How to Give an Agent a Query Language Instead of a Code Interpreter
A four-step pattern for letting a document agent write validated aggregation pipelines instead of arbitrary code, so results come back shaped and tenancy stays enforced.
Loading…
Topic
Security
169 posts about Security. Every summary links to the original.
- 169 posts
- 29 companies
- 8 explainers
See the idea
Security explainers
Anatomy of a Branded Call: The Trust Chain from Dial to Display
The Branded Calling trust chain, layer by layer: how identity, STIR/SHAKEN attestation, Rich Call Data, and carrier delivery combine so a verified brand name reaches the recipient's screen.
Backdoor Defense Is a Trade-off, Not a Scanner
A model that passes benchmarks can still defect only on a trigger. This explainer maps the trade-off between deeper backdoor verification and the friction, latency, and cost it adds.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Stop rogue AI: How Unity Catalog secures your agent actions
Agentic AI systems connected to external tools can take destructive production actions while operating within delegated authority, yet without restrictions on tool selection or records of their calls. Unity Catalog now governs MCP tools with fine-grained access control, service policies, and payload logging, while Unity AI Gateway enforces decisions in real time. Policies are SQL functions receiving actor and context information; they can allow, deny, or require user consent, inspect arguments and caller properties, and block calls before execution. Every tool call is recorded in a Unity Catalog-managed Delta table with the tool name, arguments, result, user identity, and allow-or-deny status, making the activity queryable with SQL. The service policies and payload logging are available as a Gated Beta, with early access offered through Databricks account teams.
Development environments for your cloud agents
Cloud agents need development environments with repositories, dependencies, credentials, and build-system access to test, query services, and verify engineering work rather than merely write code. The release adds reusable multi-repo environments, allowing agents to work across microservices codebases and deliver, test, and verify changes spanning repositories. It also improves Dockerfile-based configuration with build secrets scoped to build steps and layer caching that makes cache hits run 70% faster. Cursor can inspect repositories, determine required tools and dependencies, and generate editable Dockerfile configurations, while its setup flow checks credentials and validates environments; this generator is in private beta. Governance features include environment-specific version history, rollback controls, audit logs, egress allowlists, and isolated secrets, while failed configurations fall back to a base image and work continues.
Mean time to detect is a data access problem
Security operations centers measure MTTD, MTTR, false-positive rates, and analyst utilization, yet investigations often stall because analysts assemble evidence across fragmented systems. A single alert may require separate queries for logs, identity records, asset information, prior alerts, and cross-source timelines, making the analyst the integration layer and creating an MTTI bottleneck. The post presents Lakewatch with Databricks Genie as an agentic interface powered by Anthropic Claude models: analysts ask natural-language questions while autonomous agents hunt, summarize, correlate, and reconstruct timelines across security, IT, and business data. It argues that this architecture can reduce investigation work from manual, multi-system workflows to answers in seconds, while retaining analyst-level access controls and governed data access as exploit time has shrunk to 1.3 days.
Agentic identity: modeling agents to keep users in control
Ramp for Agents adds CLI and MCP interfaces through which AI agents can manage cards, bills, expenses, and approvals, creating a need to represent agents as accountable actors instead of handing them users’ session tokens or API keys. The initial identity model links a named Agent Key to a human sponsor and business, bounds scopes by the sponsor’s role, records agent attribution, and adds expiration and revocation. Ramp extends RBAC and its DenormalizedActor audit model with AgentContext, so logs, approvals, and webhooks can distinguish “Sarah (via Codex)” while reusing existing permissioning and rendering paths. OAuth2-PKCE exchanges the Agent Key for short-lived access and refresh tokens, with re-validation during refresh to limit leaked-credential exposure and preserve session traceability. The first release uses on-behalf-of-user agents because they fit current demand and keep a human accountable, while admins can oversee keys or disable agent access for roles and groups.
Alert fatigue is a business risk
Enterprise security operations centers may receive tens of thousands of alerts daily, making prioritization necessary and leaving lower-priority signals uninvestigated. Alert fatigue is presented as a data architecture problem: fragmented endpoint, network, identity, and cloud telemetry, combined with proprietary SIEM collection-and-discard practices, limits correlation and overwhelms analysts. Lakewatch proposes an open lakehouse foundation that unifies security, IT, and business telemetry, applies automated OCSF normalization, and uses Agent Bricks for data wrangling and alert triage. Databricks Genie is positioned as a natural-language AI security agent whose autonomous agents can hunt, summarize, and neutralize threats, while Unity Catalog logs queries and actions for audit and forensic purposes. Lakewatch is currently available in Private Preview.
Built in, not bolted on: What AI-native actually means in cybersecurity
The discussion defines AI-native cybersecurity applications as systems architected with intelligence at their core, rather than traditional products with AI added later. It links tool sprawl to slower threat detection and response and argues that proprietary, context-rich security telemetry is the foundation for adaptive defense. Barracuda uses Databricks to consolidate fragmented data, normalize schemas, support real-time streaming detection, run ML operations through MLflow, and power natural-language log search across billions of security events with strict data isolation. The work began by defining customer outcomes, then progressed through incremental delivery; normalized data enabled models and agents to use cross-domain context. This approach extended across WAF-as-a-service, automated configuration, API security, and bot protection while shared outcomes aligned product, data science, engineering, and business teams.
Putting Fairness in the Driver’s Seat
Uber describes its deactivation principles and safeguards for drivers and couriers, motivated by the stress of losing app access and the need for decisions that are fair, accurate, and transparent. Most access issues are temporary, while permanent deactivations are described as rare and intended to protect platform safety; users should receive notice, relevant details, and an opportunity to respond whenever possible. The updated process lets drivers view eligible reports, submit context including Record My Ride audio or video, and have reports reviewed alongside their information, while systems filter suspected fraudulent or false claims. The Review Center explains deactivation reasons and appeal options, supports uploads, and sends every appeal to a real person, with additional measures including excluding low ratings caused by factors outside a driver's control, limiting trip categories when appropriate, and covering third-party testing for disputed impairment claims.
Data Governance Platforms: Evaluation & Feature Guide
This guide presents a framework for evaluating data governance platforms for enterprise deployment, distinguishing governance—the policies, roles, and controls for data use—from data management, the operational execution of those policies. It recommends assessing metadata-centered capabilities including continuous data profiling, catalog search and enrichment, end-to-end lineage, RBAC and ABAC, sensitive-data detection, masking, audit trails, compliance reporting, and data-subject request workflows. Vendor assessment should also cover pre-built connectors, REST APIs and SDKs, near-real-time metadata synchronization, schema-drift handling, cross-cloud federation, usability, support, implementation timelines, and three-to-five-year total cost of ownership. The proposed decision process selects three leading candidates, pilots them with representative structured and unstructured datasets, defines quality, lineage, adoption, and exit metrics, and uses executive review before procurement; governance is framed as an ongoing program that expands with AI workloads and regulatory change.
Take Control: Customer-Managed Keys for Lakebase Postgres
Lakebase Customer Managed Keys (CMK) gives regulated enterprises control of the root of trust through customer-owned keys from AWS KMS, Azure Key Vault, or Google Cloud KMS. Because Lakebase separates persistent storage from elastic Postgres compute that can scale to zero, CMK protects both layers and their caches rather than storage alone. Its hierarchical envelope-encryption model uses the CMK as the root, transient Key Encryption Keys (KEKs) to wrap Data Encryption Keys (DEKs), and unique DEKs for each data segment, while plaintext CMKs remain in the customer’s KMS. Account Admins bind a configured key to a workspace, after which new projects inherit the CMK; rotation needs no re-encryption or downtime, revocation terminates compute instances, and audit services record cryptographic operations.
Run cloud agents in your own infrastructure
Cursor has made self-hosted cloud agents generally available, allowing code, tool execution, and build artifacts to remain within an organization’s network. Each agent runs in an isolated virtual machine or dedicated worker with a terminal, browser, and full desktop; it can clone repositories, configure environments, write and test code, and push changes for review. A worker connects outbound to Cursor’s cloud over HTTPS, receives tool calls from the agent harness, and returns execution results, while organizations can run long-lived or single-use workers and manage large fleets through a Helm chart, Kubernetes operator, or fleet management API. The product retains cloud-agent capabilities including multi-model support, plugins, and team permissions, while giving teams access to internal caches, dependencies, endpoints, and security controls without maintaining a separate agent stack.
Securing our codebase with autonomous agents
After a fivefold increase in pull-request velocity over nine months, the team found static analysis and rigid code ownership insufficient for security at scale. It built a fleet of Cursor Automations powered by cloud agents, webhook and GitHub integrations, and a security MCP deployed as a just-in-time serverless Lambda function. The MCP provides persistent data, semantic deduplication using Gemini Flash 2.5, and consistently formatted reporting and follow-up actions, while Terraform standardizes review and deployment. Four templates cover PR review, segmented vulnerability hunting, dependency patching with reachability analysis and tests, and daily invariant-drift monitoring. Agentic Security Review has run on thousands of PRs in two months and prevented hundreds of issues from reaching production; the team says more automations are planned.
How we built security into Custom Agents
Custom Agents were designed for collaborative workspaces where useful access must be balanced against dangerous actions. They use a build-from-nothing model with no default read, write, or interaction permissions, then add resource-level controls such as page-level access, Slack “read and reply,” email confirmation, and selected MCP tools. Runtime safeguards combine permission controls with prompt-injection mitigations, monitoring of external data, warnings, owner confirmation for risky actions, and remediation such as deleting an incorrect Slack message. Alpha testing across Notion and customers produced more than 3,000 internal and 25,000 customer agents, and exposed overly broad Slack write access that could reach #general. That finding led to the custom permission and reinforced the case for first-party integrations, while planned work includes admin-approved broader scopes, Workers integrations, and additional permission modes.
We proactively fixed ~100 security issues in 6 days with 0 humans
Ramp Security Engineering describes a six-day experiment in which home-grown agents found, validated, and fixed nearly 100 latent backend security issues, including some high-severity findings, without human involvement until pull-request review. The issues had not been uncovered by penetration testing, bug bounty testing, static analysis, or trials of 10+ code-scanning vendors, and all were patched within a week of discovery. The pipeline used specialized vulnerability detectors, adversarial manager agents that rejected 40% of initial proposals in sample testing, integration tests for validation, and an internal coding agent that generated patches. Live interactive validation struggled with complex preconditions, so test-based validation became the main approach; a human team member still reviewed and landed each pull request.
Implementing a secure sandbox for local agents
Auto-approved terminal commands make coding agents more capable but increase the risk of destructive changes and secret leakage, while repeated approval prompts create approval fatigue. Over three months, the team rolled out a uniform sandbox API across macOS, Linux, and Windows, allowing agents to run freely inside controlled environments and request approval mainly for internet access. macOS uses dynamically generated Seatbelt profiles; Linux combines Landlock, seccomp, and overlay filesystems to enforce workspace and ignored-file restrictions; Windows runs the Linux sandbox through WSL2. Changes to tool descriptions and result rendering help agents recognize constraints and escalate instead of retrying failed commands. Production data reports that sandboxed agents stop 40% less often, and the sandbox now handles a third of requests on supported platforms, although native Windows isolation remains under development.
Box chooses Cursor for enterprise-grade quality, security, and control
Box selected Cursor as its enterprise agentic coding platform after evaluating data privacy, security, and agent-quality controls. More than 85% of Box developers, or over 800 people, now use Cursor daily, while the company reports a 30–50% increase in product-roadmap throughput and migrations completed 80–90% faster. Box encodes agent guardrails in custom Cursor rules and commands, including a frontend AI toolkit, automated test-coverage work, and rules for React and design-system migrations. A mentorship program pairing power users with newer adopters increased Cursor usage by 75% and power users by 25% in six weeks, while Box says it can move faster without compromising product quality, security, or accessibility.
Securely indexing large codebases
Cursor describes a secure way to index large codebases for semantic search, where naive processing can delay availability for hours. The system builds a Merkle tree of file and directory hashes, synchronizes only divergent branches, and caches embeddings by chunk content to reduce repeated work. For new users, a client-generated simhash finds a similar index within the same team or user's indexes, which is copied while background synchronization reconciles differences. Content proofs derived from the client's full Merkle tree filter search results so users see only files they can prove they possess. Reported time-to-first-query falls from 7.87 seconds to 525 milliseconds for the median repository, and from 4.03 hours to 21 seconds at the 99th percentile.
Okta Developer Connect Recap
Okta Developer Connect Bengaluru was Okta’s first flagship Developer Connect event in India, bringing developers, architects, engineering managers, IAM practitioners, and technology leaders together to discuss identity as systems scale and AI agents work alongside humans. Sessions framed identity as foundational infrastructure spanning users, applications, APIs, services, and AI agents, while connecting core standards and practices to platform use cases including the Okta MCP Server, Cross App Access, Okta Integration Network, Okta Workflows, lifecycle management, and Verifiable Digital Credentials. Interactive discussions, audience Q&A, quizzes, surveys, and a research panel complemented talks and enabled exchanges with Okta engineers, product leaders, and advocates. The Bengaluru event begins an ongoing series intended to support practical identity education and open technical dialogue about enterprise-ready systems, identity standards, and AI-driven access and security assumptions.
From deployment slop to production reality: How BriX bridges the gap with enterprise-grade AI infrastructure
BriX addresses “deployment slop,” the gap between quickly built AI prototypes and enterprise production, where inconsistent versions, reliability failures, and security risks can block adoption. The platform centralizes production infrastructure so semi-technical domain experts can configure deployments rather than become DevOps specialists, covering scaling, monitoring, audit trails, access controls, data connections, and consistent behavior. BriX supports switching among models such as Claude, GPT, and Gemini; its Model Context Protocols (MCPs) provide standardized, pre-built connectors to approved enterprise data sources with built-in access controls and query logging. Centralized system prompts and context files enforce shared guardrails, while custom frontends and persistent, shareable reports extend use beyond chat interfaces. The stated result is a platform intended to turn deployment into a configuration task, helping teams move from prototypes to enterprise-grade tools in days rather than months.
Hooks for security and platform teams
Cursor has announced ecosystem partnerships around hooks, which run before or after defined stages of its agent loop to observe, block, or modify behavior. The integrations target MCP governance, code security, dependency scanning, agent safety, and secrets management, connecting Cursor with security tooling, observability platforms, secrets managers, and compliance systems. MintMCP, Oasis Security, and Runlayer provide MCP inventory, least-privilege enforcement, audit trails, and centralized tool-interaction visibility, while Corridor and Semgrep give coding-time feedback and vulnerability scanning. Endor Labs intercepts package installations to scan for malicious dependencies, Snyk’s Evo Agent Guard reviews agent actions for prompt injection and dangerous tool calls, and 1Password validates that all required environment files from 1Password Environments are properly mounted before shell commands execute, enabling just-in-time secrets access without writing credentials to disk.
A Decade of Defense: Celebrating Grab's 10th Year Bug Bounty Program
Grab marks the tenth anniversary of its bug bounty program, launched with HackerOne and initially involving 23 researchers. Over the decade, it grew into a global community, partnering with more than 850 active HackerOne researchers to help protect over 187 million users across Southeast Asia. The program broadened its scope in 2023–2024, adding assets that included Indonesian financial services and AI systems, while introducing a mobile-specific bounty table and experimenting with campaigns and reward methods. Grab says it now ranks among HackerOne’s top 20 programs worldwide and top three in Asia, and credits live hacking events and regional club campaigns with expanding testing coverage and researcher relationships. Anniversary activities included invite-only campaigns in Germany, Morocco, and India, plus a broader campaign that received 461 submissions, with xchopath receiving the Best Hacker Bonus.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.