Block CISO: We red-teamed our own AI agent to run an infostealer on an employee laptop

interview When it comes to security, AI agents are like self-driving cars, according to Block Chief Information Security Officer James Nettesheim.

"It's not enough for self-driving cars to be just as good as humans," Nettesheim said in an exclusive interview with The Register. "They have to be safer and better than humans - and provably so. We need that with our agentic use, too."

The parent company of Square, Cash App, and Afterpay is pushing hard to position itself as an AI leader, co-designing the Model Context Protocol (MCP) with Anthropic and using MCP to build Goose, its open source AI agent that's used by almost all Block's 12,000 employees and connects to all of the company's systems including Google accounts and Square payments.

A year ago, the company open sourced Goose.

As CISO, it's Nettesheim's job to ensure that Goose and all of ...