[tl;dr sec] #342 - Figma's Agentic Detection, Agent Identity, Uber's Agent-(E)DR

What it is

Issue #342 of the tl;dr sec newsletter (author: Clint) is a link digest. The details below are the ones that go beyond the catalog summary. The page gives no issue date.

How it works

Figma agentic detection (Matthew Sullivan, Brad Girardeau). The system sits on Panther SIEM. It investigates alerts, queries audit logs from AWS, Okta, GitHub, GCP, osquery and over a hundred other sources, and opens PRs to fix issues. Reported results: about 70% shorter time-to-resolution on complex alerts, and 20% fewer on-call pages through AI-driven severity downgrading.

• Retrieval uses AWS Bedrock Knowledge Bases and Amazon Kendra. Tines handles workflow automation. A Snowflake SQL-writing sub-agent queries the Panther data warehouse.
• Three memory layers: case memory (RAG corpus of past alerts), steering memory (markdown behavioral guidance), and procedural memory (self-learned database schemas, which sharply cuts schema-discovery queries).
• Safety controls sit at the tool layer, not in prompts. Agent-authored PRs default to draft, and prompts are channel-aware so data is not exposed in public Slack channels.

Uber ADR (open source). A sensor captures agent telemetry: prompts, MCP activity, reasoning traces, tool calls and execution context. A two-tier detector flags credential exposure, prompt injection, data exfiltration and policy-violating tool use. ADR-Bench covers 300+ tasks, 17 agent attack techniques and 133 MCP servers. An arXiv paper and MLSys slides exist.

Cloudflare Agent Access Model (Matt Silverlock). It authorizes each action against the task's accumulated state. It has six components: Agent Identity Broker (short-lived sender-constrained credentials), Task-Scoped Access Engine, Mediation Layer (tool calls and network egress), Trust Ratchet (irreversibly removes capabilities after protected events), Agent Activity Log, and Grant Review Loop.

1Password local agent identity (Horia Culea). A trusted local app verifies the agent's OS code-signing identity and mints short-lived SPIFFE JWT-SVIDs, backed by a device key in the Secure Enclave or TPM. It combines OAuth 2.0 Token Exchange (sub for the human, act for the agent), OAuth Transaction Tokens for per-call intent binding, WebAuthn/FIDO2, and CAEP for revocation.

Wiz CosmosEscape (Yuval Avrahami, Lior Maman). A Gremlin sandbox bypass using .NET reflection gave arbitrary code execution on the multi-tenant DB Gateway. That exposed the "Cosmos Master Key", a platform-wide signing credential that can fetch the primary key of any Cosmos DB account across tenants, regions and API flavors. The same key unlocked the Config Store, a registry that lets an attacker list accounts and filter by target organization. Affected targets included Microsoft's own Entra ID, Teams and Copilot backends.

In-memory YARA hunting (Ben Bornholm). This uses osquery's new yara_process table and Fleet's authenticated YARA rule distribution. Two homelab cases: a memory-only Sliver C2 implant in a Kubernetes DVWA container, and a malicious local MCP server posing as a code scanner for Claude Desktop and stealing credentials. Custom containerd_* osquery tables and recursive SQL joined on PID namespaces rebuild container process trees past PID 1. Fleet GitOps pushes rules through osquery's enrollment identity, so rules are not written to disk or hosted on an unauthenticated server.

Preconditions / Affected

CosmosEscape affected Azure Cosmos DB across tenants. Microsoft deployed a hotfix within 48 hours of Wiz's disclosure, then migrated the architecture to eliminate the Cosmos Master Key. The page gives no customer action.

What to do

The page lists no commands. The actionable items are design patterns:

• Enforce safety at the tool layer and default agent PRs to draft (Figma).
• Replace on-disk agent credentials with short-lived, scoped, logged grants (1Password).
• Use the Uber repo and ADR-Bench to evaluate agent monitoring.
• Beyond Zero (summarized by Kane Narraway): finish data classification, enrich the IdP with HR context, deploy SSF and CAEP, use MCP or API gateways, and run async policy evaluation to measure false positives before enforcing.

Caveats

• Silverlock says multiplayer access control (one agent serving principals with different permissions) is unsolved in AAM.
• Narraway notes Beyond Zero depends on SaaS and AI vendors adopting external authorization hooks, which makes vendor adoption the bottleneck.
• The Figma figures are the authors' own, and the newsletter only summarizes each source. Details need the linked posts.
• Brockman, Venables and Saxe are summarized as arguing for urgent AI-assisted defense. These are opinions, not measurements.