Securing AI Agents with Database Access Using Token Exchange, DPoP and Row-Level Security
The growing adoption of chat-style interfaces means users now interact with software by typing natural-language requests that AI agents translate into tool calls. When an agent is given direct access to a database, any successful prompt injection can turn it into a confused deputy that executes actions on behalf of the user while obeying attacker instructions.
Security experts have long known how to handle untrusted actors inside a perimeter. The principle of least privilege, capability-based attenuation, and just-in-time access were formalized decades ago. The same mechanisms now apply to probabilistic language models: instead of issuing a full user token to the agent, the system performs an OAuth 2.0 Token Exchange that narrows audience and scope to a single tool and a single resource.
Additional protection comes from DPoP, which cryptographically binds the token to the agent’s private key, rendering any stolen token useless without that key. For high-risk operations such as refunds, OpenID CIBA brings the human back into the loop by sending an approval request directly to the user’s existing chat session, after which a short-lived, narrowly scoped token is issued.
At the storage layer, PostgreSQL Row-Level Security policies check the authenticated user identifier on every query, ensuring that even a fully compromised agent cannot read rows belonging to other users. The demo stack published by issuerd shows the complete pipeline running in Docker and includes automated verification of login, order retrieval, prompt-injection attempts, and token-replay attacks.
The approach demonstrates that established identity and access-management standards already provide the controls needed for safe AI-agent deployments, without requiring new cryptographic primitives or user-experience changes.
Related articles
Eliezer Yudkowsky Explains Why Clever Human-Designed Schemes Fail at ASI Alignment
Eliezer Yudkowsky published the essay Cat-Belling Problems following debates at the ILIAD-2026 conference on mathematical AI safety. The piece uses the historical example of Michael Lorrey's proposed reactionless L-drive to illustrate why complex compensatory systems cannot violate conservation of momentum. Yudkowsky argues that any spreadsheet or design claiming net thrust from standard physics components must contain an accounting error because every individual interaction preserves momentum. He extends the analogy to proposals for solving superalignment of ASI, noting that hidden patented compensators or uninspectable calculations do not change the underlying mathematical impossibility. The essay contrasts superficial generalizations like the Law of White Swans with deep laws derived from Noether's theorem and quantum mechanics. Richard Feynman's encounters with perpetual motion machines of the third kind are cited to show how claims of new physics require experimental demonstration rather than unverified tables.
Troubleshooting AI Bug Hunting: Seven Critical Mistakes That Destroy Report Validity
Two Russian researchers shared detailed lessons from six months of running AI agents on domestic bug bounty platforms. The presentation, originally delivered at OFFZONE, covers hallucinations, lack of validation, threat model misunderstandings, severity inflation, bloated reports, high token costs, and scope violations. Vladislav Bek and Daniil Shushakov describe practical fixes including tool-enabled agents, dual-agent verification, strict templates, and cascaded model architectures. They emphasize that AI must execute real commands in isolated environments rather than fabricate results. The speakers also address scaling on private events, handling model refusals, and the continued necessity of human final validation. Their checklist stresses business context, proven impact, and staying within program boundaries to produce accepted, high-value reports.
SOC Forum 2026 Reveals Full Program Featuring Chen Qiufan on AI Agents and Business Defense
Organizers of SOC Forum 2026 have published the complete agenda for the event scheduled for October 27-28 at Moscow's Lomonosov cluster. The central theme explores how generative AI is used by both attackers and defenders, including the risks when autonomous agents gain access to corporate systems. Over 170 speakers from more than 90 organizations will participate in more than 60 sessions and 82 technical reports selected from over 400 submissions. The first day focuses on business impact, regulation, economic effects of AI, liability for errors, and employee data sent to external models, with Chinese author Chen Qiufan delivering a keynote and joining a plenary discussion. The second day shifts to technical topics such as AI-powered attacks, code security, cloud environments, and autonomous agent protections including access rights, prompt attacks, and incident investigation. The AI & Cybersecurity track received 126 CFP submissions, 2.5 times more than the previous year. The forum is organized by GK Solar as part of Russian Cybersecurity Week.
Skycode: Custom VS Code Extension Optimizes AI Coding Agent for Corporate Closed-Loop LLMs
A developer has released Skycode, an open-source VS Code extension that enables AI-assisted coding inside corporate closed environments using internal models such as Qwen. The project addresses strict data residency requirements in sectors like energy, where external services like GitHub Copilot or Cursor are prohibited because code would leave the perimeter. Key engineering efforts focused on aggressive context preservation within the model's roughly 100k token limit through incremental file reading, symbol-level extraction, history compression, and visual context monitoring. Additional features include tab-based parallel task handling, local voice dictation powered by Sber's GigaAM v3, and safeguards against repetitive loops or truncated file writes. The extension approach was chosen over forking the entire VS Code codebase to simplify deployment and compliance reviews, as extensions can often be installed from the Marketplace without separate approval. Skycode is positioned as a practical alternative for organizations running their own LLMs rather than relying on cloud models.