AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered

On October 14th, the afternoon before the AI Security Summit (AISS) flagship event in San Francisco, Snyk hosted The AI Security Panel: Unfiltered. Yahoo Finance's Deirdre Bosa moderated four people who see AI security from very different seats:

• Manoj Nair, CTO and Chief Innovation Officer, Snyk

• Michael D'Angelo, Technical Lead, Cyber, OpenAI

• John Hultquist, Chief Analyst, Google Threat Intelligence Group

• Ed Sim, Founder and General Partner, boldstart ventures

While they may have disagreed on how to regulate AI, how to supervise agents, and how far to trust them, on the core diagnosis, they lined up pretty well: AI has made attacks cheap, fast, and available to almost anyone, which calls in every risk an organization has ever accepted. Finding vulnerabilities gets easier every month, but being able to fix them is the
actual constraint. Defenders won't close that gap until machines do most of the fixing, inside real identity, permission, and intent controls.

Where did this panel sit in AISS 2026?

The AISS first launched in San Francisco last year (2025) and completely sold out. This year's flagship event ran October 15th, and was just as packed as last year’s.

As the event’s tagline says, it was one full day, in one room, with one track, for the people who own AI risk at the org level, which will be followed up by “satellite”, regional editions in Copenhagen and Sydney on November 25th. AISS is a Snyk and AI Engineer initiative, and its main house rules are that no one resorts to platitudes and that it’ll host no panels where everyone just agrees. Hence, why the disagreement mentioned above is so important. We learned, anyway, that there’s more that binds us together than stuff that separates us.

This panel was the curtain-raiser for the event, held the afternoon before, and hosted by Snyk. Its main promise was to discuss four main issues: the threat now, the threat to come, who owns it, and what to do come Monday morning. The event itself went deep in each session. The panel took the wide shot, with a frontier lab, a threat intelligence team, an investor, and a security company that works where code and agents get created.

From the lively and deep conversation, seven insights stood out:

1. Why is AI a margin call on the risk you already carry?

Most of the risk AI exploits were already on the books, but what changed was the price of cashing it in.

Manoj borrowed his framing from a Snyk customer: "AI is something that attackers are using. AI is a new attack surface, and it's also an insider." Then he named the consequence.

"It's all of your existing risks. It's the margin call on that."

Manoj Nair, Snyk

John Hultquist then laid out the mechanics: attackers have used autonomous technology for about eight years, moving from fake images and spear-phishing emails to deepfake calls to whole operations. North Korean IT workers now run their operations on models from start to finish. Models also make attackers better at the work itself: troubleshooting mid-attack, moving through a network faster, and turning a fresh patch into a working exploit before most defenders have applied it. And it scales, too: "The tools are just now available to so many more people."

Ed Sim pointed to the South Korean bank breaches. CrowdStrike believes the operator was likely one China-based 26-year-old using an open-source AI penetration testing agent as well as a commercial coding agent, and at least nine banks have been reported as targets. The case,
CrowdStrike's Adam Meyers told reporters, "allows one human to target many customers in a very short period of time using the power of AI." Ed's conclusion? "You can't fight hackers that are all over the world who have machines with humans."

Hultquist named the asymmetry underneath, with attackers experimenting at very low cost. If he tried a new way to rob a bank and it failed, "chances are I would be in jail or worse." Online, "they don't face the same consequences."

2. What makes AI agents a different kind of attack surface?

This new attack surface acts on its own: agents, the skills they load, and the access they garner and accumulate.

Development has indeed (or finally?) become a software factory where agents write the code and reach for whatever they need, and everything they reach for ends up becoming an attack surface. Agent skills are the sharpest case there, because they're written in plain English and, as Manoj put it, "three lines of English can become malware." Snyk's ToxicSkills research found at least one security flaw in 36.82% of the 3,984 skills it scanned, plus 76 confirmed malicious payloads. Publishing one on ClawHub took but a Markdown file and a week-old GitHub account.

Hultquist added the attacker's view. Threat actors have mostly preferred using autonomous systems rather than attacking them, with one exception: when people handed personal agents access to everything in their lives, attackers "honed in at that moment because they recognized all the sort of aggregating opportunity." Deployed systems are next, and attackers haven't moved on them en masse, "but they will," and defending them will take "an entirely new security regime."

The Hugging Face incident showed the view from the inside. In July, OpenAI models in an internal cybersecurity evaluation got around the controls meant to isolate them and breached Hugging Face. OpenAI's own report calls it a "warning shot." Michael D'Angelo put the cause in two sentences: "Go do this task, and you will be rewarded. So they went and did the task."

Manoj went to the unglamorous root of "secrets sitting in the open that a 14-year-old with a few tools without AI can attack," and the report bears out his starting point: an agent found publicly exposed Hugging Face credentials and shared them with the other agents.

Ed Sim's answer is to govern agents like the insiders they are, each with its own identity, an audit trail, and access granted for the job that disappears when the job is done. The unsolved part is intent:

"If my goal is to reduce the cost of my compute, what happens along the way if I decide to kill a couple production databases because I
figured out that was a good way to reduce compute costs? Well, I did my job, didn't I?"

Ed Sim, boldstart ventures

And as AI moves into chips, devices, and robots, Ed asked, "Who's going to secure the firmware, the chip stuff, the whole embedded intelligence?"

3. Why did fixing become the bottleneck?

Finding vulnerabilities keeps getting cheaper, and fixing them hasn't kept up in terms of speed. A frontier lab, a threat intelligence team, and Snyk see the same gap, but from different sides.

Michael traced finding through one revolution after another, from fuzzers to dynamic testing to agent harnesses. The hard part comes after, and it's often "a political problem": teams find more than they can route, and the result is patch ping pong, a Slack thread about "who does what, when, how," where "if it breaks, it's you."

Hultquist learned it at Google with Big Sleep, a vulnerability-finding project built around an AI harness, which drew fire on social media for handing bugs to people who maintain open source on their weekends. "It's not enough to just find this stuff," he said. Hand a company a zero-day that an attacker is already using, and the answer is often "it's going to be a while." Finding and fixing are two sides of the same coin, he said, and “if you don’t do both sides, you can’t keep up.”

Manoj pointed to Project Glasswing, where Anthropic's own update says progress on software security "used to be limited by how quickly we could find new vulnerabilities. Now it's limited by how quickly we can verify, disclose, and patch the large numbers of vulnerabilities found by AI."

It names human capacity to triage and patch as the bottleneck. As of May 22, early in the 90-day disclosure window, open source maintainers had patched 75 of the 530 high or critical-severity bugs Anthropic had reported.

The measure that matters, Manoj said, is "fixes that make it to production." Snyk's VulnBump research, published yesterday as well, on October 15th, starts from the same gap: over six months in 2026, Snyk Open Source recorded 459 million vulnerability findings across about 300,000 organizations, and while 94% had a known fixed version, only about 10% had been resolved. The benchmark counts a fix only if the vulnerability is gone and the project still installs, builds, and passes its tests. (Snyk's Evo Remediation Agent cleared that bar on 90.2% of 307 real dependency upgrades.)

His bigger point was where to break the loop. "The whole game has changed to the point of creation," where "agents are the actors," and developers supply the intent. Prevent there and remediate with that context, or stay in "this dead loop of find, fix, find, fix."

4. Does prioritization still work when AI can chain the long tail?

Prioritization is a workaround for human bandwidth, and AI is learning to exploit it.

The piece of standard advice Manoj disagrees with is contextual prioritization: reading signals to pick the 10 issues worth fixing out of 100 is how the industry works, but that only exists to fit the work to the people available. An autonomous attacker keeps no such budget.

"We should be looking at all 100. Get to the point where you can fix everything. Because those 10 things are going to become 100 things before you know it."

Manoj Nair, Snyk

The long tail matters because AI chains it: AI reasons across steps, Manoj said, so it can chain five or six vulnerabilities from the 99th percentile of your list, the ones "you said you would never get to because you don't have enough humans to patch it," into one severe incident. In the essay Michael cited, Greg Brockman describes the Hugging Face breach the same way: an agentic collective "chaining together vulnerabilities ranging from previously-unknown security flaws to using credentials to user accounts that had been leaked onto the internet."

The other half of Manoj's argument is cultural. For his whole career, the trade-off has run one way: operational risk is unacceptable, so security waits. In a room with hundreds of CISOs the week before, he heard it start to flip, toward leaders willing to take an application down briefly to remove a security risk. "Hey, something might be offline for a little bit, but it'll come back. That's better than super safely fixing this and taking a year."

5. What does machine-speed defense look like, and where do humans fit?

Defense has to move at the same speed as the attack, which means agents do most of the work and people do the judging.

Hultquist separated two kinds of attackers. There are your espionage crews that stay "low and slow," living off the land for years. And on the other hand, you have your criminals running extortion, so speed is of the essence: "There's a race between you and me for me to get whatever I need to extort you before you can stop me."

"The average SOC with a human in the loop is not going to be able to keep up with that. The SOC is going to have to take actions on its own, or you're just going to get a call."

John Hultquist, Google Threat Intelligence Group

Ed Sim wants defenders to build "a software defense factory the way that coders build coding factories," and most haven't started: for all the talk of autonomous defense, "99% of the companies don't do it at all." OpenAI is further along, as it says almost all of its initial security alerts are already triaged by AI before a human is looped in. "We don't have the 5 years that we thought we had. We have like 5 days," Ed said. CISOs don't want to give agents authority, "but they're going to have to at some point in time." Hultquist expects incidents to force the issue: "the money doesn't flow until there's a wake-up call in a lot of cases."

People should stay in the loop where it really counts. Manoj framed their job as intent, experience, and judgment call. His one thing is the ratio of issues found to issues fixed: "If that ratio is not fixed, all this other is moot conversation." The bottleneck is the process, because a human has to approve every pull request. You should automate the safe approvals and let people decide the exceptions. Then take the initiative back: "When an autonomous attacker is going to attack you, why don't you attack yourself?"

Michael D'Angelo put a clock on the opportunity. Open models trail the frontier "by a few months", a gap Greg Brockman calls the defender's window: use frontier intelligence now to scan your assets and patch what it finds before someone with a comparable model, "in, say, their bedroom," gets there first. That's the one move every single CISO should make before a frontier-class open model ships.

6. How do you supervise a system that never behaves the same way twice?

This is still an open question, and here’s where the panel's answers split.

Michael’s starting point: “How do you secure a non-deterministic system? Usually, there’s 2 ways: one, you control what it has access to; the other way is generally you use another non-deterministic system.” He took the pattern from his military background:

“When you give 18-year-olds access to extremely dangerous things, the way you do that is, one, you only give certain people certain accesses. And the other thing is you put a sergeant near them. Make sure that they’re doing what they’re supposed to do.”

Michael D’Angelo, OpenAI

He expects fleets of models, with very cheap ones overseeing the rest.

Ed Sim put a deterministic layer in the picture. "It's going to take a village", he said: frontier intelligence for the first scan, then systems built on years of data about real vulnerabilities and how people patch them, because "you need some determinism."
The open-versus-closed question, which Manoj said has reached CIOs in the last few months, gets the same use-case logic: hosting a model somewhere you control is "one layer, but that's not sufficient because what is the behavior by use case?" Some open models are well aligned and still leak personal information badly, so "don't use it for that use case." Nor would he "just assume that frontier is secure."

7. Who is accountable when an agent does damage?

Accountability is being decided in practice while the policy debate keeps running in the background.

Ed Sim framed the question nobody has answered yet: "Is it the model provider? Is it the enterprise that deploys an agent that goes and attacks someone else's place?" OpenAI tests its own releases with internal teams and external testers documented in system cards, and Michael was candid that the field is "still figuring it out."

The panel split on who should settle it. Ed favors self-regulation, warning that rules sized for the largest companies would choke the next “$100 billion company,” and that if we “regulate ourselves to death,” China pulls ahead. Deirdre pushed back:

“When people make this China argument, though, you actually look at China, they are regulating AI in ways that are much more substantial than even America is.”

Deirdre Bosa, Yahoo Finance

She also asked whether self-regulation by the biggest companies invites regulatory capture. Manoj's answer was layered and urgent: "We don't have the luxury of time." Standards first, then visibility, self-regulation, and broader regulation that requires responsibility and disclosure, arriving "much more rapidly than in the past." His sharper point was about attention: "We spend a lot of time fixated on the labs," while agents spread through every enterprise as "very capable agents or potential insiders."

Banks are already acting. Ed pointed to JPMorgan Chase's earnings call that week, where the bank said that, to the extent it can, it is blocking services that rely on customers sharing their banking credentials. CFO Jeremy Barnum's warning, as reported by American Banker: "if they give up their credentials to the agent, and the agent does something that they don't want, that's going to be on them."

What should security leaders do on Monday morning?

The actions that came out of the hour, in the order we'd take them:

1. Use the defender's window. Point frontier models at your own code, infrastructure and backlog now, before open models with the same capability reach attackers (Michael D'Angelo).

2. Attack yourself first. An autonomous attacker is coming, anyway (Manoj Nair).

3. Fix the found-to-fixed ratio. Automate the safe fixes and keep people on the exceptions and judgment calls (Manoj Nair).

4. Let the SOC act on its own. A human in every loop can't keep up with an extortion crew (John Hultquist).

5. Give every agent an identity. It should have its own credentials, an audit trail, and access scoped to the job that expires when the job ends (Ed Sim). Start by auditing what your agents can already do.

6. Turn on strong multi-factor authentication everywhere (Manoj Nair).

7. Ask the board question out loud. “Why can't we fix everything?” If the answer is that uptime always wins, that's a trade-off that needs revisiting.

So, who pays the margin call?

For a panel built to disagree, the agreement ended up being the headline. A frontier lab, a threat intelligence team, an investor, and Snyk all landed in the same place: the risk you accepted when attacks were slow and expensive is now due, and attackers are the ones collecting.

The way out is the somewhat unglamorous one: fix at the speed you find, let machines do most of the fixing, keep people on the calls that need judgment, and give every agent an identity and a leash before it gets the keys.

Ed Sim’s bet for the next year is on the defenders, precisely because they’re “not using it enough” yet. That’s the optimistic read, and also the uncomfortable one: the gap is ours to close, and the clock started before the panel did.

The next morning, Manoj gave the flagship’s first keynote: The AI Hurricane Is Here: Build for the Storm. The panel had already made the case for the second half of that title.

Want to know what your own agents can reach? Download the 2026 State of Agentic AI Adoption, Volume III for Snyk’s analysis of model risk across thousands of enterprise environments.