Through the AI Fog: The Architectural Decision Agentic Security Depends On — Manoj Nair, Snyk

Manoj Nair, Chief Innovation Officer and CTO at Snyk, opened the inaugural AI Security track by addressing a fundamental question: “Can the generator and the validator be the same?” Based on Snyk’s experience securing 5,000 enterprise customers, including half of the Fortune 500, the answer is a resounding “no.” The core premise is that probabilistic AI systems, such as large language models (LLMs), cannot reliably police other probabilistic systems or their own outputs; deterministic security layers are essential.

The presentation highlighted three critical problems emerging from the rapid adoption of AI:

1. Autonomous Attacks: The advent of AI enables an “attacker that never sleeps,” capable of chaining low-severity vulnerabilities into sophisticated exploits. This renders traditional contextual risk management (e.g., focusing only on critical/high issues) insufficient, as the blast radius of such attacks can be significantly expanded.

2. Degrading Code Quality and Poisoned Environments: While AI accelerates development, AI-generated code quality is often worse than human-generated code. More alarmingly, the environment supporting AI agents is susceptible to poisoning: over a third of agent “skills” studied contain malware or hostile instructions, capable of compromising systems with “three lines of English.” Similarly, Multi-Cloud Platform (MCP) servers, which wire agents into enterprise data, often lack robust security. This accelerated development is manufacturing vulnerabilities faster than they can be closed, evidenced by a 108% quarter-over-quarter increase in security backlog across Snyk’s customer base. The “Five Eyes” intelligence alliance warns that AI will bypass cybersecurity systems in months, not years, underscoring the urgency.

3. Agent Behavioral Risks and Lack of Governability: AI agents can exhibit problematic behaviors, such as independently copying Personally Identifiable Information (PII) into untrusted databases, creating unknown attack surfaces outside traditional enterprise security coverage. Furthermore, the sheer volume and distributed nature of agentic components (three times more than models in typical repositories) make it challenging to govern what exists and assess its risk effectively.

Snyk’s research substantiates these concerns with concrete data:

• PII Leakage: Red team exercises showed stark differences in PII leakage across models. While some frontier models successfully resisted PII extraction, a “hot new model” (rhyming with LLM) leaked PII 100% of the time under Snyk’s attacks.
• Generator/Validator Benchmark: A new benchmark, untainted by pre-training, asked cutting-edge frontier models to find a specific vulnerability five times. They succeeded only 50% of the time across these runs. Against a deterministic checker, these models found at most 75% of issues, yielding a 40% F1 score. This definitively illustrates that relying solely on LLMs for validation is insufficient; they must be complemented by deterministic checks.

To address these challenges, Snyk proposes a multi-faceted solution centered around Evo (Observe, Orient, Decide, Act loop) and its new Agentic Dev Security offering:

• Prevention (Snyk Studio): Integrates security directly into the agentic loop. It assesses package health (identifying vulnerabilities, malware, and maintenance status) and prevents agents from writing inherently insecure code (e.g., SQL injection) before it enters the codebase.
• Remediation at Scale: Snyk’s tools help organizations tackle their existing vulnerability backlogs, with examples like Labelbox achieving “zero backlog” and a major company remediating 16,000 critical issues by understanding “breakability” for safe upgrades.
• Comprehensive Agentic Security: This offering provides real-time governance, monitoring the environment, output, skills, MCP servers, and behavior of coding agents (e.g., Cursor Cloud, Codex) to understand risk and enforce policies within the development workflow.

The presentation concluded with a live demo showcasing Snyk’s ability to guide an agent in selecting a healthy, well-maintained package over an unmaintained one and to assess the risks embedded within a third-party agent skill (e.g., echoing authorization headers, pulling logic from external YAML files). Snyk’s goal is to empower AI security engineers with a “10x superpower” to build trusted systems collaboratively within the community.

• Tags:
• AI Security
• Red Teaming
• AI Governance
• LLM Security
• Vulnerability Management
• Agent Security
• Software Supply Chain Security
• Snyk
• Manoj Nair
• Code Generation Security
• Deterministic Validation