Shadow AI & Sandbox Escapes: Why You Need an Agentic Control Plane? | Michael Leland | Island

Shadow AI & Sandbox Escapes: Why You Need an Agentic Control Plane? | Michael Leland | Island

by Michael Leland

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Michael Leland 👥 40K 📅 August 18, 2026 ⏱ 32 min 👁 584 📄 expert opinion 🧭 2026-08-19
Available in: English (current) Français

Keywords

agentic control planeshadow AIMCPtoken brokeringnon-human identities

Summary

In this episode of the Cloud Security Podcast, Ashish Rajan interviews Michael Leland, VP and Field CTO at Island, about the emerging concept of an ‘Agentic Control Plane’ for securing AI agents in the enterprise. Leland argues that traditional security tools like EDR, DLP, and CASB are siloed and fail to provide comprehensive visibility and enforcement across the various modalities of AI, including browser-based, desktop, and agent-to-agent interactions. He highlights the prevalence of shadow AI, citing an example where a customer discovered 243 AI tools in use despite believing they had only eight. The discussion covers the risks of malicious AI skills and plugins, the ’two-hop problem’ of agent-to-agent communication, and the importance of protecting non-human identities (NHIs). Leland introduces concepts like ‘model fit steering’ to optimize token usage and ’token brokering’ at the MCP gateway to enforce least-privilege access. He also addresses the challenge of hallucinations, suggesting that corporate RAGs can improve trust in AI outputs. The episode concludes with a lighthearted ‘You Laugh, You Lose’ cybersecurity joke challenge.

170 words

Critical Evaluation

Value of the Information & Strength of the Argument

The episode provides valuable insights into the practical challenges of securing AI agents, drawing on real-world examples and the speaker’s extensive industry experience. Leland’s argument for a consolidated ‘agentic control plane’ is compelling, as he effectively illustrates the limitations of traditional security tools in addressing the unique risks posed by autonomous AI. The discussion of shadow AI, with the concrete example of discovering 243 tools, underscores the urgency of the problem. The concepts of ‘model fit steering’ and ’token brokering’ offer actionable strategies for organizations. However, the argumentation is largely anecdotal and vendor-centric, with a strong promotional undertone for Island’s solutions. The lack of independent data or case studies weakens the overall persuasiveness, but the logical structure and clear articulation of the problem make it a valuable resource for security professionals.

Scientific Rigor, Source Quality, Title Accuracy

The episode is an expert opinion piece, and the speaker’s credibility is established through his background at companies like Cabletron, SentinelOne, and as co-founder of Nitro Security. However, the discussion lacks rigorous scientific sourcing; no external studies or peer-reviewed articles are cited. The title accurately reflects the content, focusing on shadow AI, sandbox escapes, and the need for an agentic control plane. The description provides links to the podcast’s website, bootcamp, newsletter, and LinkedIn, but these are promotional rather than sources for the claims made. The content is consistent with current industry discussions on AI security, but the lack of verifiable sources and the promotional nature of the discussion limit its scientific rigor.

259 words

Title / Content Match

The title accurately reflects the core themes of the episode: shadow AI, sandbox escapes, and the need for an agentic control plane.

Quality & Reliability

7/10

The discussion is grounded in the speaker's extensive industry experience and real-world customer engagements, but it is primarily opinion-based and promotional, lacking peer-reviewed evidence or independent verification.

Chapters

Cited Sources

Concurring Sources

  • OWASP Top 10 for LLM Applications — This resource aligns with the episode's emphasis on AI security risks and provides a structured list of vulnerabilities, supporting the need for a control plane.
  • Model Context Protocol (MCP) — The official MCP documentation corroborates the technical details discussed in the episode regarding agent-to-application connections.

Dissenting Sources

  • No direct discordant sources found — The episode is an opinion piece, and no conflicting sources were identified within the provided content.

Contribution & Novelties

The episode contributes to the discourse on AI security by introducing the concept of an ‘Agentic Control Plane’ as a comprehensive solution to the fragmented security landscape. It highlights the often-overlooked risks of shadow AI and the ’two-hop problem’ in agent-to-agent communication, offering practical strategies like token brokering and model fit steering. The discussion on protecting non-human identities (NHIs) adds a new dimension to identity security.

Pour aller plus loin :

  • Model Context Protocol (MCP) — Official documentation for MCP, the protocol central to the episode’s discussion of agent-to-application connections.
  • Non-human identities (NHI) security — CyberArk’s resource on NHI, relevant to the episode’s discussion on protecting agent credentials.
  • OWASP Top 10 for LLM Applications — A framework for understanding security risks in LLM-based applications, complementing the episode’s focus on AI security.
  • Shadow IT — Wikipedia article on shadow IT, providing background on the broader concept of unsanctioned technology use.

149 words

Radar Profile

The radar profile shows high scores in information quantity and technical level, indicating a content-rich discussion with substantial depth. The lower scores in information quality and global reliability reflect the opinion-based nature and lack of verifiable sources, making it a valuable but not fully authoritative resource.

Reliability 6/10

💬 No comments were provided for analysis.