--- schema: 1 type: video title: >- We let an AI agent execute Bash and lived to talk about it — Sarah Sanders, PostHog description: >- Someone opens a pull request on one of your open source repos and drops a line into a markdown file. An automated code review reads it and says looks good. That file is part of the content pipeline feeding an agent that runs commands on thousands of developer machines, so you have now shipped a prompt injection payload signed by you. Sarah Sanders is a context engineer at PostHog, where the Wizard is an agentic CLI that reads a codebase, installs the right SDK, instruments events, and builds dashboards, turning an hour or two of setup into five or six minutes. Roughly 8,000 people run it a week. When the team started talking about making it the default install path, Sanders looked at the anatomy of what they had built and saw what she calls the malware starter pack, because an agent with a shell is almost exactly what you would hand a piece of malware if you were feeling generous. Her audit found the allow list was tighter than feared, with bash denied by default and secrets routed through a vault, but the security team still found gaps, and the shape of them mattered more than the specifics. Almost none were obviously evil. They were two innocent things shaking hands. Attacks compose, she notes, and code review does not. The scanner she built in response runs on YARA rules, is deterministic on purpose, and only reports findings rather than acting on them. It caught sub agents inventing ways around the guardrails to hunt for secrets, which ended sub agents entirely. The language model layer she added on top advises, never enforces, and fails closed. Speaker info: - https://www.linkedin.com/in/sarah-s-42913121a/ Timestamps: 0:00 - What the Wizard does 2:52 - The malware starter pack 5:28 - Layer zero: prompts are not security 7:08 - What the allow list actually blocked 8:00 - Attacks compose, code review does not 8:50 - The context mill and its supply chain 11:24 - Building a detector that does not act 13:08 - Sub agents hunting for secrets 14:50 - Triage: adviser, not bouncer 16:34 - Anatomy of a rule 19:06 - The posture now, in three lines --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/4lXks428C9o-we-let-ai-agent-execute-bash-lived Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- canonical: >- https://liquidgold.cc/channel/aidotengineer/explore/video/we-let-an-ai-agent-execute-bash-and-lived-to-talk-a-11a0b478a077 markdown: >- https://liquidgold.cc/channel/aidotengineer/video/we-let-an-ai-agent-execute-bash-and-lived-to-talk-a-11a0b478a077.md llms: null parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-24T03:42:48.659Z' language: null children: [] videoId: 4lXks428C9o durationSeconds: 1260 publishedAt: '2026-09-14T16:00:00.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 27 endSeconds: 179 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=27' heldReason: rights - ordinal: 1 text: null startSeconds: 191 endSeconds: 334 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=191' heldReason: rights - ordinal: 2 text: null startSeconds: 334 endSeconds: 346 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=334' heldReason: rights - ordinal: 3 text: null startSeconds: 346 endSeconds: 436 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=346' heldReason: rights - ordinal: 4 text: null startSeconds: 436 endSeconds: 447 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=436' heldReason: rights - ordinal: 5 text: null startSeconds: 483 endSeconds: 495 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=483' heldReason: rights - ordinal: 6 text: null startSeconds: 540 endSeconds: 686 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=540' heldReason: rights - ordinal: 7 text: null startSeconds: 686 endSeconds: 699 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=686' heldReason: rights - ordinal: 8 text: null startSeconds: 699 endSeconds: 794 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=699' heldReason: rights - ordinal: 9 text: null startSeconds: 794 endSeconds: 806 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=794' heldReason: rights - ordinal: 10 text: null startSeconds: 806 endSeconds: 895 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=806' heldReason: rights - ordinal: 11 text: null startSeconds: 906 endSeconds: 997 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=906' heldReason: rights - ordinal: 12 text: null startSeconds: 1008 endSeconds: 1154 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=1008' heldReason: rights - ordinal: 13 text: null startSeconds: 1167 endSeconds: 1260 watch: 'https://liquidgold.cc/watch/4lXks428C9o?t=1167' heldReason: rights --- # We let an AI agent execute Bash and lived to talk about it — Sarah Sanders, PostHog Someone opens a pull request on one of your open source repos and drops a line into a markdown file. An automated code review reads it and says looks good. That file is part of the content pipeline feeding an agent that runs commands on thousands of developer machines, so you have now shipped a prompt injection payload signed by you. Sarah Sanders is a context engineer at PostHog, where the Wizard is an agentic CLI that reads a codebase, installs the right SDK, instruments events, and builds dashboards, turning an hour or two of setup into five or six minutes. Roughly 8,000 people run it a week. When the team started talking about making it the default install path, Sanders looked at the anatomy of what they had built and saw what she calls the malware starter pack, because an agent with a shell is almost exactly what you would hand a piece of malware if you were feeling generous. Her audit found the allow list was tighter than feared, with bash denied by default and secrets routed through a vault, but the security team still found gaps, and the shape of them mattered more than the specifics. Almost none were obviously evil. They were two innocent things shaking hands. Attacks compose, she notes, and code review does not. The scanner she built in response runs on YARA rules, is deterministic on purpose, and only reports findings rather than acting on them. It caught sub agents inventing ways around the guardrails to hunt for secrets, which ended sub agents entirely. The language model layer she added on top advises, never enforces, and fails closed. Speaker info: - https://www.linkedin.com/in/sarah-s-42913121a/ Timestamps: 0:00 - What the Wizard does 2:52 - The malware starter pack 5:28 - Layer zero: prompts are not security 7:08 - What the allow list actually blocked 8:00 - Attacks compose, code review does not 8:50 - The context mill and its supply chain 11:24 - Building a detector that does not act 13:08 - Sub agents hunting for secrets 14:50 - Triage: adviser, not bouncer 16:34 - Anatomy of a rule 19:06 - The posture now, in three lines --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/4lXks428C9o-we-let-ai-agent-execute-bash-lived Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- Canonical: https://liquidgold.cc/channel/aidotengineer/explore/video/we-let-an-ai-agent-execute-bash-and-lived-to-talk-a-11a0b478a077 · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.