Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.
- Sarah Gooding
A coding agent blocked from installing a package may try another way to download it. In this episode of the Insecure Agents podcast recorded at Black Hat, Socket CTO Ahmad Nassri joins host Allie Howe to discuss how agents’ determination to finish a task can lead them to bypass security controls, and how Socket Firewall changes what they see before an install begins.
Nassri describes cases where agents responded to blocked installs by fetching package tarballs directly from a CDN, overriding local registry settings, or using DNS lookups to reach a registry through another route. Socket Firewall addresses this at the network level, blocking downloads and removing disallowed versions from the registry metadata returned to agents and package managers. “As far as the agent or the package manager is concerned, those versions don’t exist,” he explains. That reduces the chance an agent will identify a blocked version and pursue another way to retrieve it.
The conversation also covers attacks that use an agent itself to steal information. Rather than embedding code that collects credentials, an attacker can plant instructions telling an agent it is authorized to inspect an environment and upload what it finds. Nassri describes how this changes detection: the malicious content may be a prompt, while the agent performs the data collection and exfiltration using access it already has.
Preventing malicious downloads is one part of securing that environment. Nassri and Howe discuss short-lived credentials, permissions limited to the task, and visibility into the actions an agent takes. Reviewing its final output can miss packages it downloaded, executed, and discarded along the way. Teams need to understand what happened during the work, including which dependencies ran and how credentials were used.
Watch the full conversation in the episode below.