Jonathan Davis

Topic: The game got faster: an update to my afterword in Threat Driven Software Development Threat Driven Software Development: amazon.com/dp/0135567386 1/ I wrote the afterword for this book by Michael Howard (@michael_howard), Lee Holmes (@Lee_Holmes), Sherrod DeGrippo (@sherrod_im) and Shawn Hernan. That was last December, before agentic development hit its stride and the frontier security model boom. It argued that security is an iterated game, not a one time negotiation. These are my own views. 2/ In Robert Axelrod's tournaments, tit for tat won by cooperating first and then answering each move in kind. I used it as an analogy for proportionate governance: make the secure path the fastest and time box every exception before it turns into culture. Most security failures I see are leadership and management failures in disguise. 3/ The game is the same, but it moves much faster now. Each round is a tool call. Every agent in my personal bot swarm has its own skills, access and dependencies. Trust has to be earned every round. 4/ Controls on each agent don't add up to fleet security. Pass work down a chain and each agent checks its own front door while nobody watches the hallway between. 5/ Log agents the way you'd log people: an identity, scoped credentials and logs it can't modify, tied to the delegation chain. Check authority outside the model, and approve high impact actions before they run. 6/ A violation is a reason to look closer. My recent post on detecting hijacked agents goes deeper: nitter.cf/assumebreach/status/21… Respond in proportion, and forgive fast once remediation is verified. 7/ Every dependency is a player too. A tool server shapes what your agent sees and does. An attestation tells you where it was built and nothing about whether it's safe. 8/ Assume breach is something you practice every round. Build a gameboard where the secure path is fastest.

Authority is not a string in the system prompt.Most coding agents still run ambient authority: name a file or a command and the tool will do it. Repo READMEs, comments, and tool output become injection surfaces that redirect real actions. New harness research is clear — cut a task ceiling from trusted input first, store typed capabilities outside the model, check every tool call against the agent that issued it. Injection can still ask. It shouldn’t be allowed to act.

Microsoft Digital Defense 2026 report out today. Vulns weaponized in under 24 hrs. Exposed cloud workloads hit in ~5. Offense is at machine speed now. Defense has to be too. Worth your time. microsoft.com/en-us/corporat…