Max Corbridge, an ethical hacker and red teamer who is co-founder and CEO of Secure Agentics, speaks with SE Radio host Amey Ambade about how AI agents get attacked and what engineers can actually do to defend them. Drawing on years of offensive security work, Corbridge frames agents as a new and largely undefended attack surface: the industry has handed AI systems autonomy and the ability to act in the real world while carrying forward prompt injection, a flaw the frontier labs themselves describe as effectively unsolvable. He likens the moment to the early, lawless days of the web, when SQL injection was everywhere and adoption ran far ahead of security.
The conversation builds from first principles as Corbridge explains what separates an agent from ordinary software and why three properties make them hard to secure: they are non-deterministic, their language-model core can be coerced, and they are increasingly interconnected through MCP servers, other agents, databases, and email. Turning to the attack surface, Corbridge lays out his “lethal trifecta” (a vulnerable core, dense interconnection, and security tooling that has not caught up) and contrasts the decades of layered defenses protecting an ordinary email inbox with the thin protection around agents that take autonomous actions on critical systems.
The heart of the episode is defense. Corbridge orders practices by leverage: least-privilege access and privilege separation, sandboxing where feasible, imperfect-but-useful guardrails as one layer of defense in depth, and human-in-the-loop for irreversible actions (which he notes is contentious and does not scale). The discussion closes on detecting a compromised or drifting agent, the value of watching an agent’s chain-of-thought reasoning alongside its actions, the open-source tooling landscape (including Corbridge’s own project, Adrian), and his central advice: build security in proactively, define what good agent behavior looks like up front, and avoid bolting it on after agents have already spread across the business.
Brought to you by IEEE Computer Society and IEEE Software magazine.
Show Notes
Related SE Radio Episodes
- SE Radio 692: Sourabh Satish on Prompt Injection
- SE Radio 689: Amey Desai on the Model Context Protocol/
- SE Radio 680: Luke Hinds on Privacy and Security of AI Coding Assistants
- SE Radio 664: Emre Baran and Alex Olivier on Stateless Decoupled Authorization Frameworks
- SE Radio 684: Dan Bergh Johnsson and Daniel Deogun on Secure by Design
- SE Radio 722: Dwayne McDaniel on the Engineering Challenges of Secrets Management
Links and References
- Secure Agentics (and Adrian, the open-source runtime security project): Runtime Security for AI Agents | Secure Agentics
- Max Corbridge on LinkedIn (search “Max Corbridge”)
- OWASP Top 10 for LLM Applications, LLM01: Prompt Injection: LLM01:2025 Prompt Injection
- OWASP GenAI Security Project, Agentic Security Initiative (source of the agentic top-10 work referenced in the episode): Home
- “The lethal trifecta for AI agents,” Simon Willison: The lethal trifecta for AI agents: private data, untrusted content, and external communication
- Model Context Protocol: What is the Model Context Protocol (MCP)? – Model Context Protocol
- Gemini CLI prompt-injection finding (Tracebit), “Code Execution Through Deception: Gemini AI CLI Hijack”: Code Execution Through Deception: Gemini AI CLI Hijack | Tracebit
- Zenity Labs “AgentFlayer” zero-click agent exploits (Black Hat USA 2025): Zenity Labs Exposes Widespread “AgentFlayer” Vulnerabilities Allowing Silent Hijacking of Major Enterprise AI Agents Circumventing Human Oversight
- postmark-mcp malicious MCP server (Koi Security, the first publicly documented malicious MCP server): First Malicious MCP in the Wild: The Postmark Backdoor That’s Stealing Your Emails
- Postmark’s own advisory on the malicious package: Security Alert: Malicious ‘postmark-mcp’ npm Package Impersonating Postmark
- Data-poisoning research (Anthropic, UK AI Security Institute, and Alan Turing Institute), “A small number of samples can poison LLMs of any size”: A small number of samples can poison LLMs of any size (paper: Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples )
- Chain-of-thought monitoring (Max references research from OpenAI and Google DeepMind on monitoring an agent’s reasoning alongside its actions): OpenAI, “Detecting misbehavior in frontier reasoning models” (Detecting misbehavior in frontier reasoning models ) and the multi-lab paper “Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety” (Chain of Thought Monitorability: A New and Fragile Opportunity for… )
