AI Agents on Your Website: The Security Risk You Already Approved
PHP2Shell and Node2Shell have security teams on edge. But the AI agents you approved on your own website may be the bigger risk. Or Sahar, Security Researcher at Reflectiz, and Rachel Curran, Co-Founder and CEO of Locktivity, break down what the AI agent headlines actually mean for your website, separating the agents you didn't invite (outside attackers using AI to find and exploit vulnerabilities) from the agents you did invite: chat widgets, third-party AI tools, and automated processes running with real permissions.
What's covered:
- Why PHP2Shell and Node2Shell are a speed problem more than a new kind of problem
- How to apply least privilege when the "user" is an AI agent
- What the Hugging Face incident shows about agents pushing for access they were never given
- A four-question threat modeling approach for AI chat widgets and any third-party tool
- A real finding: a blind SSRF triggered through a website AI chat
- Why input validation, access control, and authentication still matter most for AI agents
Speakers: Or Sahar, Security Researcher, Reflectiz; Rachel Curran, Co-Founder & CEO, Locktivity
Key terms: AI agent security, AI chat widget security, third-party risk, least privilege, threat modeling, PHP2Shell, Node2Shell, SSRF, client-side security, web exposure management
Watch the full webinar at reflectiz.com/learning-hub/ai-agents-on-websites-webinar or book a demo at reflectiz.com/book-a-meeting.
