Tanya Janca | SheHacksPurple

**Not everything needs to be a damn AI agent.** There. I said it. And I will keep saying it. Warning: hot takes ahead. Recently, I was teaching a secure AI class, and one of my students was telling me about an AI agent they were building. 1/14

Your AI agent's instructions are NOT the same as its permissions. I think this is one of the most important distinctions developers need to understand as we start integrating agents into our daily work. You might ask an agent to write some code. Sure. But can it also: • Execute that code? 1/5

twp.aiyoutu.beWhat Can Your AI Agent Actually Do?

I share the full story in the latest episode of DevSec Station, along with what happened when my students and I threat modeled it. 🎧 What Can Your AI Agent Actually Do? Watch on YouTube: https://twp.ai/9ObIbJ Also available on your favourite podcast app. 💕 The lesson? 4/5

Design your security controls around an agent's effective capabilities, not just your expectations of its behaviour. #AppSec #AIAgents #SecureCoding #DevSecStation 5/5

• Install dependencies? • Read files containing secrets? • Connect to external services? • Publish an application? • Schedule something to run automatically? Because if it has those capabilities, then your prompt isn't necessarily going to prevent it from using them. 2/5

I learned this firsthand when I asked Claude to build me a simple morning greeting app. It did considerably more than I'd intended. Because Claude always embarrasses me during class! 🙈 3/5

I just learned something about Canadian privacy law that absolutely SHOCKED me. Seriously. 1/7

I made a video explaining what happened with Crime Stoppers, the gaps in Canadian privacy law, and why I think our lawmakers need to address them. Because I've been saying this for years: **You can't have privacy without security.** 6/7

twp.aiyoutu.beCrime Stoppers Breach: Who Protects Canadians' Privacy?

And your right to privacy shouldn't depend on whether an organization makes a profit. 🎥 https://twp.ai/9ObcXw #Privacy #Canada #CrimeStoppers #CyberSecurity 7/7

I just learned something about Canadian privacy law that absolutely SHOCKED me. Seriously. 1/7

Think about that for a moment. Domestic violence shelters. Victim support organizations. Addiction recovery services. Charities helping vulnerable children. These organizations can hold some of the most sensitive personal information imaginable. 4/7

Information that, if exposed, could literally put someone's life in danger. And yet our privacy protections can depend on where an organization operates and what activities it conducts. 5/7

I just learned something about Canadian privacy law that absolutely SHOCKED me. Seriously. 1/7

After the massive Crime Stoppers data breach, Canada's federal privacy commissioner and Ontario's privacy commissioner indicated that they don't have the authority to formally investigate the Crime Stoppers organizations involved. WHAT?!?! 2/7

It turns out that Canada's federal privacy law, PIPEDA, generally doesn't cover nonprofits when they're conducting noncommercial activities. Now, some provinces, including BC, have their own privacy laws that DO cover nonprofits. But protections vary across Canada. 3/7

You can write perfectly secure application code and STILL end up with a critical security vulnerability. That's one of the most important lessons from PHP2Shell, and it's a perfect example of why **software supply chain security** matters so much. 1/8

twp.aiyoutu.bePHP2Shell: 2 Critical PHP Vulnerabilities! Patch NOW!

You still need to rebuild, redeploy, and verify. I made a video explaining the recent PHP2Shell vulnerabilities and what developers need to know. 🎥 https://twp.ai/9Obflm **Secure coding is essential. But securing the entire software supply chain is essential too.** 7/8

#SoftwareSupplyChainSecurity #AppSec #SecureCoding #PHP 8/8

But what happens when the vulnerability isn't in your code? What happens when it's somewhere else in your software supply chain? That's why we need to think about securing the **entire software supply chain**, not just the dependencies listed in our package manager. 5/8

We need to know what we're running, understand what we depend on, keep those components updated, and verify that security fixes actually make it into production. For example, updating a container base image in your repository doesn't mean your running application has been fixed. 6/8

It includes the programming language runtime, frameworks, build tools, container images, infrastructure, and all the other components we depend on to build and run our applications. 3/8

We spend a lot of time teaching developers how to validate input, implement authorization, use safe APIs, and avoid introducing vulnerabilities into their applications. And we should! Secure coding is incredibly important. (Obviously I care about this a lot) 4/8

When we talk about securing the software supply chain, people often think about open-source libraries and third-party dependencies. But our software supply chain is SO much bigger than that! 2/8

"Developers should carefully investigate every dependency before they install or update it." Okay - Sure... And while we're at it, perhaps they could personally audit the source code of all 1,847 transitive dependencies before lunch. 😂 We need security advice that works in the real world. 1/5

And we should also limit what our development environments can access, so one malicious dependency doesn't automatically get every credential we own. I know, this one isn't as fun. :-/ **Our security controls need to scale to the way developers actually build software.** 4/5

twp.aiyoutu.beThis Malicious npm Package Had Valid Provenance. How?!!?!?!

That's one of the lessons I took from the recent GHAPPIER npm supply chain attack. 🎥 https://twp.ai/9OaPxv 5/5

Pin dependencies at dev. Use lock files. Only updating with dependencies that are 7 days or older, unless it's an emergency. But we also need to **automate the security analysis of dependencies.** Modern SCA and software supply chain security tooling needs to go beyond: 2/5

"Does this package have a known CVE?" We also care about things like: → malicious package detection → suspicious changes and behaviour → project and maintainer health → ** reachability ** → provenance and other supply chain integrity signals 3/5

The tree is really are big in British Columbia. #infosecgardening

Three service accounts aren't three security boundaries if your AI coding agent can use all three of them. 😬 Imagine your coding agent can push code to your repository. Great. Then CI has a separate service account to build and test it. Also great. 1/5

Keep production deployment behind a separate identity and an independent approval or policy boundary. Then compromising one part of your development environment doesn't automatically mean: "Congratulations! You now own production!" 4/5

twp.aiyoutu.bePlugin4Shell: AI Coding Plugins Are Part of Your Software Supply Chain

I talk about this, #Plugin4Shell, least privilege, and why AI coding plugins are becoming part of our software supply chain in my latest video: https://twp.ai/9OaKLA 5/5

Then production deployment uses a DIFFERENT identity with different permissions. Excellent! Yay! Separation of duties! Except... If the coding agent has access to all three sets of credentials, we haven't accomplished very much... 😂 2/5

If the coding agent gets compromised, the attacker still gets all 3. **The security boundary needs to exist outside the agent.** Let the agent push code. Let CI build and test it with its own limited identity. 3/5

What’s your fav developer podcast? Why? #AppSecThursday #talkAppSectome

🎉 **GOOD NEWS for https://twp.ai/9ObRov users! You're protected against PHP2Shell!** Yesterday, two critical vulnerabilities were disclosed in PHP, the programming language that powers WordPress. And understandably, a LOT of website owners are worried! But I have some good news! 1/8

If you use another hosting provider, you need to check with THEM to confirm that your PHP installation has been patched. And if you manage your own PHP server, please apply the security updates! 5/8

twp.aiwordpress.comwordpress.com

I've made a short video explaining the difference, what https://twp.ai/1Hia7jt has confirmed, and what other WordPress website owners should do. 🎥 **Watch here:** https://twp.ai/18LFdLl 6/8

twp.aiwordpress.comwordpress.com

That's exactly the kind of proactive security work we all love to see from a hosting provider! I use https://twp.ai/gDGABN to host my own website, so I was especially happy to hear this. 😊 But there's an IMPORTANT distinction: 3/8

twp.aiwordpress.comwordpress.com

✅ **https://twp.ai/yxv8xd:** The hosting provider has confirmed that its customers are protected against these specific vulnerabilities. ⚠️ **https://twp.ai/paaeZV:** This is the open-source software, which can be hosted almost anywhere. 4/8

twp.aiwordpress.comWordPress, Your Way

**https://twp.ai/NSbBP7 has officially confirmed that websites hosted on its platform are already protected against these two vulnerabilities!** They worked with the PHP Security team BEFORE the public announcement to prepare protections. 2/8

👑 I asked Claude to build me an app that would call me Queen every morning. What could possibly go wrong? Well... I wanted a cute little application that would greet me, give me a compliment, and share an inspirational quote. 1/5

twp.aiyoutu.beWhat Can Your AI Agent Actually Do?

🎧 Season 2, Episode 2: What Can Your AI Agent Actually Do? We're talking about the difference between what we ASK an AI agent to do and what we actually give it the POWER to do. Because those are two very different things. 🎥 Watch on YouTube: https://twp.ai/9ObIXb Prefer audio? 4/5

Find DevSec Station wherever you listen to podcasts. Follow or subscribe so you don't miss the rest of Season 2! #DevSecStation #AISecurity #AppSec #AIAgents 5/5

Instead, Claude built the application, published it, executed it, scheduled it to run on my computer, and connected it to an external API I hadn't vetted. I hadn't explicitly asked it to do all that! 2/5

And the resulting application was missing authentication, authorization, and input validation. Naturally, I brought this into my secure coding class, and we threat modeled it together. This is the story behind the latest episode of DevSec Station: 3/5

🚨 PHP2Shell: Two critical PHP vulnerabilities have emergency fixes available. Even securely written applications can be vulnerable because the flaws are in the PHP runtime itself. Check your PHP versions, patch, and rebuild affected containers. Don't rely on a WAF alone. 1/2