Cyberside Chats: Cybersecurity Insights from the Experts

Your organization is already running an AI workforce and almost nobody knows who they report to, what they can touch, or how to shut them down. In this episode, Sherri Davidoff and Matt Durrin break down the shadow AI agent problem: what makes an agent a "shadow" agent, how real breaches are already happening because of them, and what security leaders can do about it this week.

Using three case studies: Anthropic's Claude Dispatch as a canonical product example, the April 2026 Vercel breach (the cleanest illustration yet of the OAuth supply chain attack model), and Meta's internal Sev-1 incident (when the agent itself is the failure mode). Sherri and Matt walk through the four layers where shadow agents accumulate risk and close with five concrete, actionable takeaways for security teams at any size.

 

Key takeaways

1. Start with discovery, not policy. You can't govern what you can't see. The right question to ask your team isn't "are you using unauthorized AI tools?" — it's "what AI tools are you using to do your job?" Check OAuth grants in Google Workspace and Microsoft Entra, and look at expense reports. The real number of agents in your environment is typically two to five times what you initially find.

2. Audit and restrict OAuth scopes — especially "Allow All". The Vercel breach was enabled by a single broad OAuth grant an employee made during onboarding for a third-party AI productivity tool. Most enterprise Google Workspace and Microsoft 365 tenants allow users to grant full OAuth scopes to external apps with no admin review. Requiring admin approval for OAuth grants — and auditing existing ones — is a control that can be implemented today and would have prevented the Vercel incident. An OAuth token is as good as — if not better than — a username, password, and MFA combined. It gets you straight through the back door.

3. Treat AI tool agreements like vendor contracts — because they are. When an employee clicks Allow All on an AI tool's onboarding screen, they have created a vendor relationship on behalf of the organization — without a DPA, a BAA, a security review, or procurement involvement. Build a lightweight intake process specifically for AI tools, and make it faster than the OAuth click. If the approved path takes two weeks, employees will route around it. Aim for two days.

4. Get visibility at the identity layer. Machine identities already outnumber human identities by roughly 50:1 in enterprise environments. AI agents add more — fast. Look at purpose-built NHI management tools: Token Security, Astrix, Andromeda, and Entro. Microsoft Agent 365, launched May 2026, gives Microsoft ecosystem organizations a registry and map of agents in their environment — a quick starting point for visibility.

5. Build a fast lane for AI tool approvals. "Don't use shadow AI" is the wrong message. Employees will use these tools regardless — the goal is to make the sanctioned path faster than the shadow path. A lightweight checklist covering data sensitivity, OAuth scopes requested, and basic vendor security posture beats a heavyweight approval committee. Make the process visible, frame it as enablement rather than restriction, and you will get compliance.

 

The three flavors of shadow agent

1. The unsanctioned agent. An employee built it in Copilot Studio or ChatGPT. IT doesn't know it exists.

2. The sanctioned-but-invisible agent. The platform is approved, but nobody is tracking what each agent can access, who owns it, or what it's doing.

3. The granted-access agent. An employee authorized an outside AI tool via OAuth. An external agent is now operating inside your environment with your credentials.

 

References

1. Vercel breach https://vercel.com/kb/bulletin/vercel-april-2026-security-incident

2. Kiteworks 2026 Data Security and Compliance Risk Forecast https://www.kiteworks.com/cybersecurity-risk-management/meta-rogue-ai-agent-data-exposure-governance/

3. Cloud Security Alliance + Token Security survey (April 21, 2026) https://cloudsecurityalliance.org/press-releases/2026/04/21/new-cloud-security-alliance-survey-reveals-82-of-enterprises-have-unknown-ai-agents-in-their-environments

4. OpenAI — ChatGPT Workspace Agents https://openai.com/index/introducing-workspace-agents-in-chatgpt/

5. Salesforce FY26 Q4 earnings release (Feb 25, 2026) https://www.salesforce.com/news/press-releases/2026/02/25/fy26-q4-earnings/

6. Microsoft Copilot Studio — agent overview https://adoption.microsoft.com/en-us/ai-agents/copilot-studio/

7. Microsoft Agent 365 (launched May 2026) https://www.microsoft.com/en-us/microsoft-copilot/blog/copilot-studio/unveiling-copilot-agents-built-with-microsoft-copilot-studio-to-supercharge-your-business/

 

65% of US doctors are using an AI tool their hospital never approved — on personal phones, under click-through contracts. Sherri and Matt unpack what every CISO and IT leader should learn from it about shadow AI, "free" professional tools, and the contracts nobody's reading.

The tool is OpenEvidence — 27 million clinical queries in April 2026 alone, 60% of them shaping actual treatment decisions. Doctors love it because the alternative was Googling patient symptoms on a personal browser. Their hospitals mostly don't know it's happening, and the vendor's click-through Business Associate Agreement authorizes them to use that data to train their models forever.

Healthcare is the example. The same pattern is showing up in legal, financial services, engineering, and HR right now — different tool, same structural risk. Tune in for five concrete takeaways security and IT leaders can use this week.

Key Takeaways:

1. Inventory shadow AI. Ask your staff what AI tools they use to do their jobs, not whether they're using unauthorized tools. The real number is likely 2–5x what you'll find.
2. Read the actual contract before letting any AI tool touch sensitive data. Find the training-data clause, the termination clause, the audit rights, and who the "Customer" really is. Click-through BAAs don't protect the employer.
3. Treat every AI prompt as a disclosure. Removing names doesn't make data safe. Combinations of attributes, dates, locations, roles, rare events, can re-identify people even without a name attached.
4. Take a position on shadow AI and communicate it. Decide which tools your organization sanctions, which it blocks, and which fall in between. Silence is implicit endorsement.
5. Push back on every "free" professional AI tool. Ask who's paying and what they're buying. If it's not you, the product is your professionals' decisions.

Resources:

1. https://www.nbcnews.com/tech/tech-news/openevidence-ai-doctor-medical-physician-login-app-what-npi-uptodate-rcna341064
2. https://www.healthcare.digital/single-post/clinical-intelligence-a-strategic-analysis-of-openevidence-and-the-multi-agent-medical-ai-ecosystem
3. https://www.ama-assn.org/system/files/physician-ai-sentiment-report.pdf

 

In this episode of Cyberside Chats, Sherri Davidoff and Matt Durrin break down what may be the largest education-sector data breach in history: the massive compromise of Canvas by Instructure. With more than 275 million records reportedly stolen and over 8,800 educational institutions impacted, the incident highlights the dangers of cloud concentration risk, where a single vendor breach can create a domino effect across an entire industry.

The discussion dives into the tactics allegedly used by the Shiny Hunters threat group, the risks of SaaS platform overreliance, and the troubling gap between vendor assurances and real-world containment. Matt and Sherri also explore lessons organizations can apply immediately, including phishing-resistant MFA, monitoring for bulk data exfiltration, data retention reduction, and why every “incident contained” statement should be treated cautiously until independently verified.

 

Key Takeaways:

1. Inventory every SaaS vendor that holds your identity, communications, or user data, and rank them by blast radius. You cannot manage concentration risk you have not measured. The output is a one-page list, ranked by how many users would be exposed if the vendor were breached tomorrow.

2. Enforce phishing-resistant multifactor authentication on every administrative and remote-access account. Hardware security keys or platform authenticators that meet the FIDO2 standard. SMS codes and push notifications are not sufficient against the current voice-phishing playbook. Apply this to every administrative account at every vendor in your inventory.

3. Monitor and alert on bulk data exfiltration across your critical SaaS platforms. Configure threshold-based alerts and additional controls to detect or prevent mass exports of sensitive information through APIs or administrative tools. If an account is compromised, the goal is to stop attackers before they can empty the entire database.

4. Set and enforce a data retention schedule that deletes records when their operational purpose ends. The Illuminate FTC consent order specifically requires this, which is a signal that retention is now in enforcement scope. Data you no longer need is data the next breach will steal.

5. Treat any vendor claim of "incident contained" as a hypothesis until your own monitoring confirms it. Maintain independent visibility into the data flowing in and out of critical SaaS platforms — through your identity provider logs, your CASB, or the vendor's own audit feed. The five-day gap between Instructure's containment claim and the second-wave defacement is the case study.

It took nine seconds for an AI coding agent to wipe the entire production database of PocketOS — a SaaS company serving hundreds of car rental operators across the US — along with every backup. Customers showed up Saturday morning to pick up their cars and there were no reservations on file.

In this episode, Sherri Davidoff and Matt Durrin dig into the cascading security failures behind the PocketOS incident, connect it to a pattern of similar AI-caused outages at Replit and Amazon AWS, and explain why the real problem isn't rogue AI — it's identity. Every one of these incidents involved an AI agent acting under an identity it shouldn't have had, or that was far too powerful. The insider risk playbook applies. We just haven't been applying it to AI.

 

Key Takeaways

1. Treat AI agents like privileged insiders, not trusted tools. Apply your full insider risk playbook: least privilege, separation of duties, peer review, monitoring for anomalous behavior. If a human developer needs approval to push to production, so does your AI agent. The PocketOS and Kiro incidents both trace back to AI agents that were granted more trust than any new employee would get on day one.

2. Scope every credential your AI tools can reach. AI agents will find and use any token they can read — even ones created for unrelated tasks, stored in unrelated files. Audit what credentials live in your codebases and repositories. A token created for domain management should not be able to delete databases. If you wouldn't hand that token to a contractor with no supervision, don't let your AI agent have it either.

3. Enforce controls at the infrastructure layer, not the prompt layer. System prompts are advisory. The PocketOS agent had explicit rules against destructive actions — it knew them, quoted them, and violated them anyway. Confirmation requirements for destructive operations, token scoping, and peer review must live in your API layer and infrastructure, not in a paragraph of text the model is asked to obey.

4. Make sure your backups can survive a compromised identity. If your backups are accessible with the same credentials as your production systems — or stored in the same location — they are not real backups. They are a copy in the same blast radius. Test it: could an AI agent, or an attacker, with production access also wipe your recovery options? In the PocketOS incident, the answer was yes.

5. You cannot fully audit your AI vendor's safety claims. You can't penetration-test a reward signal. You can't verify that fine-tuning data isn't quietly drifting your model's behavior. The only controls you can actually rely on are the ones you own: token scoping, access controls, peer review, and monitoring. The goblin story is a reminder that even the vendor that built the model didn't see it coming. Build your defenses accordingly.

 

Resources

1. PocketOS incident write-up by founder Jer Crane — https://x.com/lifeof_jer/status/2048103471019434248 Amazon Kiro / AWS outage reporting — https://kingy.ai/news/amazon-ai-aws-outage-kiro/

2. Replit AI agent database deletion (Fortune) — https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/

3. OpenAI "Where the goblins came from" post-mortem — https://openai.com/blog/where-the-goblins-came-from

4. Guardian reporting on Amazon cloud outages and AI tools — https://www.theguardian.com/technology/2026/feb/20/amazon-cloud-outages-ai-tools-amazon-web-services-aws

In this live episode of Cyberside Chats, we dig into security debt and why it continues to sit behind so many major incidents. This is the risk that builds quietly over time when controls are available but never turned on, systems aren’t fully decommissioned, or ownership is unclear.

Using recent examples like Stryker, along with Change Healthcare and Colonial Pipeline, we walk through how attackers don’t always need sophisticated techniques. In many cases, they just take advantage of gaps that have been sitting there for years. We also introduce a simple framework to think about security debt across identity, lifecycle, architecture, governance, and operations, and why most real-world incidents cut across more than one of these areas.

We close with a look at how things are changing. With AI accelerating exploit development, the window to fix these issues is getting smaller. What used to be a manageable delay is quickly becoming real exposure.

 

Audience takeaways

1. Require dual approval for destructive admin actions. Any system where one administrator can wipe, delete, or lock out at scale — Intune, Entra, identity providers, backup consoles, remote management tools — should require a second administrator to approve the action before it executes. Microsoft's Multi Admin Approval does this for Intune. Most identity and backup platforms have an equivalent. Turn it on. Stryker is the case study for what happens when you don't. (Addresses: Governance debt primarily; reduces Identity and Architecture debt blast radius.)
2. Enforce phishing-resistant MFA on every administrator and every remote-access path. Not "available," not "recommended" — enforced, with no exceptions. Every admin account. Every VPN. Every Citrix or similar remote portal. Change Healthcare is the case study for what a single missing MFA checkbox costs. (Addresses: Identity debt.)
3. Separate admin work from daily work. Admins should use dedicated, hardened devices for privileged tasks — never the same laptop they use for email and browsing. An infostealer on an admin's everyday device is how privileged credentials walk out the door; isolating admin sessions removes that path. Microsoft calls this pattern Privileged Access Workstations; other vendors have equivalents. This directly addresses how attackers likely got Stryker's admin credentials in the first place. (Addresses: Architecture debt; reduces Identity debt.)
4. Cut your patch SLA in half and plan capacity accordingly. Whatever your current median time-to-remediate is for critical vulnerabilities, assume you need to hit half of it within the next year. The Mythos research shows attacker timelines are compressing from weeks to hours. Your patch program needs budget, automation, and process changes to keep up — not pep talks. (Addresses: Operational debt.)
5. Put expiration dates on every security exception and review them quarterly. If your exception register contains entries with no expiration date, no owner, or a "revisit in the future" stub — those are governance debt. Every open exception should have an expiration date, a named owner, and a scheduled review. Exceptions are fine; forever-exceptions are not. This is also how you close the loop on lifecycle debt: an EOS system running past its decommission date is just an exception someone never wrote down. (Addresses: Governance debt and Lifecycle debt.)

References For listeners who want to dig into the source material referenced in this episode:

1. CISA Alert — Endpoint Management System Hardening After Cyberattack Against US Organization (March 18, 2026). The official CISA advisory issued in the wake of the Stryker incident, including specific guidance on Multi Admin Approval for high-impact actions like device wiping. cisa.gov/news-events/alerts/2026/03/18/cisa-urges-endpoint-management-system-hardening-after-cyberattack-against-us-organization
2. CISA Binding Operational Directive 26-02 — Mitigating Risk From End-of-Support Edge Devices (February 5, 2026). The federal directive that defines deadlines for inventorying and decommissioning unsupported edge infrastructure — a useful baseline for anyone managing lifecycle debt. cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices
3. 3. Andrew Witty Written Testimony, House Energy & Commerce Subcommittee on Oversight (April 30, 2024). UnitedHealth Group CEO's congressional testimony confirming the Change Healthcare breach occurred via a Citrix portal that did not have multi-factor authentication enabled. energycommerce.house.gov/events/oversight-and-investigations-subcommittee-hearing-examining-the-change-healthcare-cyberattack

Anthropic accidentally exposed the source code for its Claude Code CLI—and while no customer data or model weights were involved, the impacts are significant.

In this episode of Cyberside Chats, Sherri Davidoff and Matt Durrin break down what actually leaked, why the agent layer matters more than most people realize, and what happened next—including the rapid emergence of new open-source alternatives like Claw Code.

 

They also answer key questions from a client:

1. What risks should organizations be thinking about because of this leak?

2. Does this change how AI coding tools should be monitored?

3. What are some practical recommendations for educating end users and developers?

 

The conversation focuses on real-world impact: execution risk, supply chain exposure, and the growing need for governance around “vibe coding” tools.

 

Key Takeaways

1. Treat AI coding agents like controlled execution environments These tools can read files, execute commands, and modify code. Govern them like CI/CD or automation systems with constrained permissions and segmentation.

2. Assume attackers are studying this architecture right now The leak removes guesswork. Expect more targeted prompt injection and tool abuse as adversaries analyze how these systems behave internally.

3. Prioritize immediate risks: malicious repos and supply chain abuse Threat actors are already using this as a lure. Monitor for typosquatting, dependency confusion, and “leaked” tools distributing malware.

4. Ensure developers know what’s official—and what isn’t Make sure teams can distinguish between official tools and alternatives. If using open-source variants, vet the source, maintainers, and security model.

5.Take this as an opportunity to formalize AI governance for coding and development tools. Many organizations are still experimenting. Define policies, logging, and oversight now, especially around how these tools are approved and used.

Anthropic’s Project Glasswing and its unreleased Mythos model signal a potential turning point in cybersecurity: AI that can find—and potentially exploit—software vulnerabilities at unprecedented scale.

In this episode of Cyberside Chats, Sherri Davidoff and Tom Pohl break down what this means for organizations today. If AI can uncover decades-old bugs in seconds, what happens to patching cycles, vulnerability management, and the balance between attackers and defenders?

They explore the uncomfortable reality: we may be entering a period where vulnerabilities are discovered faster than organizations can fix them—and where access to powerful AI tools could determine who wins and loses in cybersecurity.

From continuous patching to network segmentation and vendor accountability, this episode focuses on what security leaders need to do right now to prepare for a rapidly shifting threat landscape.

 

Key Takeaways

1. Reduce your internet exposure - If a system doesn’t need to be publicly accessible, don’t put it on the internet. Move services behind firewalls, VPNs, or restricted access controls wherever possible. Attack surface matters more than ever.

2. Vet your vendors’ security practices - Don’t just trust that vendors are handling security well. Ask how they:

• Secure their development lifecycle (SDLC)
• Detect and respond to vulnerabilities
• Patch and distribute fixes
• Vendor risk is now a direct extension of your own risk.

3. Budget for ongoing maintenance of custom code - Custom applications aren’t “done” at deployment. Plan for:

• Regular security testing
• Continuous patching
• Developer time to fix vulnerabilities
• Software is a living system and requires ongoing care and feeding.

4. Segment your network to limit attacker movement - Assume attackers will get in. The goal is to stop them from moving laterally:

• Separate critical systems
• Limit privileged account access
• Control how systems communicate
• Containment is just as important as prevention.

5. Update your incident response plan for zero-day reality - Your IR plan should assume:

• Exploits may exist before patches are available
• Detection may lag behind compromise
• Prepare for faster response, imperfect information, and active exploitation of unknown vulnerabilities.

 

Resources & References

1. Anthropic – Project Glasswing - https://www.anthropic.com/glasswing

2. Anthropic – Mythos Preview - https://red.anthropic.com/2026/mythos-preview/

3. Historical example discussed: Microsoft bug tracking system breach (2017)

4. Example referenced: ProxyShell (Microsoft Exchange vulnerabilities and rapid exploitation)

In this episode, Matt interviews Tom and Derek from our pen test team to break down why attackers often don’t need to hack their way in at all.

While most organizations invest heavily in tools like EDR and SIEM, Tom and Derek share how they regularly get inside buildings using nothing more than confidence, a good story, and sometimes even a box of donuts. From posing as copier technicians to tailgating behind employees, their experiences show that people are often the easiest way into an organization.

And once they’re in, things escalate fast. Physical access can quickly turn into network access, whether it’s plugging in a device, jumping on an unlocked workstation, or moving through the environment with far fewer restrictions than an external attacker would face.

The big takeaway is simple. Real-world testing exposes what audits miss. Doors get propped open, employees try to be helpful, and small gaps add up in ways most organizations never see on paper.

If you’re not testing your people and your physical controls, you’re only testing part of your security.

 

Key takeaways:

1. Attackers target people first, not systems - Social engineering consistently bypasses even mature technical controls.

2. Physical access equals full compromise - Once inside your facility, most security controls can be circumvented quickly.

3. Un-tested controls are assumed to fail - If you’re not running social engineering or physical assessments, you don’t know your real risk.

4. Culture is a security control - Employees must feel empowered to challenge, verify, and report suspicious behavior.

5. Real-world testing reveals what audits miss - Offensive social engineering exposes how attacks succeed, not just theoretical vulnerabilities.