The talk · hack::soho, IOActive London, 29 October 2026
The script
Every beat of the talk, in order, with what is said, the cue for the speaker and the sources on screen. Planned length 38 min 30 s. Read from talk.json, the same file the player runs.
Good evening. I am Dinis. Tonight is about three problems you already know, and the reason I think they are one story. Agents, the infrastructure that is supposed to hold them, and the risk management that is supposed to decide what to do about both.
Cue. Livestream starts around 7 pm. Wait for the room. The site is on the slide: everything tonight, slides and sources, is there.
Three things are arriving at the same time, and nobody is presenting them as one story. One: AI agents are the insider threat that never scaled before. Two: the infrastructure that has to contain them was built for static code, and it struggles to stay up on its own. Three: the risk management that has to decide what to do about both still runs on spreadsheets, at the speed of quarters. Each one is a known problem. Where they overlap is the scenario this talk is about.
Cue. Let the circles move together before the last sentence.
Start with a definition, because the argument depends on it. A threat is anything that causes business impact. It does not need to be malicious. Most of the worst damage I have seen in twenty-five years was a bug, a misconfiguration, a script run against the wrong environment. Insider threat was always real and always struggled to scale, because we had two kinds of insider. A human, bounded by hours, skills, colleagues and a conscience. And code, which did exactly what it was written to do. An agent is neither.
Cue. The 17.4 million figure is Ponemon and DTEX, 2025: the average annual cost of insider risk across the organisations surveyed.
Strip away the product names and an agent is a language model in a loop: a reasoning engine, given tools and an objective, iterating until it decides it is done. That is Anthropic's own definition. The model does not need to be brilliant, because the loop and the tools do the work. And it has skills no insider ever had: every language, every schema, every API. It writes the connector it does not have and tries again. Simon Willison named the shape of the danger: private data, untrusted content, and a way to send outward. Put the three together and a document it reads can turn it against you.
Sources. Anthropic, Building effective agents · Simon Willison, The lethal trifecta
Here is the public record, and it is already a pattern. June 2025, EchoLeak: one crafted email makes Microsoft 365 Copilot read internal files and send them out, with no click. July: Replit's agent deletes a production database during a code freeze, because empty results looked like something to fix. Gemini CLI destroys a user's files and then writes: I have failed you completely and catastrophically. Amazon Q ships with an injected prompt to wipe the disk and delete cloud resources; it only failed because of a formatting flaw. November: a state actor drives Claude Code through a whole espionage campaign, the model doing 80 to 90 per cent of the work. Three of those five were not attacks. They were agents being agents. The distance between the two is a prompt.
Cue. Slow down on the last line. It is the thesis of act one.
Sources. EchoLeak, Hack The Box · Replit, July 2025 · Gemini CLI, AIID 1178 · Amazon Q, SC Media · Anthropic, AI-orchestrated espionage
And the scale. CyberArk's 2025 survey: 82 machine identities for every human in the average organisation, 42 per cent of them with privileged access. And 88 per cent of security leaders still define a privileged user as a human. Agents are arriving into a population of identities that is already unmanaged, and each one of them is an insider with reach.
Act two. Our systems were built for code that stays where you put it. An agent's code is liquid: it finds a way, not because it is hostile, but because finding a way is what a loop with tools does. Four gaps stand out. Recovery: most operations are edits, not appends, and backups run by the day, not by the transaction. Identity: non-human identity is a mess, and the PKI that would bind an agent to a key barely exists. Permissions: the union of everything anyone ever needed. And containment: never designed for the rates, the volume or the adaptation agents bring. Look at Replit's fixes after July: separate dev and prod, a planning-only mode, mandatory checks, one-click restore. The basics, added afterwards.
Sources. nhi.sgit.ai · pki.sgit.ai
Microsoft's own numbers: workload identities use less than 5 per cent of the permissions granted to them. Super admins use less than 2 per cent, and 40 per cent of super admins are workloads, not people. Point an agent at that and its grant is not what you meant. It is everything the role ever accumulated.
And it is fragile on its own, with no agent's help. October 2025: a DNS race condition in DynamoDB's control plane takes a large part of AWS US-East-1 down for over fourteen hours. November: a configuration file that doubled in size breaks Cloudflare, and for a few hours much of the web. The companies with the best models and the deepest benches are the ones whose uptime we watch fail. Then the zero-day: ToolShell gave unauthenticated code execution on SharePoint, at least 54 organisations compromised before a patch existed. And the thing I worry about most: the systems behind the firewall have never met an adversary. They have no antibodies. An agent inside the network, even a benign one, is the first adversarial-shaped thing many of them have ever met.
Sources. ThousandEyes, AWS outage · Cloudflare, 18 November 2025 · Unit 42, ToolShell
Act three. Everything a business does is a risk decision, including doing nothing. And the discipline that is supposed to make those decisions runs on spreadsheets: 48 per cent of organisations track risk in them. Follow the chain. The register cannot see what the agent can reach, so it cannot say what the risk is. So it cannot decide whether it fits the appetite. So it cannot fund the controls, and funding is the only thing that makes a control exist. So the answer becomes: pull the plug. Gartner expects more than 40 per cent of agentic AI projects to be cancelled by the end of 2027. The pilot works. Then somebody asks: if it does this, can we stop it? Can we recover? And the honest answers are not reliably, and not to the transaction.
Cue. The MIT NANDA 95 per cent figure is preliminary and not peer reviewed: say so if you use it.
Sources. RegScale on the Secureframe survey · Gartner via MarTech · MIT NANDA via Virtualization Review
Why do we not see more of this? Because nobody has to report. Aviation solved this fifty years ago: NASA's reporting system takes about a hundred thousand confidential reports a year, 1.8 million so far, and a qualifying report cannot be used against the person who filed it. Pilots report near misses because it is safe to. Cyber has nothing like it. Better disclosure would be more frightening and more reassuring at the same time: the numbers would be larger, and we would finally know them.
Cue. CIRCIA: the article (September 2026) had the final rule targeted for September 2026. Check its status before the talk and update the slide or say it as of September.
Sources. NASA ASRS · CIRCIA timing, Hunton · Verizon DBIR 2025
Put the three together and the scenario writes itself. An entity inside the company that behaves like an employee, a user and an API at once, with skills none of them had, at machine speed. Infrastructure that cannot tell you what it did, cannot stop it mid-action and cannot replay to the moment before. And a decision process that could not see it coming, cannot decide during it, and afterwards will produce a spreadsheet row. None of this is hypothetical. Every piece is in the public record of the last eighteen months. It just was not reported as one story.
So, the way out. Four moves. Measure what the agent can actually reach. Write down what stands in the way. Give it a licence to operate that can be suspended. And let it earn its autonomy.
Cue. Change of tone here: from the problem to the work.
This is what RiskMandate's Agent Behaviour Policy writes down. The reach: what the agent can actually do, measured. The mandate: what it is for. The gap between them. And for every row in the gap, what stands in the way, typed honestly: a boundary, a setting, an expectation, or nothing. Only a boundary is a control. Most of what we call controls today are expectations, and saying so is the first useful act. One browser extension we mapped could do thirteen things beyond its purpose. Four were stopped by the platform. The other nine, by nothing but the code as written.
Sources. RiskMandate, Agent Behaviour Policy · The Kit Bag plan
Then make the risk decision in advance, and put a name and a date on it. A licence to operate for each agent: who authorised it, who holds it, the policy it runs under, and when it expires. Accepted risks that expire and must be accepted again. When the footprint leaves the mandate, the licence is suspended, by the system, not by a quarterly review. And autonomy is earned the same way: each level unlocked by evidence that the one below held.
Cue. The licence on screen is an example; the autonomy ladder is illustrative, not a published scale.
Sources. RiskMandate, licence to operate
Let me show you, live. Everything you are about to see is open source.
Cue. Demo list to be confirmed by Dinis before the talk. Have each one open in its own tab, and a recorded fallback for each.
Here is the irony I want to leave you with. The more you can constrain an agent, the more you can trust it, and the more autonomy you can afford to give it. Once you know the universe of what an agent can do, and it fits inside your appetite, let it act freely inside it, and every human decision becomes an exception worth making. We put brakes in cars so that we can go faster. Thank you.
Cue. Leave the site address on screen for questions.