Allie Howe Hey everyone. Welcome to another episode of the Insecure Agents podcast. I'm your host, Allie Howe, and today I'm super excited to be filming here at the a16z studio with Joel de la Garza. He's an partner here at a16z on the infra team here. Joel has an amazing security background. He was the CISO at Box. He's also founded and worked at various security startups and has a wealth of knowledge, and I'm super excited to talk to Joel here today about what this article from our regular is calling the end state fallacy of is AI going to, sort of like equal out an equilibrium between attackers and defenders?

Who has the advantage today? Who will have the advantage tomorrow? And what does this look like over time? Before we get into that, Joel, would you like to introduce yourself?

Joel de la Garza I mean, you did a great job, so I'm I'm one of those people that doesn't like talking about myself, so happy to just roll with what you got there Perfect. But yeah, I mean, I, I spend a lot of time focusing on AI both professionally and personally. I love this stuff. It's incredible, and so super excited to have a chat about it.

Allie Howe Yes. Yeah. Absolutely. Yeah, I'm super excited to, like, get your experience and your, your wisdom here too because a lot of people are thinking, "Okay, you know, AI has caused all of these new problems with security." But a lot of them are old problems just c- becoming, like, reinvented or becoming, like, worse because of AI. I think a great example of that is like GitHub Actions for example. Like a lot of people don't realize that, you know, you know, having static secrets in GitHub is not necessarily The best-- Well, it's, it's obviously, like, not what you would want to do, but people think that's their only option.

That's not the case. It's actually possible today to add runtime authorization into GitHub Action, to, you know, use OIDC CD or use-... New technologies that startups that I know are working on to be able to inject very highly task-scoped FMR credentials into something like GitHub Actions to make those a lot more secure. So, and, and obviously that becomes more important now because of AI where, you know, agents are now inside of these GitHub Actions. And, supply chain security has been, you know, compromised, and there's a new supply chain attack, like, every other day. So like static secrets everywhere just because of just the nature of how these AI attacks are becoming so prolific.

That's just becoming sort of like an unacceptable thing now. It was, you know, not great before, but now it's really a paradigm that's really not going to work for us going forward. So how are you seeing concepts like that where it's like, okay, there was a best practice that we were told, like, years ago that we should go do, but like now it's becoming a non-negotiable?

Joel de la Garza Yeah, I mean, I think the I think the quote that best sums it up comes from Mike Tyson, which is that everybody has a plan until they're punched in the face. And so, like, I think it really goes back to sort of, like, if you're gonna dial it back to kind of thinking about what, what is the job of a CISO, and I think the answer you get from someone who's done the job is very different from someone who's worked alongside, hired, or not worked in the security space, right? And I think if you ask a person at a regular company, "What does your chief security officer do?"

They'll probably say something like, "Well, they'll keep us safe. They fix problems. They correct vulnerabilities," right? You ask, you ask a CISO what they do, largely it's just allowing, finding ways to allow the business to continue to operate, right? And they're... The- historically, the job of a CISO has been to walk the line between risk and, and reward, right? And if you do too much security, you kill the business, right? Like, if you wanna be completely safe, you sever all access to the internet, you take out the windows, you build a bunker, you go underground, you don't interact with anyone that you don't know, and you don't make any money, right?

So, like, I think it's always been the case where the job of the CISO is to walk the fine line between taking risks and not letting the business go off a cliff. And so, as a result of that, most... I mean, a good chunk of time that CISOs spend historically has been on things like risk acceptance, things like, "Yeah, this isn't best practice. This is a vulnerability, but we have additional compensating controls. And you know what? We can probably live with this risk because to fix it would disrupt the business in some meaningful way." And over the last decade or decades, that, that tech debt or security debt has really just accrued.

And now what we get with AI is we basically get these hyper-focused You know, hyper-focus, like incredibly technical things that we've used rewards to train to break stuff that now will try infinitely many permutations of ways to break stuff until they find something and get the reward. And so what you're seeing essentially is the confluence of these two factors, and basically it's gonna lead to a rethinking of like what does it mean to do security? What is, what does this position mean? I think. That's ultimately... And you could describe it in terms of market equilibrium, and there's all sorts of elegant ways that you could try to outlay some kind of grand unifying theory for how this stuff works, but ultimately you're gonna get punched in the face.

You just have to scramble to keep up, and that's generally how the job is, right? Like, you know, ivory towers are nice for coming up with grand theories, but if you're actually a CISO protecting a business, you've got shit to do.

Allie Howe Yes, well said. And it, it seems like before only a handful of companies had to really truly worry about zero day- like with the Fortune 500s, but now it's everyone. Models are now chaining vulnerabilities together, like even like the low vulnerabilities. So y- you said to your point, you know, you used to be able to live with this tech debt or like not focus on this, but now because models are able to chain these vulnerabilities together to get an exploit to be able to allow an agent to escape a sandbox now what you focus on becomes, you know, a, there's... it's a lot broader. And then when you get punched in the face inevitably, which I, I agree with, I feel like that's just kind of the reality these days, like what does that punch look like?

And like I just feel like the stakes are so much higher if a, you know, an agent is gonna s- escape a sandbox or whatever that punch enables, like how do we contain that? How do we make sure that a business is actually be able-- going to recover from that?

Joel de la Garza Yeah. I, I think there's a couple things there. I think the one thing that's happening, and I guess to, to, to just be sort of very, very cr- simplistic about it, the cost to hack was always fair- fairly high. And obviously over time It's probably had what I would say is more of a linear, a linear slide in terms of cost, and so it used to be multi-million dollars to get, like, an iOS exploit or some sort of exploit for a popular system, right? They-- We had a period of time where there were companies that sold exploits, VuPen and o- others were, were, were kind of brokering the sale of these things, typically to nation states.

There's also a black market for these hackers, all that sort of stuff. You know, that price had sorta come down over time. Now there's some dynamics in that market. It could be because attackers were going after cloud services. It could be because endpoints became less valuable. Who knows? But what essentially this wave of, of, of a- agents and AI have done is essentially drive the cost to zero, right? And so now it's no longer... In the old days, the calculus was always, like, someone has to spend a million dollars to get into this company, very few people are gonna do it. So obviously, if you're Raytheon, someone's gonna spend a million dollars to get in that company, right?

If you're a cat meme internet hosting site, probably not. And so that was always sort of the, the math and the calculations that you were making. I think now we're at a point where sort of like, you know, it's free. Anyone can do it. And, and, and by the way, like, it's not just the mythos and the, and the f- the frontier level models. Like, you know, Opus 4.5, Opus 4.6 were incredibly good at getting into stuff. Like, we had issues internally, and that was, that was sort of the, the punch in the face moment was, you know, we were, we were testing, and, and, and Ben Horowitz actually gave a, a talk at, a keynote at, at RSA this year that was based on our experience with these agents where we were, like, using them to build stuff.

We had coding agents running. We thought it was running, you know, we wouldn't claim that it's an air-gapped environment like some other people, but it was running in a secured container in a secured GCP cluster. We thought relatively secure enough. But no, these things figured out how to open tunnels out to Cloudflare to get around our, our, our egress and ingress controls. It downloaded, you know, I think it was like Port Slammer or something to, like, tunnel stuff out, and it was just doing this on its own accord, right? And so it's just sort of like, wow, this is, this is a really amazing capability.

And this, by the way, largely is not... I mean, there's a security element to it, but, like, this is largely an alignment problem, and it's, I think it's largely a reflection of the, the various pre-training and post-training operations that the frontier labs have done. And so, like, the agents don't have-- I mean, the a- they're just, it's software. There's no morality. It doesn't think things are wrong. It has a set of tools, and it uses the tools. Well, I mean, you gave it a gun, and it's gonna rob the liquor store, right? Like, that's just what happens. But I mean, I think largely these things will get fixed, but whatever.

Allie Howe Yes, and that was kind of the theme of the article by this company Irregular that I guess works with, you know, frontier model labs to help them with their cyber evaluations and hardening and all of that. What they were saying is that like yeah, like in the, in the near term it seems like attackers have like the advantage. And you know, models are capable of, you know, finding how to exploit a vulnerability if given it. And there's sort of this like spectrum the article laid out of like, okay, you have, you know, the red team obviously like the attacking side, then you have like the blue team, the defending side then you also have like the purple in, in the middle where it's like a capability from a model that would sit in the purple.

A good example of that is like it finds a vulnerability. Like great, like now a defender can go patch it or an attacker can go exploit it. Should, like what's, what's the answer to get us closer to enabling defenders? 'Cause like at the end, end of the day from the article the end of the day point was like, hey, in the future hopefully the equilibrium between who is more advantaged, defenders or attackers, evens out, but in the short term, attackers have the advantage today. Do you agree with that?

Joel de la Garza I, I'd argue that the disequilibrium they're citing is largely one that's artificial. And, and, and we made this, I made this point a couple times, Dylan from Truffle has also made this point, which is gatekeeping security always fails. It's always a catastrophic thing to do and right now we're in a situation where the people who are making these models are gatekeeping these in such a way that the defenders don't get access to it, right? Like, and, and, and, and it's not just sort of like sure, they're giving it to the defense contractors and the banks and all those folks get it. But like, I mean, how many people...

Like, your supply chain is like N plus plus, right? Like, there's just an infinite number of people in that supply chain, and protecting the bank isn't just about protecting the bank. It's about protecting the people who write the open source code that goes into the bank. It's about protecting the transit links and the various suppliers that power the networks that get to the bank. Like, there's just so many interdependencies that when you allow these things to be gatekept, and you keep the defenders who are lower in the stack, who are not, you know, tier one bank from getting access to these tools, you're basically putting a vast majority of the ecosystem at risk, and you're creating a lot of like in- incredibly catastrophic potential scenarios for, for disaster.

And so like I don't think the equilibrium is that, oh, these things are so good at red teaming, they're just not good at blue teaming. I think the issue is more like the red teaming is a product that can be sold. We've made this product to sell it to people, and now we're gonna gatekeep. It's like the cigarette companies, right? Like, "Hey, look, we can create cancer. Let's not talk about the cancer. Let's just sell the cigarettes while people need them, and then eventually we'll figure out the cancer," right? Like, that is essentially the equivalent to what's happening with gatekeeping. So I don't, I don't think the disequilibrium is some gap in technology.

I think it is a byproduct and an intentional byproduct of gatekeeping these capabilities.

Allie Howe Absolutely. Yeah, it's, it's hard too 'cause I feel like, you know, an attacker has to be right just, just once, but a defender has to be right all of the time. So I feel like the defenders...

Joel de la Garza Yeah, I agree that that's true.

Allie Howe I feel like also like the defenders just have so much more work cut out for them. And Maybe like there needs to be one thing that could potentially help is more defensive tooling, security tooling getting made, like, you know, making verification easier, making like vulnerability patching easier like, and all, all of that. Is that something that you see like worthwhile to like invest in or helping people like, you know- Yeah... spin that up?

Joel de la Garza I mean, we largely have invested in blue team, in, in defensive tools, and there's a number of reasons for that, right? The market, the market for defense has always been substantially larger, right? Firewalls, host security, EDR, all these are the big categories for security, identity. These are all defensive technologies. Pen testing, red teaming Application security have they have never gotten to that scale. Now, there may be reasons why that's the case. It could potentially be that it's just always been constrained by talent, and maybe this unlocks talent, and maybe those markets get incredibly big. But right now in the enterprise, right, and, and typically we are investing in technologies for enterprise buyers enterprise buyers overwhelmingly spend the dollars on blue team, and that's where the, the m- vast majority of the budget is.

And so technically, you wanna be investing in, in that sort of stuff as much as possible 'cause that's where the opportunities lie.

Allie Howe Yes, that makes sense for sure. What does that defensive stack look like today for if you're like a bank or a large company? Like, what sort of defensive tooling would you be looking to buy, or what do you think is, like, critical for their stack at the moment?

Joel de la Garza Yeah, I think that there's... This is the beauty of enterprise software is that it's got an incredibly long tail. So, like-... you know, the, the, the stuff they run now, it, it, it, it's all, it's all gonna compound. The stuff they run now they will continue to have to run and probably until the end of time or until we get some sort of super intelligence. Or so like that stuff is gonna be there. People will still be using CrowdStrike, people will still be using Palo Alto firewalls. Like, a lot of this stuff is gonna be there regardless, right? But what typ- typically happens is that a new thing emerges, right?

And so if you remember in the old days, the first wave was like the servers, the mainframes. Mainframe servers, kind of this, this client server architecture. And that gave birth to like a whole bunch of products, right? So you got the first firewalls, you got intrusion detection systems, you got antivirus to some extent. Then you had the client sort of getting more capable. You had the rise of the desktop computer, and you had the internet. Then you got antivirus, then you got the McAfees, the Semantics, all those sorts of companies. And then you had cloud, and that sort of drove things like CrowdStrike and Palo Alto, right?

Because tunneling protocols through non-standard ports became an issue, app identity, all that sort of stuff. And, and basically, those old school pix firewalls in the enterprise that lived in your data centers, they're still there. Like, it's still like a line in, in Cisco's earnings, right? Like, it's still a very important product, and it's still driving a tremendous amount of revenue. So what's gonna happen is this new layer of stuff will emerge. This new layer will have unique requirements that make it very difficult for the incumbents to kind of move up the stack and p- and play in that. There's also a bit of the innovator's dilemma, which is where incumbents will be hesitant to cannibalize their legacy businesses.

And so you'll get a new opportunity for new companies to emerge to play in this new stack. Now, what does that look like? I mean, we're still day one of what this is gonna emerge and eventually be, and the way this thing works is that there's typically a bunch of waves, and in every wave there's a few survivors. And then a new wave comes in, there's a few survivors, and at the end you get kind of the large companies that typically have staying power.

Allie Howe Yes, that makes sense. And it's interesting to see some of the, like, new companies that are out there their learnings in far as like what makes models, like, stay on track or stay- How do you, like, make them, like, not escape a sandbox essentially. At Black Hat, I had Ahmad from Socket Security on my- Oh, yeah... on my podcast, which I think, like, you obviously know.

Joel de la Garza Yeah, Socket's awesome.

Allie Howe Amazing. Yeah, yeah.

Joel de la Garza Love those guys. Yes. Yeah. No, they're fantastic.

Allie Howe What that... I thought was really clever that Ahmad was telling me about their firewall- Socket Firewall, is that they modify the API such that that API doesn't even return vulnerable packages, so, like, the agent doesn't even know about them. So the agent becomes, like, very goal motivated, and it's like, you know, "This package is, is blocked," or is supposed to be like, you know, "I'm not supposed to use it, but I ultimately now believe that it might help me, like, achieve my goal, so I'm gonna find a different way- Okay to route around this and potentially go find it elsewhere.". But you can control the agent and help them, like, not do that when they become misaligned-...

When they're trying to pursue their goal if you... They don't even have the information. So it's basically what the agent doesn't know won't hurt it kind of a thing. Yeah. It's... I feel like these are the type of patterns that people are finding out that's gonna help us really launch agents at scale. And ultimately enable things like software factories, which I know, like, a lot of people are starting to spin up at the moment. Like, the technology for sure exists. You know, context windows have gotten larger, model vision has improved, so we now verify work that's been done. But the security model seems like it's largely missing.

And so when folks like Socket and others find out these patterns that worked, and I also talked to Travis McPeak from Cursor, who was saying, like, they've got two different agents. When a coding agent runs, there's another that monitors that agent, and when it drifts and starts thrashing 'cause it can't accomplish its goal, the other agent will gently course correct it, and that works because the monitoring agent doesn't share the same goal as the first. So, like, what are these patterns that are starting to come together to be able to enable, like, production agents at scale?

Joel de la Garza Yeah. Datadog does something similar. Emilio was talking about that on one of our podcasts, where they have a, a judge essentially that sits o- on top of stuff and makes sure that things don't go sideways. I think There's... I, I think we, like, coding may be done, but computer science isn't. And so, like, I think... And I think it's still, it's actually more important than ever. And so I, I think that there's probably... And these are always really hard things to figure out because there's, there's sort of the academic right way, and there's sort of like, you know, it's, it's the kind of like classic like whitelisting versus blacklisting, and, like, whitelisting never has won 'cause it's always been a pain, and we've always just done signature-based stuff because it's easy and it scales.

And so I think, I think we're going through that with, with the agent discussion right now, and I, I think it starts like at layer, like at layer one, right? Like what is an agent and what does it run on? Now, is it-... is it this, like... Is it this ephemeral thing that spins up, does a task, and goes away, or is it this persistent long-lived thing, or is it this thing in the middle? And- And I think ultimately what you're gonna see happen is it's gonna be some version of, of the two ends of that spectrum. So I, I think, I think you can see a world, especially now Grokbot, I'm Grokbot-pilled.

It's incredible. Just been having a lot of fun with it. The Cursor guys built a phenomenal product. And I'm, I'm, I'm, I'm not a salesperson. I just, I am genuinely enjoying it. I think you see the rise of these long-running persistent agents for users, and that, and that just... And that's gonna be a very different system architecture than the sprites that, that spin up, "Here's a bit of text, figure this out. Here's a task to execute on, figure this out." Or like even the coding agents, right? Like, they exist for a period of time, and they go away. And I, I think maybe what you're seeing is sort of the delineation between the sort of like consumer user facing and the enterprise, and maybe that's kind of the pattern that emerges.

But like then the question becomes, what is the base layer that runs this? Do these things run in a container? Do they run in a v- in a full-on VM? People are running them on Mac Minis, right? Like, like there's just a lot of infrastructure questions that have to get solved, and security is always a laggard. And until we understand kind of what the core infrastructure looks like, you're gonna thrash at trying to figure out security problems. And so I think like what the Socket guys have done is incredibly smart, right? Because, like, the business is running today. Like, people need to use this today.

And so you have these very interesting sort of transitional kind of technologies. And what I think is interesting for Socket is you can start to see this world in which they build out a future for the way that code management, you know, the way that code security is managed, and that looks very different than kind of what the, what the present does. But you will start to see these transitional technologies approve and or, or appear and, and maybe some of the, the agent sandboxing and the agent VM tools are kind of starting to paint the picture, and you kind of can get kind of glimpses of what that looks like.

Allie Howe Yes, this resonates with something I heard Ian Livingstone, CEO of Keycard, say on a panel at Black Hat where he was calling this shift sort of like the pets versus cattle phase- Yeah... of agents, where, yeah, you have your, maybe your OpenClaw that's running on your Mac Mini and it's serving just you. But, we're shifting towards, like, running agents in actual production, where agents can be spun up like cattle, can be taken down like cattle. It can serve entire enterprises, multiple stakeholders, not just yourself. So there's a lot of, like, different technologies that have to come together, infrastructure, like you said, to be able to enable that.

I'm personally, like, really excited about, like, the identity piece too- Oh, yeah... for agents because like, when I'm building agents, like, myself, and I'm they're serving not just me but my team, I have to think about, like, whose identity is this agent, like, in Slack going to take? Is it gonna take mine all the time? Like, no, that's not feasible. It needs to take the identity and the permissions of anyone that's talking to it, making sure that it's authorized to only say what that user is able to get based on their permissions. And then also if that agent, like, runs in the background like you said, long-running agents whose identity does it use then?

It probably just needs to have its own identity and a different source of or set of permissions and policy in place. Like, I feel like we're starting to figure out what those paradigms look like.

Joel de la Garza Yeah. I mean, it's funny, right? Because I'm I actually find myself working against security-... at least in my personal life as I use these agents and stuff. Like, like, there's so much security, like... I s- I don't wanna say lore, but, like, there's just a lot of security heterodoxy about sort of like this is the framework and this is the things that we do. But, like, agents are profoundly different than anything we've ever worked with. And, like, I get it that it's scary, but, like, the, the lesson in my own life that I've come to realize about these things is that, like, the more access you give them, the better they perform.

And they, like... I mean, if you give an agent this, like, very restricted thing and this very, like, modular task to do, and you constrain them in such a way and you don't give them the tools, like, it's crap. Like, it just doesn't work well. But when you give them, like, a full operating system and access to all the data, like, they do amazing things, right? And so, and so, like, there's just a lot of security that you have to work around to make that happen, right? And I, and I, you know, I'm part of the problem, I get that. And so it's been really weird to be on the other side of this being like, "Hey, I want my agent to do X."

Oh, but this product does, does, like, bot defense, and this website, even though I'm logging into the website and it is my credential and it is not a bot account, like, this website doesn't want my bot to use it. Which is ridiculous 'cause, like, I'm driving business to these people. I'm spending money. Why are you stop- Like, shut up and take my money, right?

Allie Howe Yeah.

Joel de la Garza And so, like, it's just weird that, like, we're in this weird transitional period where it's like there's a lot of security... I- identity for example, like working around... There, there are no great... For a lot of the consumer stuff, other than maybe password managers, there's just not a lot of great answers, right? Other than like here's a web browser login, which sucks. I mean, it's, it's sort of like, you know, alarm bells ringing, security professional, you don't do this, this is wrong. But you know what? Like, I kinda want my agent to, like, bid on this whiskey at this, like, at this auction website. And so, like, you like, whatever, let's do it, right?

It's containerized. Who cares? And so, like, I just think that there's just a lot of this sort of like Like, people are gonna find the true... Like, this is the, the sort of, the sort of grounding truth for security, and I guess the grounding both consumer and on the enterprise side is that, like, you're not paying people to be secure, you're paying people to do their job. And at the moment where security gets in the way of people doing what they wanna do, security will always lose. And that's just kinda like the, the, the, the 800-pound gorilla in the room that we have to reckon with, in that there's gonna be a lot of very uncomfortable security things we're gonna have to tolerate.

Going back to sort of like what is the role of a CISO, there is gonna be a lot of very uncomfortable security things we have to tolerate in order to unlock the value that these things can bring. It's just, it's just how it is. And I think largely the people that are out there, and you know, it is a sizable number of people change is hard, people fight change, and I think largely, you know, your inability to manage change through this period is fundamentally gonna limit your shelf life Just generally how I think about it.

Allie Howe Absolutely. Yes, I agree. And at at Keycard we call this the trilemma-... where you c- like, a lot of people think there's this, like only three... There's three things, you only can pick two of them. It's autonomy, capability, and security.

Joel de la Garza Yeah.

Allie Howe And that's an impossible choice, like you said. Like, if I'm gonna, you know, not give my agent access, then it's actually not gonna perform well, and that's, like, not an option for me 'cause I'm actually trying to drive vis- revenue, and, like, ship things and do real work. So yes, we need, like, security infrastructure that's provides- Yeah... all three. And I also what really resonated with what you were saying is how it sounds like for security infrastructure and security to win it needs to be a win for developers and engineering as much as it actually is security, so it actually drives adoption. I think one good example of that that I've seen is, like, ID JAG-...

That's- that's come out that's enabled things like what people are calling agent SSO, where you only have to, like, log in one time, and it's got access to all your different MCP servers.

Joel de la Garza Yeah.

Allie Howe But it also enables your, like, your IT administrators to revoke that grant for everything all at once. So, you no longer have these, like, OAuth islands sitting around where you, like, don't know if, like, there's a grant that you have no control of to go revoke if, like, your employee leaves or goes rogue. And, so, like, that's, a security improvement, but it also is a usability improvement for developers that wanna quickly, like, gain access to, like, MCPs and not have to, like, auth every time. And, I think technology is, like, you know, like, different, like, MCP gateways and stuff are, like, starting to come out with those, sort of, paradigms as well.

And, like, I don't know if you've heard of, like, AAuth as well. The, yeah, the new protocol for, like, agent auth.

Joel de la Garza Agent auth, yeah. Yeah, yeah, yeah.

Allie Howe So like-

Joel de la Garza Yeah, it's exciting. It's super cool. Yeah. You know, what, what's really cool about all this stuff is that, like, if you build the agent well, and, like, I'm s- I'm not, I, I, I've just been s- spending way too many late nights with GrokBot-... which is not, not good for your mental health. If you build the agent well, these things solve these problems. And so it's, it's sort of like, in the old days it used to be like you'd tell me about a new tool or a new framework or a new library or a new whatever, language, and it's just like, "Oh, I have to learn something."

Like you know, it's sort of like I have to set aside time in my day to figure this thing out and then, like, get it working. These agents are amazing 'cause you just like, "Hey, use this thing," and it uses it. And it's just like, it's just incredible, right? So, like, I'm, I'm, I'm, I'm very excited that- That a lot of the barriers to making things better are falling. It's just problematic in that there's, like, a lot of, a lot of security... I mean, even some of the security first principles kind of make this difficult to move forward with, right? Like least privilege. Sort of like, well, agents work better when there isn't least privilege.

Right? Like, it, it just, like, all these things, I mean, if you're, if you're, if you're fully, you know, bitter lesson pilled, like, like, least privilege doesn't make sense, right? Like, and there's just a lot of things that you have to fundamentally rethink a lot of the first principles. And so it's just the most exciting time ever in tech.

Allie Howe Yes, definitely. And it's interesting to, like, watch companies kind of figure out the happy medium between the agentic onboarding experience, but also just, like, the developer onboarding experience- Oh, yeah onto a new product. S- I haven't tried GroqBot yet. I've heard lots about it. I really need to.

Joel de la Garza Yeah.

Allie Howe But one framework I've been spending a lot of time with is Vercel's Eve framework- Yeah, yeah... for building agents. Like, that's worked really well for me, and it's been nice to be-

Joel de la Garza I find a lot of this to be very fragile.

Allie Howe Okay.

Joel de la Garza So just for the use cases, like the l- so this goes back to the sort of like is it gonna be persistent or is it gonna be, is it gonna be temporal or temporary? Yeah. My, my problem has largely been that a lot of the persistent long-running agents have been very brittle, and, and things break, and then you have to go redo them. I've just found it just seems like a lot of the brittleness has been solved on the GroqBot side. That would just be my take.

Allie Howe Okay...

Joel de la Garza I ran OpenClaw, I ran Hermes, I ran all these other things, and it was just, like, a lot of work. Yeah. And so, so the, so the, the, the, I guess that's the key is gonna be figuring out kind of a lot of the availability challenges and the, like, the consistency challenges with that infrastructure, which it seems like we're making a lot of progress very quickly, which is awesome.

Allie Howe Yes. Yeah. Yeah, that's exciting.

Joel de la Garza How long did it take for VMs to get stable, right? Probably like five to 10 years. Right? Like, I mean, really, like VMs were a nightmare. And now we've got, like, these agent frameworks that popped up in five to 10 months. It's just incredible.

Allie Howe Yes. And while these, like, frameworks are super, like, easy to use and they might provide some, you know, varying levels of, like, security model for you you definitely have to, like, take a look at what's going on underneath the hood and, like, introduce, like, the gaps or fix the gaps yourself. And what I noticed with, like, for ourselves, like, ease framework is there's an open issue on their GitHub repository-... for adding authorization to in the loop tool call. So it's like if I am using, you know, the agent with that, that framework to go and talk to Linear, for example-... using the framework, I can add in the loop onto that tool call.

So if I'm gonna create a, a Linear issue, I can use that framework to pause and ask me for approval. But if that agent is, like, running in Slack and that approval button is just hanging out, anyone can go and approve it. So it's missing that authorization piece of, like, who's actually allowed to go create an issue.

Joel de la Garza I just feel like those are problems that you'd give the agent to solve. Like, I, I just feel I don't know, maybe I'm, maybe I'm, I'm just losing my mind. But, like, I think that, like, there's just this, like, these things can build their own reality, right? And so I, I think the way that I've found these things to work best is to give them very vague, very... Not vague, but, like, relatively vague, like, tasks with very specific constraints, if that makes sense. And, and, and then allowing them within their own worlds, they have the ability to build a number of these controls and these tools, and I've just found that to work fairly well.

But who knows? TBD.

Allie Howe Yeah. But it's like if the agents are building their own controls, can they also, like, remove those controls, like, at runtime? So, like, shouldn't the controls, like, sit outside of the harness?

Joel de la Garza I mean- Or the- To, it, again, it goes back to sort of the, the what is the agent doing? Is it long-running and persistent, or is it something ephemeral running in a corporate environment, right? And I think they're very different. Like I, I think we're still... I don't think we're at the point, other than like Claude, Cowork, and OpenAI Codex, like I don't, and, and, and Cursor, like those are kind of the first generation of agents in the enterprise. And I, I don't think we're, I haven't seen anyone in an enterprise at scale where they're deploying like open CLAU style. I mean, Facebook, yes. I mean, other than like forward-leaning tech companies that are trying to get in the AI space, like you're just not, you just haven't seen that sort of long-running persistent agents in the workplace yet.

So-. I think that security model is TBD. For me personally, it doesn't matter. Yeah. Right? Like, and that's the difference between consumer and enterprise.

Allie Howe Absolutely. Yeah, and I feel like there's just a lot of problems that enterprise would face with a long-running agent. Like if it's gonna write to, like a shared memory store, for example, where different employers are going to be accessing that, like how do you control that, like just 'cause, you know, you know, the CEO wrote to that, the shared memory store, like who says like the junior or like engineer gets to pull from that?

Joel de la Garza Oh yeah. I mean, that's a problem as old as time. And I think like the agents, you can tell them to be mindful of that stuff. I think to me the interesting thing is gonna be how do we instruct... I mean, I think there's two parts to it. I mean, just, again, first principle is defense in depth. There will be two parts to it. I feel like the, the, the controls existing outside of the agent thing is a, is a relatively solved problem, and right now it's just about gluing things together and kind of reconfiguring the way that those operate. I think the, the, the, the constellation of existence inside the agents and how that's constructed is the truly interesting part.

And I mean, that's, that's just me in- intellectually interested in that. Your agent should have a token that only accesses X just feels like a solved problem.

Allie Howe Yeah, that makes sense. Can you dive deeper into like what's unsolved, like the components of the agent that we're still figuring out, like you mentioned? Like what are those-

Joel de la Garza I mean, at some point for these agents, like it feels like every agent's building a lot of infrastructure-... that feels reusable. And it, and it, and it feels like there's probably gonna be these kinds of layers that start emerging for this reusable infrastructure for those agents as patterns start to emerge and will default onto one sort of pattern. And so it's gonna be sort of like where do you store user context? How do you store embeddings for user context? Where do you store the data that you're outputting? Like there's just, like if these things become long-running, like keeping them in a markdown file is just not gonna be the path forward.

Allie Howe Yeah.

Joel de la Garza Right? And I, I think that's when you start to get into the more interesting, like well there's a new infrastructure layer that emerges, and what does that look like? And it's just we're speed running this. I mean, it's just- Yeah... happening so quickly, right? Like these, these are forces in technology that typically took decades to sort out and this is just taking months, and that's just the most interesting thing ever.

Allie Howe Yes. No, the speed for sure is, like, definitely notable. And to your point about reusable patterns that, like, you know, maybe there should just be infrastructure that provides this. I've had, like, Uber's engineers on the podcast and engineers- Yeah... from BrowserBase, and then just connecting all these threads, it just seems like everyone's building the same things for, like, identity and authentication structures.

Joel de la Garza Oh, yeah, everybody's got a harness. Yeah, yeah, yeah. Yeah. Everybody's got a harness. Yeah. Yeah. People have their own personal projects that are building harnesses, right? Like-... But that, that's more to me, that just seems like a, it's a symptom of the fact that the cost to code has gone to zero, right? And so, like, and this goes back to kind of the earlier statement, which is like, it doesn't... This actually doesn't make computer science less important. It actually makes it more important, right? And like, what you're seeing is the, the, the principle level, like, super engineers with deep backgrounds in systems and computer science and infrastructure are the ones that are coming up with the patterns that lead to the thing that gets built to solve the problem, right?

And it's, it's sort of like, it's, it's just incredibly interesting. I mean, I, I don't know where this plays out, but my, my, my gut tells me that, like, a lot of this stuff, the vibe coded stuff probably won't persist. But there will be these patterns that are, that are p- that will kind of persist in that for, in that, in that state.

Allie Howe Yes, absolutely.

Joel de la Garza I mean, I mean, we have to not confuse the fact that code, the cost to code is zero with sort of the architectural shifts and decisions that are being made. And also, like, the harnesses, like these are relatively simple, simple programs. Like, I think, I mean, from what I've heard from folks is that, like, you know, for f- if you're writing something like a new library or a new framework for an em- a, a new form of technology that, you know, that isn't in the distribution, that hasn't been coded before, like there is still a lot of manual code that's getting written where you're kind of on the frontier of building new systems and stuff.

So maybe that's where this goes. I don't know. I mean, it's... I mean, we're all just, we're all just making guesses at this point. Like, no one knows where it's gonna go.

Allie Howe It's so exciting. Yeah. I mean, that's where it all, it feels like all of the focus is on right now is, like, building the infrastructure- like you're saying. And then for teams that have, like, fully built a software factory, like for example, they've transitioned from, like, writing code because, you know, code is cheap, to like, their whole job is, like, managing the factory. Like, is that the future of, like, software engineering and security is just managing all the infrastructure?

Joel de la Garza I mean, you could argue that's the job now. Like, I just feel like these tools I don't know. I mean, there's two, there's two things playing out here. The first is sort of like what is the timeline, what is the timeline to kind of arriving at some level of, of super intelligence where, where the systems are creating that new knowledge? I mean, you can ma- AGI is all definitional. I mean, these things are really impressive. I don't... I, I'm, I'm just not on that wavelength to have the discussion about those sorts of things. Like it's just not, not my, my bag. But I, I think Yeah, I think the question is sort of like at wha-what rate do these things continue to improve?

Do we get algorithmic advances? Do we get infrastructure advances that accelerate the timeline? That's all the stuff that, that I think is... That, I mean, that's, that's the, that's the coin flip or the, the dice toss. Like, is it 10 months? Is it 10 years? Is it 20 years? I don't know. I mean, I just don't know. And so we'll see.

Allie Howe Circling all back or putting it all together, like we, in the beginning we talked about this end state fallacy- Yeah... around like, hey, maybe like AI will like equal out in terms of like who's got the advantage, attackers, defenders, or maybe if it's the gatekeeping's the issue, maybe like in the future- Yeah we won't have that.

Joel de la Garza It's an artificial, it's an artificial disequilibrium. And if you talk to guys at Cotool, like- Yeah... they'll show you like refusals. Like, these, these models refuse to do blue team work because they think you're hacking. And so then, and you saw this in the Hugging Face example- Yeah which is like, "Let's use the frontier models. No, they won't do the work. Now we have to go use an open source model." And, and so, and so like, I feel like, I mean, I try, I mean, security people are prone to conspiracy theories. I mean, it is-... kind of our job. But like- Yeah... I'm not prone to conspiracy-minded thinking, but it just does seem like, oh man, it turns out curing cancer is hard, let's just sell cigarettes- is sort of the approach that, is like a conscious maybe a subconscious decision that people have made.

And so like you put these, y- you put these tools for hacking into the world, but then you h- but then you handicap the blue teamers, just feels like a falsely created equilibrium or disequilibrium. Whatever the term is there.

Allie Howe Do you think that equilibrium is to sell both like the problem and the solution? Like, let's make the problem exist and then we'll introduce the solution?

Joel de la Garza Yeah, I mean, they cure cancer, I'll start smoking next week.

Allie Howe Yeah. There we go.

Joel de la Garza I mean, seriously, right? Yeah. Like, it's just sort of like the... I mean, yeah, I don't know. I mean, these are, these are commercial entities that are making decisions to optimize the business for the ecosystem, so I don't know, maybe.

Allie Howe Yes. Yeah, yeah, that's true. And I s- I feel like a lot of companies are doing like this like offensive like red team work, and that's their whole product. Yeah. Like, is there a future for those products? I feel like LLMs do that, like...

Joel de la Garza I... You know, the one thing I am certain of, that from now until the end of time, people will wanna steal your shit. And that will be something that never changes, and that means that there will always be a market for a lot of this stuff, right? So like there will always be hackers, there will always be attackers. The tool set will look different. There will probably be infinitely many... Not infinitely many, but there will... We're in this weird phase where, like I said, like the, the job of the CISO wasn't to bury the bodies, it was to hide them. And so we're going through the phase where people are finding the bodies.

And so like the question is, like this is, this is, this is transitory, and what is the, what does the steady state look like here? I don't know. I mean, I, I think- I think at some point, like, if you look at... And I'm not, these things are incredible. I'm not, I'm not dim- diminishing their capabilities in any way. They've, they've built some amazing things. These tools are incredible. I'm not, and I'm not slighting them. I think that for some of these things, it's a little more complicated than we found a vulnerability. Like, because there's other things in the system, there's other compensating controls. Like, it may not quite be the kill move that people think it is.

And so, like, there's just a lot of complexity here, and I think if you look at Look, and this is all just my speculation. If you want data, I think the closest thing we have to data are the earnings statements that public companies are making about where their spending priorities are, and if you look at the one from IBM a few months ago or weeks ago, whenever it was, like the CEO of IBM is basically like, "Look, our customers are only spending money on AI and security." And so it just seems to me that like both are gonna be incredibly bullish markets-... for at least the foreseeable future.

And I don't think that regardless of how sophisticated attacking, at attacking these tools become like I just, I just don't think that obviates the need to have a security team and to continue to invest in this stuff. Like, I don't see it going away. I don't see it being a solved problem. Yeah. Just never, because people will always wanna rob you, full stop. Like, the motivation is there. Like, and as long as that is a motivation, that will continue to happen.

Allie Howe Yes, absolutely. And hopefully some of these like bans get lifted or, yeah, the gatekeeping ends so that like people-

Joel de la Garza Yeah. I mean, we, we've been thinking a lot about like how do you attack this from a policy perspective, right? Like, I think there is this, there is this current... The, the zeitgeist now is, "Oh, slow it down," and, "Oh, we need to restrict it," and all that sort of stuff, and I think that's actually the opposite like of what needs to happen. Like, I think the answer is to just get this into the good people's hands and let them use it and build it and make things better, and that's what people wanna do. Like, I just think that when you start to gatekeep these things, you just ensure that like only...

Like it's it's just the argument that like if you, if you make guns illegal, only the criminals will have guns, right? Like, it's a very similar argument. Now, I'm not advocating that we all run around there with guns, but like the fact that you're trying to gatekeep these things that exist in the world just has never worked. Just it's always made the problem worse.

Allie Howe Yes. Yeah, and offenders need the ability to react at machine speed. Yeah. And they need agents that can react at machine speed that have the ability to take, you know, very high like level actions like shut down a VM or make like a high like production like, you know, code change in a minute just to turn something off, like-

Joel de la Garza Well, and I think this is, this is sort of the like... I know 'cause we, there's like this ongoing debate about open source and the importance of open source, and this is just like literally the existential need for open source is like we can't, we can't allow like centralized commercial interests to, to undermine our ability to make our society safe, full stop. Like, and that's not like, "Oh, we need to keep them from building hacking tools." That's more just sort of like we need open source solutions that companies can build on top of that don't have the gatekeeping and allow them to protect themselves, right?

And so that's why there just has to be a very real commitment to open source. I mean, one of the reasons, one of the many reasons. And it's just why like open source is so incredibly important. You see that in the Hugging Face-... instance, right? Where it's like they had to default back to open source to protect themselves. Like open source is that protection.

Allie Howe Yes, absolutely. Yeah, I was reading that, like, open source model is, like, three months behind the frontier labs. Like

Joel de la Garza Well, there's a lot of reasons for why that is, but

Allie Howe Why is that?

Joel de la Garza I mean, if you talk to the labs, they'll say- Yeah... it's distillation. And that essentially... I mean, the, the, the, the, the saving grace of this is that these models... I mean, information... I mean, the, the, the, the, the, you know, the, the saying has always been that information wants to be free. Information will... Knowledge will always move to freedom. And that very much seems to be the case in that you, the more you use these models, the, the knowledge leaks from them. And that's essentially what distillation is. And the large fron- frontier labs would make the argument that these models are trailing them because it takes some time to distill them and then release them as an open source product.

Now, that discussion aside, there should still be an ecosystem of well-funded open source model building in the US. There needs to be. There should be. I think we do have a bit of an imperative to create that kind of an ecosystem- Yes... that is not based on distillation and that sort of attack. Like, literally based on, like, you know, open source frontier models and a business model that works around that.

Allie Howe Yes, absolutely, and that way more people can get their hands on them, too, like you were saying. This is, like, you know, the world runs on all this, like, end steps of, like, software. Like, it's not just the bank software, it's, like, all of the supply chain that comes with it.

Joel de la Garza Yeah. I mean, this is Windows versus Linux version two, right? Like, it's the- Yes... it's the same thing, right? Like, we've seen this story before, and, like, the only saving grace that we have is that, you know, the model, the, the models are very leaky, and the information, the knowledge leaks from them, and we can see that captured in open source.

Allie Howe And so to wrap us up if you were a defender today, what would you... Like, what would be the first, like, one, two, or three things that you would do to protect yourself or invest in?

Joel de la Garza Look, I think everyone in tech should be playing with this stuff. I talk to a lot of... Obviously, I mean, I'm, I live in the security world, and I know a lot of engineers and software developers at security companies who refuse to use AI coding. "It's garbage, it's crap, it's vulnerable code. It doesn't do the right thing," blah, blah, blah, blah. Like, yes, but like, this is the worst it's ever gonna be. It's gonna be better every day from now on until eternity. And so you gotta lean into this stuff, and you gotta embrace it. And it, and it's, it's more just sort of like Like, I, I mean, I guess maybe it's a generational thing, but, like, I got into tech 'cause I thought this was cool.

Like, to me, this was the coolest thing ever. I mean, I, I built computers. I loved playing with computers. The internet was phenomenal. Like, this has just been... I mean, if you didn't pay me to do it, I'd still be doing it-... is kind of the way I think a lot of people in tech are. And so I would just say to try to be like that. Like, this is, this is the... There's this, like, really, really incredible... I mean, there's a couple incredible things about these periods, and one is that you can actually just play with stuff. And so I would just say, you know, play with these things.

Get to use them. Don't be afraid. Like, it is super scary. Getting these things to work does mean going against security best practice and b- and for first principles. You're taking a risk, but, I mean, you kinda have to take... You have to kind of a, adapt or die, right? Like, it's just the way the world works. So very much lean into it. Don't... Be the person... And this is, this is my hope. This is, this is, and this is coming from sort of the cloud transition that we've been going through and sort of the history of security, right? Like, at the very beginning of the security profession, the joke was always that the CISO is the person that can say no in the most languages, and that's who got the title.

And they just existed to say no. W- the cloud transition became sort of like the CISO as enabler, and now I think it's very much sort of like security should be leading this, right? Like, like, security teams should be building tools for users to use that are safe so that they don't blow their heads off. And that's the role, I think, of where I would see security as an enabler versus sort of the, like, "No, you can't use this agent," "No, you can't do these cool things because blah," right? Like, I think that's kind of what I would say. And I think if you look at the innovative teams, right?

If you look at, if you look at Datadog, if you look at Cursor, if you look at the companies that are living on the frontier, like, the security leaders very much there are involved in the infrastructure rollout and the deployment and are the ones that are enabling the safe use of this stuff, and that's kinda how you, how you win.

Allie Howe Yes, makes sense. Absolutely. Well, thank you so much for your time today. Thank you for coming on the podcast, and we'll catch up with you again soon.

Joel de la Garza Awesome. Thank you.