@TheTokenSec

Token Security offers a centralized non-human identity security solution for multi-cloud environments.

 Tel Aviv
token.security
Joined May 2024
  • Tweets67
  • Following10
  • Followers68
40Media
The Agentic Universe: more software will be built for agents and humans. Teams are already reshaping products so agents can use them with less friction. @MaorShlomo, founder of @Base44, on what’s next: lnkd.in/gwbUcP8v #AgenticUniverse #CybersecurityAwarenessMonth
22
Nobody has years of experience securing AI agents. The people doing it are learning in production. So we asked them to chart a course with us. Meet The Agentic Universe: free AI agent security lessons from CISOs at @Roblox, @klaviyo, @webflow & more.
1
1
7
2,046
27+ topics across five worlds, from Foundations to Detection & Response. Short videos, deep dives, and checklists you can run against your own environment. No login. No form. Just the shared journey 🚀 token.security/agentic-unive… #AIAgents #AISecurity #CybersecurityAwarenessMonth
1
57
38
An AI agent in your environment has no identity of its own. It acts on behalf of a person, sometimes using that person's human identity. Ido Shlomo from @TheTokenSec spoke to Ashish on @CloudSecPod. First question in any agent review: whose access is it carrying?
2
1
148
⚠️ Your SOC 2 controls can pass an audit while still failing to answer what AI agents are running, who authorized them, or whose credentials they're using. 🔍@TheTokenSec explains why SOC 2 needs to adapt. ➡️ bleepingcomputer.com/news/se… #cybersecurity #sponsored

With the Rise of AI Agents, SOC 2 Should Adapt or Risk Irrelevance

AI agents can operate through human credentials and take actions that existing SOC 2 controls may not distinguish from human activity. Token Security explains why SOC 2 needs to adapt to address the...

bleepingcomputer.com
2
8
27
8,591
Token Security retweeted
NYSE 🏛
@NYSESep 4
Today on NYSE Live: Peter Tuchman, @EinsteinoWallSt Michael Hund, Rare Ventures Itamar Apelblat, @TheTokenSec Tune in 9am ET. xitter.cf/i/broadcasts/1qGvveBNd…
0:00

NYSE 🏛

Today on NYSE Live | Annaly Capital Rings NYSE Opening Bell to Mark New Rare Ventures’ Initiative

1
9
29
194,231
🔐 Snowflake is ending passwords for legacy service accounts, but replacing them is only part of the challenge. 🛡️ @TheTokenSec explains why organizations must also identify account owners, dependencies, and access. ➡️ bleepingcomputer.com/news/se… #cybersecurity #sponsored
1
5
10
8,599
⚠️ Give an AI agent a vague task and broad access, and it may go beyond what you intended. 🛡️ @TheTokenSec explains why agent permissions should stay scoped to their intended purpose. ➡️ bleepingcomputer.com/news/se… #cybersecurity #sponsored

Vague Task, Total Access: When AI Delegation Becomes a Security Risk

AI agents can improvise beyond the intended scope of a task when they are given broad access to enterprise systems and data. Token Security explains why organizations need to define agent intent and...

bleepingcomputer.com
4
3
2
19
8,355
We've spent decades designing identity around people. AI agents are forcing us to design it around software. We spoke to Ido Shlomo, CTO & Co-Founder @TheTokenSec , about why human IAM breaks down for autonomous identities and where authorization becomes the real control point
2
3
4
194
🤖 AI agents improvise to complete tasks. Broad permissions turn wrong decisions into security risks. 🛡️ @TheTokenSec explains why identity and intent-based access controls are becoming the foundation for securing agentic AI. ➡️ bleepingcomputer.com/news/se… #cybersecurity #sponsored

Your AI Agents Are Guessing at Scale: Permissions Decide the Damage

AI agents are designed to improvise as they complete tasks, making broad permissions a growing security risk. Token Security explains why identity, intent-based access controls, and least privilege...

bleepingcomputer.com
2
5
7,348
An AI agent just breached a real company. No human at the keyboard. During an @OpenAI evaluation, an agent escaped its sandbox and broke into @huggingface's production systems. 17,000 autonomous actions. A thread 🧵
1
1
64
more replies
The unsettling part? This wasn't groundbreaking. The agent ran the oldest playbook there is, leaning on over-permissioned, rarely-rotated non-human identities to move deeper. Which means the first confirmed AI-agent breach in history was containable using existing controls.
1
13
AI agents belong in your threat model now. As of yesterday, it's an incident report, not a prediction. Full breakdown: token.security/blog/first-ai…

An AI Agent Escaped Its Sandbox and Hacked a Real Company. It Got In With 0-Days; Credentials Did...

An AI agent escaped its sandbox and breached Hugging Face during an OpenAI eval. 17,000 actions, no human involved. What it means for your threat model.

token.security
10
🤖 AI agents are changing security faster than fixed workflows can keep up. 🛡️ @TheTokenSec explains why organizations can build on an identity foundation while creating security workflows tailored to their environment. ➡️ bleepingcomputer.com/news/se… #cybersecurity #sponsored

AI Agents Broke the Security Playbook. Here's What Replaces It.

Traditional security workflows were built for environments that changed at human speed. Token Security explains why AI agents require a new approach: building on a live identity foundation while...

bleepingcomputer.com
1
5
6,236
The credential you made to read ONE vault may quietly carry read visibility across your whole org. We reverse-engineered 1Password's proprietary SRP auth protocol. The real finding wasn't a broken cipher. A thread 🧵
1
3
115
more replies
Takeaway for defenders: Risk hides in the gap between what a scope SAYS and what a token can DO. Don't just trust scopes, SDKs, or docs. Validate what your credentials can actually reach. Rotate like it matters.
1
15
Full write-up: crypto deviations, the Frida pivot, and the ~420 lines of Python that replaced our SCIM bridge. Read the research 👇 token.security/blog/reversin… #Cybersecurity #IdentitySecurity #NonHumanIdentity

Reversing 1Password's Proprietary SRP Authentication Protocol | Token Security

What if the credentials you created to access a single vault had broader organizational read visibility than you’d expect from its scope?

token.security
1
38
Load more