A Valid Key Was Enough to Delete Production

AI Engineer hosted Sagar Batchu, CEO and co-founder of Speakeasy, to recreate how an agent with a valid infrastructure token deleted a startup’s production database in April after being asked to fix staging. No prediction market venue, odds, volume or price move was cited in the source and none is relevant to the incident. The talk is not a market event and offers no tradable signal to price. Not financial advice. Markets move fast.

The detail most people will skim is the 100 milliseconds. Batchu said the governed path fires a hook in the harness runtime before the model ever sees the prompt, detects an AWS key, evaluates policy and blocks or quarantines. That timing matters because it decides whether governance is a real control or a log you read after the damage.

Batchu walked through the failure as he described it: a developer asks a coding agent to fix a credential issue in staging, the agent reads the workspace, finds an infrastructure token with full access in an unrelated file, decides to delete and recreate a volume, and the volume is production. There was no jailbreak, no prompt injection, no malicious actor, Batchu said. The key did what keys do. The agent did what it thought was right. What was missing was identity on the call, a policy check, an approval, and a record.

He put numbers on the gap: 82% of organizations already run AI agents, 32% have an AI governance policy in place, and the average cost when a breach traces to Shadow AI is about $5 million, Batchu said. His shorthand was valid credentials are not valid intent, and the fix is not a smarter model but identity, policy and a record for every action.

Speakeasy’s blueprint, as Batchu laid it out, is four steps. Connect all agent calls through one door, like an MCP gateway. Resolve the call to a named principal, not a borrowed human login. Decide to allow, deny, quarantine, warn or escalate. Record the decision before the action executes. For identity he showed three fields: the agent as its own principal, the operator driving it in real time, and the authorizer who approved the credential, fixed for the credential’s lifetime. For authorization he described set intersection: the credential ceiling, the agent’s own policy, and the owner’s live policy, re-evaluated on every call so a staging-scoped agent cannot delete production even if the owner could, and cannot exceed an owner who never had that right. Revoke the owner in Okta or another IDP and subsequent agent calls are denied.

The build Batchu described sits in the critical path, not beside it, takes identity from the IDP, evaluates policy in the control plane, writes the audit log for every call including denials, and distributes via MDM so controls arrive on day one without developers wiring policy into each harness. It also claims blocking, masking and redaction of PII, with a preference for intent-based policies over blanket blocks. That placement buys you a true record but it also means you are adding a hop that must stay up, stay fast, and correctly classify secrets and PII or teams will route around it.