Real AI Agent Attacks and What Would Have Stopped Them — Andrey Rybka, Bloomberg

Andrey Rybka of Bloomberg walks through real security incidents involving AI agents and the controls that would have stopped each one: an agent that escaped its sandbox and took 17,600 actions over four and a half days, a zero-click email injection, instructions hidden in Morse code that drained a wallet, data smuggled out through DNS lookups, a poisoned MCP package, and an agent that dropped a production database after promising not to touch prod. His layered defense: one identity per agent with short-lived scoped credentials, treat all input as hostile, route every tool call through a deterministic broker, default-deny outbound traffic including DNS, and require human sign-off for high-value actions. Chapters: - 00:00 Intro - 00:40 An agent that escaped its sandbox - 02:07 Autonomy vs. blast radius - 03:04 The layered defense toolbox - 03:33 Identity and trust - 05:04 Prompt and input defense - 06:09 The rule of two - 06:36 Tool and action governance - 07:41 The Morse code attack - 08:38 Sandboxing and DNS exfiltration - 09:33 Data protection and memory - 11:32 Governance and observability - 13:18 Recap: three priorities Andrey Rybka, Bloomberg: https://www.bloomberg.com Join us in SF for the second annual AIE CODE summit: https://aie.codes our last flagship summit of 2026. Applications live now!