Inside the OWASP Agent Security Regression Harness Project - Mert Satilmaz - ASW #393
Application Security Weekly (Audio)
Release Date: 07/28/2026
Standardizing Mobile Defense: Inside the OWASP Mobile App Security Project v2 - Jan Seredynski, Ryan Lloyd - ASW #405
Application Security Weekly (Audio)
The OWAS Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification standard for devs (MASVS), and a testing guide (MASTG). Ryan Lloyd and Jan Seredynski from Guardsquare dive into the project to talk about how it's been updated, how orgs can use it, and the challenges orgs face in managing their mobile frameworks and environments. We also cover how agents and LLMs are impacting mobile security and what future iterations of the MAS project might include for securing mobile apps...
info_outline
What's Not Found in AppSec? - ASW #404
Application Security Weekly (Audio)
To celebrate our 404th episode we discuss what's not found in modern appsec and what still exists that should become not found. The conversation starts with a classic problem of appsec -- looking for a reliable vuln prioritization methodology. But we expand from there to challenge whether a focus on vulns and patches is even the right choice for an appsec program. Then it's on to incentives, the role of agents in writing and securing software, and what we should be looking for to bring new appsec practitioners into the industry. Visit for all the latest episodes! Show Notes:
info_outline
Getting Granular with Access, Attributes, and Intent - Alex Olivier - ASW #403
Application Security Weekly (Audio)
The principle of least privilege access is ubiquitous in recommendations, but perhaps too uncommon in practice. Alex Olivier explains how the AuthZen Working Group has been approaching new standards, guidelines, and practical deployment patterns to make it easier for orgs to establish more refined and correct access policies. It's a problem that predates LLMs, but also one that agents and MCPs made all the more acute. We talk about what intent means when trying to constrain agents' activities, what role LLMs have in policy decisions, and how LLMs can help create a much-needed inventory of...
info_outline
Going From Bug Bounty Bugs to More Secure Systems - Shlomie Liberow - ASW #402
Application Security Weekly (Audio)
Finding flaws with LLMs and agents is changing bug bounty programs. But it's not necessarily changing how orgs fix those flaws. Shlomie Liberow shares his experience across a decade of bounty programs and how they have changed for researchers and orgs. He explains why fixing the bug reported through a bug bounty is more about understanding interconnected systems than fixing a single piece of software. We discuss how orgs can be more effective at securing their environment and what role LLMs might have in evaluating controls. Plus, we look to the future of bug bounty programs and how...
info_outline
Understanding Prompt Injection In Order to Contain It - Julie Brunias - ASW #401
Application Security Weekly (Audio)
Prompt injection demonstrates one of the major challenges in securing LLMs and agents -- how do you ensure an agent ignores attackers and only does what you instructed it to do. The flaw highlights how LLMs mix inputs, context, and outputs without any strict boundaries between them. Julie Brunias joins us to talk through examples of injections, why their consequences can go beyond information leaks, and why trying to mitigate them with other LLMs is insufficient. Segment resources: Visit for all the latest episodes! Show Notes:
info_outline
The AI Threat Multiplier: Securing Mobile Apps in the Automated Era - Ryan Lloyd, Jason Cortlund - ASW #400
Application Security Weekly (Audio)
While agents and LLMs haven't fundamentally changed core mobile vulnerability types, they have supercharged speed, scale, and accessibility—democratizing threats like automated phishing, synthetic identity fraud, and easier identification of hard-coded secrets. Ryan Lloyd and Jason Cortlund break down how threat actors leverage LLMs as a force multiplier to accelerate mobile app attacks. Then we discuss actionable defense strategies, from viewing agents as an active adversary to leveraging server-side threat telemetry, attestation, and layered defense strategies combined with polymorphic...
info_outline
Security Conversations on AI, Agents, and Emerging Threats from Black Hat 2026 - Michael Leland, Ido Geffen, Sean Murphy, Idan Plotnik - ASW #399
Application Security Weekly (Audio)
We showcase recordings from this year's Black Hat. The Hidden Risks of the AI Supply Chain - Black Hat interview with Michael Leland, VP and Field CTO of Island Agents can independently discover and install tools, but the emerging ecosystem of Skills and MCP servers lacks many of the trust and security controls applied to traditional software. Michael Leland discusses Island's research uncovering thousands of malicious repositories, widespread security flaws across MCP servers, and a new attack technique called “AgentBaiting,” in which attackers manipulate agents into finding and...
info_outline
Fixing Software Weaknesses Rather Than Just Finding More Flaws - Gil Geron, Nidhi Aggarwal, Braden Russell - ASW #398
Application Security Weekly (Audio)
AppSec has always emphasized techniques and tools for discovering vulns, along with taxonomies and lists for describing them. But just piling up more CVEs into a prioritized patching queue has never been an effective strategy. Nidhi Aggarwal talks about some of the economics and decisions that orgs evaluate when figuring out how to improve and protect their software. LLMs might be effective assistants in generating code, but only when they have the context of secure patterns to follow. We also talk about what some of the bug bounty data reveals in terms of successful researchers finding more...
info_outline
Applying Zero Trust Principles to Agents - Kieran Human - ASW #397
Application Security Weekly (Audio)
Sandboxing, least privilege, and monitoring are well-established controls in terms of the defenses they provide against unexpected and unauthorized actions. But being well-established in theory doesn't always translate to successful in practice. Kieran Human talks about some of the properties that a good sandbox should have and how monitoring creates a feedback loop to refine allow lists and access controls. In practice, the potential unpredictable behavior of an agent isn't much different from malware. We talk through some of the ways orgs can securely deploy agents without unnecessarily...
info_outline
Augmenting Threat Intel Analysis with Agents - Chris Wallis, Sai Kiran Uppu, Ramin Farassat - ASW #396
Application Security Weekly (Audio)
All sorts of cybersecurity disciplines are adopting agents to help humans save time and automate routine activities. Sai Kiran Uppu describes his work on creating a platform for agents to analyze external threat intel, examine internal systems, and present triage decisions to operators. This type of work is especially useful to orgs that deal with petabytes of data and thousands of systems. And, as Kiran notes, it's important to keep that scale from blowing up your budget or turning triage into a procession of false positives. Ideally, this kind of threat intel that's paying attention to...
info_outlineOrgs need to be able to use agents, MCPs, and LLMs in ways that don't lead to unexpected actions and undesirable outcomes. The OWASP Agent Security Regression Harness project is an approach for defining customizable scenarios and testing whether those systems fail against known security threats. Mert Saltimaz talks about the background of the project, how orgs can use it as they bring more LLMs into their environment, and how the project intends to grow. Importantly, we also talk about the security controls and designs that orgs can build around the systems and data that models interact with in addition to evaluating the security of the agents and agent harnesses themselves.
Segment Resources:
- https://github.com/OWASP/Agent-Security-Regression-Harness
- https://youtu.be/6DWs5EwbFQ0?si=r0IJ_F0SZnkPzzYg -- "What Trading Systems Taught Me About Breaking (And Defending) Infrastructure"
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-393