John Hammond Interviews Ashish Rajan on AI Security Engineering Book and Emerging AI Security Challenges

John Hammond interviews Ashish Rajan about his new book AI Security Engineering published by Wiley, focusing on security for AI rather than AI for security. Rajan, who has 17 years in cybersecurity and runs the Cloud Security Podcast and AI Security Podcast, discusses the challenges of securing AI in production environments, particularly around AI agents and coding assistants like Claude Code and Codex. He identifies four organizational buckets for AI adoption: AI-native companies, AI-hybrid organizations integrating AI into existing systems, AI-as-a-service users, and notes that AI-hybrid represents the largest current pool. Rajan's AI Security Lab is developing an open-source tool called Charlie to help practitioners validate configuration files like settings.json for coding agents and ensure compliance with security policies through MDM enforcement. He emphasizes that traditional network security controls including sandboxing, firewalls, and honeypots are making a comeback for AI security, as frontier models cannot solve prompt injection and operate under shared responsibility models. The research lab is currently investigating how to detect when agents go rogue, examining over 50 controls across ecosystems, with findings planned for release at the AI Engineer Conference in New York. Rajan stresses that the industry lacks clear definitions of what constitutes an AI security incident, particularly around intent-based vulnerabilities versus traditional technical vulnerabilities.