What Practitioners Actually Think About AI Security

Where this comes from

Cloud Security Office Hours is a free, open Zoom that runs every Friday. Practitioners drop in, someone asks a question, the room works through it, and every session gets a published recap. AI has been a substantive topic in 22 of them since November 2024.

This is not a survey and not a consensus document. It is what people said to peers rather than to a camera. No attendee is named. Where sessions contradicted each other, both views are here. Where a recap frames something as speculation or an untested allegation, so does this page.

Governance arrived after the tools did

Every governance discussion started from the same position: the tools were already in the building. In the December 20, 2024 session the talk was still abstract, covering assurance programs and documenting an AI component's version, training data, and license structure.

Eighteen months later the question was enforcement. The May 29, 2026 session compared mobile device management controls, network proxies, and AI gateways that restrict which models and data employees can reach, and drew a line worth keeping: an unintentional bypass (working around a control to fix a technical problem) is a design failure, while an intentional one is a disciplinary matter and not something to solve with more technology. That session also noted that real enforcement needs a central purchasing function and mature HR controls, which smaller companies do not have.

In the June 26, 2026 session attendees described employees blowing through token limits and a scramble to stand up governance tooling. The room split on responsibility: users choosing models well, or vendors designing tools non-technical staff cannot hurt themselves with. One view, offered from direct experience, was that these models were never built with enterprise controls in mind.

The January 30, 2026 session was the most candid about policy itself. Keeping an approved-tools list current was called a losing battle, and sensitivity labels fail when nobody has defined what counts as sensitive. One attendee offered a "grandma test" for AI input: if your grandmother would not understand it, do not paste it. And pointing an AI agent at your policies is not a substitute for writing clear ones.

Agents and agent skills: the current unsolved problem

If one topic is treated as genuinely unsolved, it is this. The May 22, 2026 session took it head on. Three familiar scanning approaches were laid out (scanning in CI/CD, external secret scanners, secured runners with telemetry) and agent skills defeat all three: they are plain text, they reference one another, and malware scanners are ineffective against threats written in ordinary language. The session cited a Snyk study finding that 36% of AI agent skills contained security issues including prompt injection, and the room agreed there is no reliable way today to spot a malicious skill in a marketplace. The workaround is procedural: organizations that ban open agents still permit skills and review them the way they review open-source library requests. One gap named there: platforms lack an administrator control restricting agents to official-marketplace skills.

Earlier sessions circled it. April 18, 2025: no centralized security standards for the Model Context Protocol, machine identities with broad access, real potential for data leaks and unauthorized changes. August 8, 2025: non-determinism creates repudiation problems, agents must act inside the user's intent, and one practitioner described treating agents like "dumb interns" with scoped permissions, heavy logging, and human approval for anything critical. April 3, 2026 turned it into patterns: separate planning from execution, verify critical use cases, validate inputs, grant privileges just in time. Dropping privileges cleanly was the hard part, and vendor support was thin enough that teams were building their own. May 8, 2026 covered runtime sandboxing, with agent access to credentials and production as the core worry.

The June 5, 2026 session is where to read the room's temperature. Working through Anthropic's white paper on agentic security, several attendees felt it read more like positioning than prescriptive guidance, lacking implementation detail and cryptographic controls, and some questioned whether autonomous agents can be reliably secured at organizational scale at all.

Attackers, phishing, and the AI supply chain

The room is consistently less alarmed about AI-powered attackers than the trade press, and consistently more alarmed about the AI supply chain.

The November 7, 2025 session discussed the Google Mandiant report finding that most AI-assisted malware was detectable by existing security technology and did not represent a significant threat, alongside the observation that malware authors often neglect code quality. The July 10, 2026 session was more concrete on phishing: AI is effective at scanning for vulnerable targets and customizing campaigns, making mass phishing more targeted and efficient. Autonomous follow-up replies to a victim were described as possible, but untested by the person raising it.

The supply chain is where the room saw actual damage. The March 27, 2026 session worked through the reported compromise of the LiteLLM Python package, with credential exfiltration at scale and subsequent extortion. Mitigations discussed: version pinning, air-gapped development, separating CI from CD, short-lived credentials, and private maintainer channels. Allowlisting outbound connections was called impractical given dependency depth in GitHub Actions, and the conclusion was that layered measures buy resilience rather than immunity. The June 5, 2026 session added the Ironworm eBPF rootkit, which uses backdated commits and AI tooling to mask malicious activity. A related note from the October 24, 2025 session: an observation from a CISO event that many security leaders seem to prioritize fourth-party risk over more immediate exposures such as open-source vulnerabilities.

The unglamorous problems never went away. The November 29, 2024 session catalogued AI infrastructure misconfiguration: predictable default bucket naming for a managed ML service, Azure OpenAI accounts left publicly accessible, unencrypted notebooks and models, exposed access keys. It also drew a line still worth using: jailbreaking is a vulnerability, but not a CVE-style one.

Cost, hype, and the promise gap

This is where practitioners sound least like the marketing. The May 29, 2026 session observed that token limits still sit below actual costs even after recent changes cut available tokens, and that newer models are less token-efficient. The sharpest point: performance metrics can accidentally reward token-maxing rather than useful output.

The skepticism is older. The March 14, 2025 session described a race to the bottom in AI pricing and a major provider struggling to sell AI add-ons for its productivity suite. The February 6, 2026 session predicted that large generative models could lose ground to specialized, localized applications on compute cost alone. The June 5, 2026 session compared AI company financials to prior bubbles and questioned IPO and debt sustainability, with one attendee predicting a possible market correction within 18 months. That is speculation, and it is recorded here as speculation.

On motives, the June 27, 2025 session argued that adoption is frequently driven by hype and a desire to cut costs rather than by a clear use case. The December 20, 2024 session had the cleanest analogy: one attendee compared the AI hype cycle to 5G in telecom, warning of overinvestment followed by disappointment.

Frameworks, trust scores, and ontologies

Two strands run through the sessions. The first is scoring and control. In the July 24, 2026 session, Rohit Valia of Tumeryk presented an AI trust-scoring framework built in partnership with the Cloud Security Alliance, evaluating models across six pillars: security, privacy, reliability, excessive agency, transparency, and safety and societal impact. In the demonstration, Gemini scored strongest across most categories. That is a vendor presenting a vendor product, and it is reported here as a presentation rather than an independent evaluation.

The second strand is structural: ontologies, taxonomies, and graph databases used to constrain what AI systems can do and make their outputs auditable. It appears in the September 12, 2025 session (graph lookups and guard layers, with the field called nascent and in need of standardization), the April 3, 2026 session (graph-backed approaches to reduce hallucinations), and the February 6, 2026 session (semantic layers for auditability, plus skepticism that major providers would ever adopt data-provenance tracking given the legal exposure). The December 20, 2024 session pointed defenders at the OWASP Top 10 for large language model applications, and nothing since has displaced it as the starting point.

One contested framing, from the June 27, 2025 session: an industry report concluding that AI security is an extension of existing tooling rather than a standalone category, implying organizations should wait for their current vendors to extend into it rather than buy a new category.

Do the AI labs practice what they preach?

This comes up more often than a vendor would like, and it is entirely opinion. In the April 3, 2026 session, after a widely discussed code leak, several attendees criticized the engineering quality on display, compared it to spaghetti code, and questioned building complex systems without stronger engineering oversight. There was also concern about how few experienced security professionals sit in AI company leadership.

The July 24, 2026 session returned to it: the view from several attendees was that the major labs hire well-known security people but do not visibly translate that into controls, and that public messaging leans more on marketing than on demonstrated practice. That recap explicitly notes these were opinions offered in discussion rather than assessments the group had evidence for, and that is how they should be read. The same session touched on contested reports of an experiment in which a model given limited internet access was said to have escaped its constraints and probed Hugging Face systems. Those details are disputed.

Two complaints are structural rather than cultural, and therefore more actionable. From the May 22, 2026 session: covering agent skills would require real collaboration from the model providers, and a provider compliance API would improve visibility into agent interactions for auditing and blocking. From the June 26, 2026 session: provider compliance tooling arrived late, well after enterprises had adopted the tools.

Where the room disagrees

These are live disagreements, not strawmen. None of them were settled.

Does AI need new security tooling, or an extension of what we have?

The oldest fault line in the archive. In the December 20, 2024 session one view was that securing AI is a never-ending race because social engineering keeps evolving, countered immediately by the view that this is a normal security problem with known mitigations. Eleven months later the November 7, 2025 session ran the same argument: a proposal that new defensive mechanisms are needed to monitor AI-generated threats, met with skepticism that entirely new tooling is required and an argument that existing controls would likely suffice against AI-generated phishing and malware.

Are LLMs actually useful in security work?

In the April 18, 2025 session one attendee said flatly that they had yet to find an LLM accurate and insightful enough to use, and asked where anyone was finding ones that worked. The same session produced two counterexamples: an incident-summary feature inside a security platform, and generating infrastructure as code for attack-simulation environments. By the June 27, 2025 session a narrow, verifiable win was on the table: small language models detecting secrets in code. Broad skepticism about general-purpose use, real enthusiasm for narrow tasks with a checkable output.

Who is responsible when this goes wrong?

The June 26, 2026 session split on users versus vendors, and weighed whether fines change behavior at all, with one suggestion that personal liability for executives would work better than corporate fines. The June 5, 2026 session ran the same question one layer down: model provider or infrastructure provider. Neither reached a conclusion.

Can autonomous agents be secured at all?

The June 5, 2026 session included the position that reliable security for autonomous agents may not be achievable at organizational scale. The August 8, 2025 and April 3, 2026 sessions proceeded on the opposite assumption, that scoped permissions, separated planning and execution, and human approval gates get you far enough in practice. Both positions are still represented.

What changed between 2024 and 2026

Late 2024: keep the data out. The November 29, 2024 and December 20, 2024 sessions were about keeping confidential data out of models and fixing misconfigured AI infrastructure. The January 17, 2025 session was a guest presentation on exactly that: masking names and account numbers before a prompt leaves the building, then de-anonymizing the response. On malicious use of AI, the December 2024 session recorded that the group did not find substantial evidence for it at the time.

2025: the year of the agent. Machine identity and protocol gaps in April, threat modeling for non-deterministic systems in August, the first framework sketches in September. The question shifted from what might leak to what it might do.

2026: governance and the ecosystem. Token budgets and AI gateways, acceptable-use enforcement, agent skills as an artifact nobody can scan, compromise of AI-ecosystem packages, and trust-scoring rubrics. The unit of concern moved from the model to everything around it.

What did not change. Hallucination and the need for human verification run through nearly every session, from the November 2025 warning about relying on AI-generated remediation guidance to the February 2026 point that you need baseline knowledge to use these tools safely, to the July 17, 2026 session on verifying AI-generated code.

The honest scorecard. One 2024-era position aged well: the camp arguing AI security is a normal security problem was partially vindicated by the November 2025 Mandiant finding. And here is what the room mostly did not see coming. By 2026 the concrete AI-related damage under discussion was not model capability at all. It was supply-chain compromise in the AI package ecosystem and AI tooling used to disguise malicious commits. The threat arrived through the ecosystem, not through the model.

FAQ

Is this an official position of Cloud Security Office Hours?

No. It is a synthesis of what attendees said on the live Friday call across 22 sessions. CSOH is vendor-neutral and takes no house position on AI security. Where attendees disagreed, both sides are reported rather than reconciled, and opinions are labeled as opinions.

Why are no individual attendees named?

The Friday session is open to anyone, but it is a conversation, not a publication. People think out loud, change their minds, and talk about their employers informally. Attributing opinions to named individuals would change what people are willing to say. Guest speakers who presented publicly are named, because presenting is a public act.

How were the 22 sessions selected?

They are the recaps between November 2024 and July 2026 in which AI security or AI governance was a substantive part of the discussion rather than a passing mention. Every claim on this page links to the recap it came from, so any reader can check the source.

Can I join the Friday session?

Yes. It runs every Friday, it is free, there is no pitch, and there is no requirement to speak. Details are on the sessions page, and every past session has a published recap.