Agent Security Explained for Interviews and Enterprises

[00:00:00]Anthropic just dropped something called Claude Tag. You add Claude to your Slack workspace, connect it to your tools and data, and then anyone on your team can tag @Claude to assign tasks. It breaks the tasks into stages, works through them using whatever tools it has access to, and posts back in a thread. That sounds incredible, and it is. At Anthropic internally, 65% of their product team's code is now created by their own version of Claude Tag. But, here is the question nobody is asking right now in all the excitement. What identity is that Claude agent running as when it touches your infrastructure?

[00:00:39]Because when Claude Tag gets assigned a task, it works through it using whatever tools it has access to. Your databases, your internal APIs, your Kubernetes clusters, your production services. And if that agent is running on a static API key, a shared service account credentials that never expire, then every person in that Slack channel who can type @Claude just got indirect access to everything that agent can touch. Again, that is not a hypothetical. That is the default for most teams shipping agents today. Stay with me, because I'm going to show you exactly what that looks like in production, and then show you what the fix actually looks like. Here is the thing about AI agents. Everyone is rushing to deploy them, and I get it.

[00:01:26]The productivity gains are real. I have talked about this on this channel for months. But, here is what nobody is talking about. What identity is that agent running as? When a human engineer logs into your AWS environment, there is an IAM role. There is MFA. There is a session that expires. There is an audit trail. You know who did what and when.

[00:01:48]Now, ask yourself, when your AI agent connects to your database, queries your internal APIs, or makes a call to a service in your Kubernetes cluster, what is it running as? For most teams, the honest answer is a shared service account, a long-lived API key, credentials that were hardcoded during the sprint when everyone was in ship-it mode, credentials that never expires, credentials that half of the team forgot it even existed. And again, that is not a hypothetical. That is the reality of how most AI agents are created and deployed today. So, let me show you what this actually looks like in practice. I set up a simple AI agent, nothing exotic. It uses an LLM to interpret instructions and then calls tools to take action. Standard agentic pattern.

[00:02:35]Watch what this agent has access to.

[00:02:37]This agent can query production. It can write to storage. It has network reach to services it has absolutely no business touching for this task. And there is zero audit trail on what it actually did. I would have to piece that together from CloudWatch logs and hope I catch it. Now, here is the uncomfortable part. The agent's credentials do not expire. If they leak through a prompt injection attack, a compromised dependency, a misconfigured MCB server, an attacker does not just get this agent. They get everything this agent can touch permanently until someone manually rotates the key. This is the agentic identity crisis. And it is not a niche security problem. A recent survey of over 200 infrastructure leaders found that 69% said AI adoption will require significant changes to how they manage identity. The people running infrastructure at scale already know this is coming. The question is whether you are going to get ahead of it or clean up after it. Before I show you the fix, quick note. This video is sponsored by Teleport. They're the company that has been thinking about infrastructure identity longer than almost anyone, and they have built something specifically for this agentic problem. I'll show you exactly what that looks like in a second. Link is in the description.

[00:03:57]Check it out after this. So, what does a properly secure agentic environment actually look like? Teleport built what they call the agentic identity framework. And the core idea is this: AI agents should be treated as first-class identities, the same way you treat human engineers, not shared accounts or static API keys. Real, cryptographically verified identities with short-lived credentials that expire. Let me break down what that actually means in practice. Pillar one, no static credentials. Instead of a long-lived API key that lives in an environment variable forever, Teleport issues ephemeral credentials, short-lived certificates tied to a specific agent identity. When the task is done, the certificate automatically expires. No rotation needed, no sprawl, no forgotten keys. All this is done by Teleport Bot or Tbot, which is a lightweight Teleport agent designed to run anywhere your agentic workload does. It can run in AWS, it can run in Linux, or even within a Kubernetes cluster. And it uses each platform's native trusted join mechanism to authenticate, such as AWS IAM role, Kubernetes service account, or a TPM-based host identity, and exchange that for short-lived X.509 certificates issued by Teleport. And from there, Tbot can produce ready-to-use SSH, database, and Kubernetes configs, giving your agentic automation and tools seamless access to any other resources. But here is the advantage: these X.509 certificates are ephemeral, so they expire after a certain amount of time, so you don't have to worry about any static secrets, and the access to different other services and tool is governed by role, so you can control from Teleport what agent can access what other tools and every action gets captured in the audit log. And we're also going to see how an audit log looks like in pillar number three.

[00:05:58]>> Pillar number two, least privilege enforced at the identity layer. The agent gets access to exactly what it needs for this task, a specific database, a specific internal service, and nothing else. The identity layer enforces it instead of a static credential that can be shared or stolen, which is a fundamentally different and much stronger guarantee.

[00:06:20]>> Pillar number three, full audit trail on every action. Every action an agent performs, such as prompt, tool call, database query, is fully audited and attributed to that agent's unique identity, as well as the human who initiated the agent's task. This means you do not have to piece audit logs together across five different services.

[00:06:39]It's all there, tied to the agent and the human's verified identity.

[00:06:44]>> So, for example, these are some of the audit trail references. Let's say your agent created a MCP session which ended in a failure. So, this is the detailed audit log that you will get. It shows the UID, the user, the application name, as well as the error code. Perhaps, your agent is trying to reach a invalid HTTP.

[00:07:04]In that case, you will get everything in the audit trail so that you can go investigate. So, as you could see on the right side, this is all the audit reference examples. It is quite impressive. So, Teleport can create your session start, session end, delete, error, auto override, delete, and many more. It equips you with everything to trace how your agents are working normally and particularly in cases where your agents are doing something bad, you can go back and trace it.

[00:07:33]>> Pillar number four, Teleport Beams trusted agent runtimes. This is what I find really interesting. Teleport runs something called beams. Each beam runs your agent in an isolated firecracker virtual machine. Think lightweight micro VM with identity already wired in. No secrets or manual IM stitching needed.

[00:07:55]The agent inherits delegated identity from the human user and connects to your infrastructure and inference endpoints without ever touching a static or shared credential. Using beams is super easy.

[00:08:07]So for example, you want to create agent with beam, all you need to do is tsh beams add and that's going to create the micro VM and it is going to control all the connections going outside and the inference so that you will have full audit and access control and then from there you can just run your cloud commands like cloud and then dangerously skip permission so you don't have to keep saying yes or no and then this is the prompt which is going to create an agent. So beams control all that. You can do sandbox app development as well.

[00:08:38]Very simple tsh beams add creates the micro VM. Then you can clone a repository inside this isolated virtual machine and then you can run your usual commands and uh beams is going to access control as well as trace all the actions. And these are the full list of commands. I will give the link in the description. The way Teleport's CEO put it, security is a prerequisite that's already solved. Engineers can ship agents knowing the identity, access control and audit trail that are already there. That is the goal. Make security the default, not the afterthought. This is exactly the direction the industry needs to move. Not monitoring after the fact or hoping your agent does not get prompt injected. Identity first from the ground up before the agent ever makes its first call. Teleport eliminates static credentials entirely. The agent never gets a secret to misuse or leak because it authenticates with short-lived identity that is backed by a hardware root of trust. An agent running with an ephemeral identity issued by Teleport gets no access or privileges that persist longer than the time needed to complete the task at hand. Here is my takeaway. AI agents are going into production. That is not a prediction, that is happening right now. Cloud Tag just launched. Teams are already tagging at the rate cloud to hit databases, query services, and take actions across infrastructure. And the security model most teams are using, static credentials, shared service accounts, zero audit trail, was built for a world where software did not autonomously make decisions and take actions. That world is gone. Identity is the control plane for agentic systems. Get that right and you can ship agents with confidence. Get it wrong and you are one prompt injection away from an incident you will be explaining for a long time. Teleport has put real thoughts into this. Their agentic identity framework is worth understanding. Link is in the description. Go check it out. If this clicked for you, hit subscribe. I cover AI, I cover GenAI, cloud architecture, and the stuff that actually matters for engineers building in this space. See you in the next one.