Securing AI Agents at Runtime

Hey everyone, welcome back here to Techstrong TV. My next guest is David Mitten. David is the founder and CEO of a company called Arcjet.

If you haven't heard of Arcjet, it's okay. We're going to tell you about them in a second. Let's welcome David.

Hey, David, welcome to Techstrong TV. Hi, thanks for having me. My pleasure.

So David, before we jump on about Arcjet, let's hear a little bit about you. I started Arcjet in 2023. This is my third company.

Started my first one back in 2009, which was in cloud monitoring. Sold it in 2018, where I joined to run product engineering for a company called Statpath, which was in edge security. dev, which I'm still running for almost six years.

Just write very short dev tools reviews every week. Got about 30,000 subscribers. And it was through playing around with all the really fun dev tools that developers these days are used to, trying to find the same things with security that inspired me to create what became Arcjet, which is a security platform for securing AI agents at runtime.

So we can deal with things like prompt injection detection, personal information detection, tool guards, anything that an agent can do in production. I love it. So I've been speaking to a lot of companies recently around this particular subject of agentic security.

And is Arcjet primarily finding rogue agents or monitoring agent behavior for rogue behavior? Or are you policing it in that if you see rogue agents, somehow you're shutting them down or doing something proactive? That's the key question.

Every company is in AI security today, right? And a good portion of them are agentic security. So we have to stand out and differentiate.

And we look at three stages. We observe, we identify, and then we enforce. So we can see all the agents you have deployed in your environment.

We can help you identify them and attach them to a proper identity and a user and owner, and then we can help you enforce policy. So we can see what they're doing, we can make sure they're doing the correct thing, and then we can stop it when they're not. Love it.

We're going to dive further into it, but let me get some housekeeping out of the way. David, for people who want to find more about Arcjet, where do they go? com.

AR, it's just the way it is going to be on the bottom of your screen here, the bottom third with David's name and company. com. Now, David, this is going on since 2023 for you with Arcjet, so you've been around.

Talk to us a little bit about the business of the product, so to speak. How is the product offered? How do people consume it?

Arcjet observes your environment, and we ingest open telemetry data, so we can see all the activities. That allows us to complete that observe stage and the identify stage. The enforce stage is where it starts to get interesting, and you can either do this manually, or you can get your coding agent to do it for you, or you bring our SDK into your code base, whether you're writing Python, JavaScript, whatever language you're building your agents in.

Arcjet's integrated directly into the flow, because it's no longer sufficient to look at an agent as a whole. You've got to look at every single action that it's taking. And it might take 10 or 20 actions through a workflow.

So we charge based on the number of applications that we're observing, and then depending on the policy controls and the rules that you define, we charge on a usage basis. So if you're detecting prompt injections, then we charge based on that. Get it.

I get it. So David, if you don't mind, I want to kind of turn our conversation a little bit. When we talk about agentic security, I guess the progenitor, granddaddy story of agentic security with the recent, well, it wasn't even that recent.

It's been around probably two months, when OpenAI announced that in testing their latest version, the agents somehow broke containment, if you will. And now, to OpenAI's credit, they've published a lot of the background on how this happened. So we kind of know the story of how the agents were able to escape.

But nevertheless, the agents have escaped, and you can't blame tigers for having stripes. The agents had a mission, and in order to fulfill their mission, they were trying to find out more information or to get ahold of information that would help them. And so they reached out, in this case, to Hugging Face, and were able to infiltrate that after escaping containment at OpenAI.

Again, the agents are without malice and without ill intent. They're mission focused. That's how they're made.

And we could dive into the particulars of how this happened. But the future of security is all about this now, right? Because companies like Arcjet and others we've spoken to, this is what people are talking about.

Right. It's a real failure of observability. That was the key thing, because this went on for quite a long time.

You can trace the incident back months where different actions are happening. And so the actual attack, happened over a couple of days, but the build-up to it was over a much longer period of time. There's two concerns here.

There's the point-in-time enforcement of restrictions. They broke out of the sandbox. As soon as that happened, they should've been able to detect the unexpected network traffic, particularly to third parties like Hugging Face.

But the longer sequences, where I think is the more interesting thing when we're thinking about the future, is the behavior drift over time. They didn't suddenly attack Hugging Face. The behavior emerged over a period of time as the agents were collaborating, different actions happened, and then ultimately that resulted in the Hugging Face breach.

And it's this drift of the expected behavior that I think is the frontier problem in agent security that most of the CISOs I talk to right now are not thinking about it, because they're still thinking at the very beginning of the journey of where are all the agents, what are they doing? But there was an interesting paper by Google called Beyond Zero, where they talk about this behavior drift problem. And of course, Google operates at a very different scale than most organizations, so- Yeah ...

it makes sense that they're going to be the ones flaggng this as an interesting problem that most people don't need to solve right now. But it's something that we're thinking about how we build this into Arcjet and how we help our customers in the future, as well as dealing with the problem right now of agents doing things at a point of time. What about if an agent was being deployed for six months, and then the context changes, or the API calls change and the agents start to do different things than what it was designed for.

Monday to Friday at noon, we do a show every day, not every day, just Monday to Friday. But it's called Techstrong Gang, and we pick three topics that we explore with a panel of pundits, let's call them. And we were talking actually on the show we did live today before I came in studio here for this, was around NVIDIA announced a couple partnerships with Nemtode and stuff for what Gartner is calling guardian agents, right?

Agents that monitor other agents for rogue behavior and supposedly can reset a circuit breaker or stop them. They may be using, as you said, you guys are, right, with having the SDK built into the agent. The interesting thing or the part that I think we need to focus on is the persistence of the agent, right?

If you define an agent around a mission, and that agent has a persistent nature where it doesn't stop until the mission, the goal is reached, right, goal behavior almost That's exactly the kind of thing in the OpenAI example that got it in trouble, right? In other words, you could tell it, "Hey, this is your goal. " But if the goal becomes the goal, the goal becomes the end game.

If that path doesn't work, you can't blame the agent for finding another path to achieve its goal. And so I wonder, are we just at an intermediary step level in how we program our agents to-- can we program them more securely, while at the same time still wanting them to fulfill their goals? The guardian agent category is interesting because it's basically another AI watching the AI.

Yeah. And who's watching the guardian? Exactly.

I think the fundamental challenge is just the behavior of the agent is what you tell it, not necessarily what you mean. And so they act almost like a genie or like in the Midas Touch fable, where it does what you say, but that's not actually what you want. And this is the underlying challenge.

It's the reason why we tend not to do programming in English. We use a programming language because it's much more precise. A deterministic programming language that you write does exactly what you tell it, and if there's a bug, it's because you've written the code wrong.

But if we move over to English, there's less precision, and as a society we've solved this by having the court system and lawyers, and you argue, you understand the interpretation, and then ultimately there's a judge involved. And depending on your legal system, the judge might make the decision or might advise or get a jury involved, and that's much more like how agents operate. You can't be 100% certain of what they're going to do and what the outcome is going to be.

Agreed. How do you feel about, this isn't a fully baked-- I just get the feeling the whole industry's not fully baked here. We're still coming to terms with what agents are.

Because this is another thing. What is an agent? Right?

Will we be in the future all agents are persistent, all agents are goal-based, anything less is just a task, right? Or do we have ephemeral agents, if you will, that just do one little thing and p**f, go away? So what is an agent?

What boundaries do we put on agents? How do we do those boundaries? I just feel like we could stick a flag in the ground right now, but that ground is kind of like shifting sands.

Yeah. Well, a year ago, this whole category didn't even exist. No.

So that's the real challenge. The CISOs I'm talking to tend to split into two categories. There's agents that are built by non-technical people, marketing, ops, sales, and they tend to use a platform service.

It's not writing any code, and you're reliant on that platform to handle security and provide you observability. The second category is the agents where you're writing the code. You have a dev team.

They're probably using one of the many open source agent frameworks, and then you're responsible for deploying it into production. And the advantage with that is it's just code, so you can use all existing tools, or you can buy the new category of tools to get observability, to get enforcement. And I think right now we have a challenge of connecting the two, and security teams are just dealing with the fact that it's so easy for non-technical users to spin up agents in platforms that they're using.

And then when agents are being deployed from code, it looks like just another application. And how do you bring that into your enforcement envelope? And teams are inventing their own tools, though.

I talked to a company where they have five separate agents in production. They all have five separate code bases and five separate approaches to security. And we're in the very early stages.

It's like being back in the early 2000s with the number of vendors, the number of approaches. We haven't even got into the cloud era yet with one or two vendors starting to provide properly defined APIs and environments. So this is the fun part, but also the difficult part.

I think anyone who went to Black Hat just a couple of weeks ago and walked the expo floor would've had the same impression. Sensory overload. Yep.

There's all sorts of flashing lights and neon characters in costumes. Yeah. 500 companies yelling, "Look at me, agentic.

" Yeah. I was there. And I've been going to Black Hat for 23 years, right?

My background is in security and cyber. We didn't call it cyber, but in security. And this year I walked that floor and I was dizzy.

Yeah. You couldn't tell one story from the next. Right.

So they just tried to outspend each other, it seems. And it's like tricking people into paying attention to you, and I'm not sure that's how you actually sell a product. Yeah.

You might get a lead, but are they going to respond and are they going to solve a problem? It's just very difficult. It really was.

I don't even want to get into the Black Hat part of it. But I do think you're right in where we are now and what is changing with this. And here's another thing we spoke about on the gang episode regarding this today.

" Right? " I think we're applying the general human rule as we just proceed until there's some kind of incident or catastrophe, and then that's when we take another look at things. The OpenAI hack was interesting, but it didn't cause any damage or cause any real problems.

That's still to come, and when that happens, that's when I think attitudes are going to change to security. Until then, it's just going to be the Wild West and everyone's going to be deploying all sorts of different things. They're going to be retrofitting controls.

The main advantage that we have now is that everything is new, and so you don't have to worry about legacy agents. Maybe that just means something you built and deployed six months ago, but this is using today's technology. But as opposed to the kind of legacy IT estate where you might have an application that's been running for 10 years and you really don't want to touch it at all.

Everything today is brand new, and so you have the opportunity right now to deploy some of these new tools and bring in features from your existing vendors to solve this from the beginning rather than trying to deal with it at the end. That's the hope. I'm not sure it's going to happen, but it is the opportunity.

Let's hope so, you and me both. Hey, David, we're about out of time. I want to wish you success with ArcJet.

Don't be a stranger. Come back and keep us posted. This is something we talk about, as you can see, all the time here, so I'd love to continue the conversation.

Great. Thanks for having me on. All right.

David Mitten, founder and CEO of ArcJet, here on Techstrong TV. We're going to take a break. We'll be back in just a little bit.