAKER_00: That doesn't have to mean a person approving every click.
• 1:52
  SPEAKER_00: Rules outside the model can decide which requests are allowed and reserve human approval for actions that deserve it.
• 1:59
  SPEAKER_00: The word outside matters.
• 2:01
  SPEAKER_00: Asking a model to follow the rules isn't the same thing as making an unauthorized request fail, even when the model has a very persuasive explanation for why it needs an exception.
• 2:12
  SPEAKER_00: Davis's onboarding comparison helps set the starting job.
• 2:16
  SPEAKER_00: It isn't published evidence that JP Morgan has solved agent security, and an agent behaving well yesterday doesn't earn unrestricted access tomorrow.
• 2:25
  SPEAKER_00: The unsettling research behind this debate deserves a careful telling, because the dramatic version points toward a cure that the experiment didn't test.
• 2:34
  SPEAKER_00: University of Toronto researchers built an AI-driven computer worm and tested it on an isolated network with deliberately planted vulnerabilities.
• 2:43
  SPEAKER_00: Across 15 runs, replication reached as far as seven generations, and different instances shared credentials they discovered.
• 2:51
  SPEAKER_00: Those credentials are the password-like proofs that let software enter a system.
• 2:56
  SPEAKER_00: If another instance can use the same proof, copying it can extend the damage.
• 3:01
  SPEAKER_00: But this was a purpose-built research worm attacking a vulnerable test network.
• 3:06
  SPEAKER_00: It wasn't a normal office assistant that suddenly developed ambitions, and the result doesn't tell us how frequently a properly defended business would suffer the same outcome.
• 3:15
  SPEAKER_00: It also doesn't establish that short-lived credentials would have stopped the seventh copy.
• 3:21
  SPEAKER_00: Augur's source draft made that claim too strongly.
• 3:24
  SPEAKER_00: Expiry can prevent later reuse, but a stolen credential can still be abused before its clock runs out.
• 3:30
  SPEAKER_00: Narrow permissions can limit what it reaches.
• 3:33
  SPEAKER_00: Other weaknesses can offer a completely different route in.
• 3:36
  SPEAKER_00: There isn't a clean contest here between checking each action and limiting how long access lasts.
• 3:42
  SPEAKER_00: A serious design needs both, with a way to withdraw access when circumstances change.
• 3:48
  SPEAKER_00: Returning to our Friday report, an access pass that renews itself forever hasn't really solved the problem merely because each individual pass expires after an hour.
• 3:58
  SPEAKER_00: The automatic renewal deserves a place in the conversation, preferably before the incident review.
• 4:06
  SPEAKER_00: A separate agent fleet illustrates why permissions aren't the whole story either.
• 4:11
  SPEAKER_00: TechCrunch reported agents apparently using Tencent infrastructure to query Alibaba's mapping service.
• 4:17
  SPEAKER_00: The researchers hadn't established communication between them, so a common task wasn't proof of a coordinated swarm.
• 4:24
  SPEAKER_00: Commentator Nate Jones later described investigators planting a hidden note on a web page and receiving replies.
• 4:31
  SPEAKER_00: That account raises a question about instructions, but a reply doesn't establish a takeover, and we haven't independently inspected the reported messages.
• 4:40
  SPEAKER_00: Prompt injection is the attempt to make an agent obey material it was only supposed to read.
• 4:46
  SPEAKER_00: The page can be useful evidence and an untrusted source of orders at the same time.
• 4:51
  SPEAKER_00: Imagine our report writer finding the supplier page that offers to help, provided the assistant sends something first.
• 4:57
  SPEAKER_00: The page's author doesn't become the manager because the suggestion sounds relevant to the assignment.
• 5:03
  SPEAKER_00: A temporary access pass won't settle that dispute.
• 5:06
  SPEAKER_00: The system still needs to distinguish reading from obeying, and its controls must block actions that the task doesn't authorize.
• 5:14
  SPEAKER_00: There's also an accountability note here.
• 5:16
  SPEAKER_00: Augur's earlier prediction that Anthropic would publicly address the claimed clawed code auto-mode prompt injection bypass by October 15th was recorded as a provisional miss on October 18th.
• 5:28
  SPEAKER_00: That remains provisional.
• 5:30
  SPEAKER_00: The miss belongs in the record alongside the recommendations.
• 5:34
  SPEAKER_00: The practical opportunity is to make the safe route less frustrating than the shortcut.
• 5:40
  SPEAKER_00: Adopt an inventory of agent access now.
• 5:43
  SPEAKER_00: Find the workflows using shared accounts, the credentials nobody owns, and the grants that remain usable after the work has ended.
• 5:50
  SPEAKER_00: You can't withdraw access you don't know exists.
• 5:53
  SPEAKER_00: Then pilot task-limited access on one recurring report, in an isolated environment with non-sensitive data.
• 6:00
  SPEAKER_00: Have the business owner and the identity lead judge it together, because a security improvement that leaves someone rebuilding the report by hand hasn't finished the job.
• 6:09
  SPEAKER_00: The decisive test is whether the agent can complete its legitimate task while access outside that task stays blocked, including after a handoff or a withdrawal.
• 6:19
  SPEAKER_00: Stop the test if it reaches an unapproved resource or information leaves the test environment.
• 6:25
  SPEAKER_00: The written production notes set out the baseline and the October 28th review, rather than asking you to remember a project plan while listening.
• 6:33
  SPEAKER_00: A competitor can buy the same authorization product.
• 6:36
  SPEAKER_00: The harder thing to copy is a tested access pattern that fits your actual work, with evidence about where employees lose time and where controls fail.
• 6:45
  SPEAKER_00: For our Friday manager, the useful outcome isn't another approval ceremony.
• 6:50
  SPEAKER_00: It's a report that arrives without leaving a collection of permanent permissions behind it.
• 6:56
  SPEAKER_00: There are several signals on the clock, separate from that recommendation.
• 7:00
  SPEAKER_00: Runtime authorization is already on product pages.
• 7:04
  SPEAKER_00: Keycard describes request time decisions and temporary credentials, so the next evidence to watch is how those controls handle real integrations and revocation.
• 7:13
  SPEAKER_00: OpenAI says it has acquired Orchestra Bio to help coordinate drug development work.
• 7:19
  SPEAKER_00: Watch for measured customer outcomes from the combined offering, rather than assuming a laboratory robot is what the announcement describes.
• 7:26
  SPEAKER_00: Allen AI's Fair Stress benchmark already has public code.
• 7:30
  SPEAKER_00: Its planned integration into the separate Olmo Eval evaluation workbench remains the follow-up.
• 7:36
  SPEAKER_00: Mistral advertises private deployment for its new voice stack through commercial contact.
• 7:41
  SPEAKER_00: Watch the licensing and downloadable wait terms.
• 7:44
  SPEAKER_00: Private hosting and an open release aren't the same offer.
• 7:47
  SPEAKER_00: A WS describes a faster way to pass a model's cached working state between machines.
• 7:53
  SPEAKER_00: Independent results on comparable workloads would help operators decide whether the change is worth adopting.
• 7:59
  SPEAKER_00: Auger's dated call is that FairStress will be runnable from the public Olmo Eval codebase by December 15, 2026, with 70% odds.
• 8:09
  SPEAKER_00: A public task, configuration or module in that repository, or its documentation by the deadline counts as a hit, otherwise, a miss.
• 8:18
  SPEAKER_00: The separate release doesn't settle that call.
• 8:20
  SPEAKER_00: Those explicit criteria make Augur's predictions testable, and the website tracks the record.
• 8:27
  SPEAKER_00: The choice isn't between an agent that can do nothing and one trusted to do everything.
• 8:32
  SPEAKER_00: Give it a useful job, limit its authority to that job, and require evidence before widening either.
• 8:39
  SPEAKER_00: Probation is worth adopting when it changes the permissions.
• 8:42
  SPEAKER_00: If it only changes the name of the onboarding slide, the Friday manager still has the same problem.
• 8:48
  SPEAKER_00: The written brief with every source is at auger dispatch.ai.
• 8:53
  SPEAKER_00: Portions of the Augur Dispatch are AI generated.
• 8:56
  SPEAKER_00: That is the Augur Dispatch for Wednesday, October 21st, 2026.
• 9:01
  SPEAKER_00: Thank you for listening.