
An AI agent got its user banned from Resy after firing off around 200 booking requests an hour. As more apps go headless and agents sign up, browse and call APIs for you, the button you used to rely on stops working as a security layer.
Allie Howe from Keycard is back for Security Corner. She, Shane and Abhi dig into why UI has been hiding security holes for years, what happens when an agent crawls every endpoint you publish, and whose identity an agent should use when it acts on your behalf.
You'll also hear about rate limits for an internet where anyone can script anything, prompt injection through WebMCP, where approvals go when there's no UI, consent fatigue, and why MCP might be a better front door for agents than a REST API. Allie also explains ID-JAG, the new protocol behind Enterprise-Managed Authorization for MCP.
Recorded live on AI Agents Hour, a weekly livestream by Mastra CPO Shane Thomas and CTO Abhi Aiyer. Mondays 12PM Pacific.
👤 ABOUT ALLIE Allie Howe is a member of technical staff at Keycard, which builds runtime auth for AI agents. She hosts the Insecure Agents podcast, runs workshops and events on agent security, and founded Security Corner on AI Agents Hour.
Allie on X: https://x.com/vtahowe Insecure Agents: https://insecureagents.com Keycard: https://www.keycard.ai Keycard events: https://luma.com/keycard
📚 MASTRA RESOURCES Mastra: https://mastra.ai Mastra on X: https://x.com/mastra_ai Mastra Discord: https://mastra.ai/community/discord Mastra GitHub: https://github.com/mastra-ai Learn Mastra: https://mastra.ai/learn Principles of Building AI Agents (Book): https://mastra.ai/books/principles-of-building-ai-agents Patterns for Building AI Agents (New Book): https://mastra.ai/books/patterns-of-building-ai-agents
WHAT IS MASTRA? Mastra is an open-source TypeScript framework designed for building and shipping AI-powered applications and agents with minimal friction. It supports the full lifecycle of agent development—from prototype to production. You can integrate it with frontend and backend stacks (e.g., React, Next.js, Node) or run agents as standalone services. If you're a JavaScript or TypeScript developer looking to build an agentic or AI-powered product without starting from first principles, Mastra provides the scaffolding, tools, and integrations to accelerate that process.
⏱️ CHAPTERS 00:00 Cold open 00:28 Security Corner is back 01:13 Agent identity in the enterprise 05:32 Everything is going headless 06:59 UI was hiding your security holes 10:58 Approvals without a UI 12:11 Is MCP the new front door for agents? 15:27 ID-JAG explained 17:24 Outro
Fler avsnitt från "Agents Hour"



Missa inte ett avsnitt av “Agents Hour” och prenumerera på det i GetPodcast-appen.








