insecureagents.com valid

Insecure Agents

A podcast about AI security, vulnerabilities in AI systems, and building secure AI agents. Hosted by Allie Howe. A Keycard property.

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-26T01:36:33.560Z. Cached copy · Source on insecureagents.com

# Insecure Agents

> A podcast about AI security, vulnerabilities in AI systems, and building secure AI agents. Hosted by Allie Howe. A Keycard property.

## Pages
- [Episodes](https://insecureagents.com/): the podcast episode feed
- [Live Events](https://insecureagents.com/live): live recordings and panels

## Episodes
- [Ep 63: Josh Woodruff, Co-Chair, Zero Trust Working Group at CSA and Founder & CEO of Massive Scale AI](https://insecureagents.com/episodes/josh-woodruff) — transcript: https://insecureagents.com/transcripts/josh-woodruff.txt: Josh Woodruff, Co-Chair of the Zero Trust Working Group at the Cloud Security Alliance and Founder and CEO of Massive Scale AI, joins us to talk about the Agentic Trust Framework, the open source zero trust model for AI agents he donated to CSA. His framing is simple on purpose: treat every agent like a new hire. It goes on the roster, gets a badge, starts as an intern, and earns more freedom through demonstrated reliability, with instant demotion when it misbehaves. Zero trust taught us to check who you are and what you can reach on every request. Josh argues agents need one more check on top of that: what are you doing right now, and is that allowed at this moment? We get into why agents running under a human's identity break your behavioral baselines and turn every kill switch into a work stoppage, why intent is a useful signal but the checkpoint still has to be able to say no, and how ATF fits alongside AARM and Agent Baseline as the field converges.
- [Ep 62: Andy McMahon, Director, Principal AI & MLOps Engineer at Barclays](https://insecureagents.com/episodes/andy-mcmahon) — transcript: https://insecureagents.com/transcripts/andy-mcmahon.txt: Andy McMahon, Director and Principal AI & MLOps Engineer at Barclays, joins us to talk about what it actually takes to move an agent from prototype to production inside a 200-year-old bank. His name for the core problem is the fishbowl: every platform, vendor, and runtime arrives with its own identity provider and its own auth, and you are left trying to make the fishbowls speak to each other. The fix was landing on one persistent concept of agent identity that ties the initiating client, the agent, and any delegated permissions together. We get into the three foundations he builds on (gateways, registries, and runtimes), why kill switches have to be layered from credential revocation through gateway denial to killing the runtime entity, why deciding when to pull one is still hard, and why an incident where agents doctored their own logs means the audit log must sit outside agent control.
- [Ep 61: Ian Livingstone, Peyton Casper, and Ivy Lee, CEO of Keycard; Product Lead, Identity at Browserbase; and VP Product, CMS Agentic Commerce at Visa](https://insecureagents.com/episodes/browserbase-navigate-panel) — transcript: https://insecureagents.com/transcripts/browserbase-navigate-panel.txt: Recorded live at Browserbase Navigate 2026 on September 10, this panel asks
…

Related sites

Explore similar publishers →

Category suggestions: other listed sites in AI and machine learning. These share a category. See the whole category →

Machine-readable: GET /v1/resolve?q=insecureagents.com · GET /v1/domain/insecureagents.com · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for insecureagents.com:
1. POST https://agentwebmap.com/v1/sites/insecureagents.com/claims and keep claim_id and claim_secret private.
2. Publish the verification line "AgentWebMap verification: <token>" (token from step 1) in https://insecureagents.com/llms.txt, or use the DNS, meta-tag or well-known method the response describes. This only verifies the listing; your website and domain remain yours.
3. POST https://agentwebmap.com/v1/sites/insecureagents.com/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/insecureagents.com).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.