Agentic AI Exposes Decades-Old IAM Failures, Not New Security Risks

·1 views

Security concerns around agentic DevOps pipelines — such as agents exceeding their tasks or bypassing human approval — are largely pre-existing identity and access management failures now playing out at machine speed. Microsoft's 2024 multicloud risk report found that only 2% of granted permissions were actually used in 2023, while over half of cloud identities held access to all permissions and resources. The principle of least privilege has been a documented security standard since Saltzer and Schroeder formalized it in 1975, yet organizations have consistently over-provisioned access on the assumption it would never be fully exercised. Unlike humans, AI agents have no habits or hesitation, meaning they act within the full scope of granted permissions rather than the narrower bounds of a runbook. Workload identities already made up 83% of all cloud identities before AI agents arrived, meaning unrestricted non-human access was the majority case long before large language models were connected to cloud APIs.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Open-Source Framework Offers Structured Testing Methodology for AI Agents

A developer has released an open-source, framework-agnostic testing methodology designed to rigorously evaluate AI agents beyond basic response checks. The project includes a 61-source benchmark map referencing standards such as BFCL, GAIA, SWE-bench, and WebArena, along with 58 universal test blocks organized across seven tiers. It also incorporates the full OWASP Top 10 for Agentic Applications 2026 and aligns with regulatory frameworks including NIST AI RMF, MITRE ATLAS, the EU AI Act, and ISO/IEC 42001. A real-world macOS agent called PheronAgent, equipped with over 50 tools, is included as a reference implementation with documented bugs and actual test runs. The repository is publicly available on GitHub, with documentation licensed under CC BY 4.0 and templates under MIT.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One Follow-Up Prompt Can Catch the Data Bugs Your Code Review Misses

A piece published on DEV Community argues that data engineers routinely skip a critical step when using AI coding assistants: asking the model to critique its own output. The author illustrates the risk with an incremental load scenario, where an engineer catches two obvious flaws through self-review but misses a third — an unstable business key assumption — that later causes unexplained duplicate rows in production. The core argument is that prompting an AI to find problems generates fundamentally different output than prompting it to solve one, because the tasks are shaped differently. The recommended follow-up prompt — 'Critique this. What breaks first? What did you assume that I didn't tell you?' — is designed to surface hidden assumptions the engineer never explicitly provided. The author notes this habit is most absent among intermediate engineers, who have learned to question AI output but still treat the entire review process as solely their own responsibility.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds iOS app invisible to App Store search after months of flawed keyword tracking

An indie iOS developer discovered that their app ranked for only 2 of 59 tested keywords across six App Store storefronts, with both matches consisting solely of words already in the app's title. Critical search terms like 'app blocker' and 'digital detox' returned no results for the app in any country. The developer also found that their keyword-tracking script used a browser-style User-Agent header, which returned artificially optimistic rankings compared to neutral HTTP clients, making months of recorded data unreliable. A separate SEO check using the 'site:' search operator was similarly compromised, as it was returning unrelated results from Chinese Q&A sites rather than the developer's own domain. The developer concluded that the app's stagnant download count stemmed from indexing and measurement failures rather than a lack of demand or a marketing shortfall.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

React Custom Hooks Explained: How to Reuse Stateful Logic Across Components

Custom Hooks in React are JavaScript functions prefixed with 'use' that encapsulate reusable stateful logic, allowing developers to share it across multiple components without duplicating code. Common use cases include API data fetching, window resize detection, online/offline status monitoring, and form validation. Unlike copying logic into each component, Custom Hooks keep codebases cleaner and easier to maintain by isolating functionality in a single reusable function. Importantly, while the logic is shared, each component instance gets its own independent state, meaning two components using the same Hook do not share data. This concept is part of Day 18 of the React Mastery Series on DEV Community, which has been progressively covering advanced React patterns.

0 comments Read more at DEV Community