{
  "video": {
    "id": "IvE8n-ylFYY",
    "title": "Privacy-Preserving Intelligence — Steve Korshakov, Bee (acq. Amazon)",
    "duration": 953,
    "upload_date": null,
    "channel": "AI Engineer",
    "source": "AI Engineer",
    "event_format": "In person"
  },
  "analysis": {
    "video_id": "IvE8n-ylFYY",
    "title": "Privacy-Preserving Intelligence — Steve Korshakov, Bee (acq. Amazon)",
    "one_liner": "Bee's founder explains how an always-on AI wearable that captures ~10M tokens of a person's life per year is built so that no one — including Amazon, its new owner — can decrypt it: device-held keys, attested confidential-compute inference, a Sigstore transparency log, and a separate Amazon team whose signing keys are hardcoded into the clients.",
    "summary": "Steve Korshakov describes the privacy architecture behind Bee, an AI wearable acquired by Amazon ~8 months ago that records everything a user says and hears. Because the agent must run continuously and autonomously (days at a time, without the phone online) rather than request/response, they built a stateful runtime with persistent memory that the company itself cannot read: keys live only on the customer's phone, everything is encrypted with no opt-out, and inference runs on their own models inside confidential compute after an attestation pipeline checks the workload against a public Sigstore transparency log. The hardest problem became internal threat: joining Amazon meant the usual 'Amazon is the trustworthy cloud provider' guarantee no longer applies to you, so deploys are gated by a separate Amazon team whose signing keys are hardcoded into the client apps and backends, making it 'virtually impossible' for Bee's own engineers to ship something unnoticed. The whole trusted surface is about 20k lines in a memory-safe language, most of it attestation verification.",
    "key_points": [
      "A single Bee wearer captures roughly 10 million tokens per year, and within the first week of recording you can learn virtually everything about a person — he calls it one of the most sensitive capture devices on the market.",
      "Design premise: the agent should work non-stop on your behalf without consuming customer resources like battery, so request/response is not enough — he cites Claude Code going from 'change this, change that' a few months ago to running for hours as a glimpse of where personal agents go, and expects them to run for days.",
      "Result is a stateful runtime with persistent memory that Bee cannot access, can connect to tools and third-party services, and does not require the user's device to be online — 'fully autonomous but at the same time fully controlled by the user.'",
      "Four encryption principles: the key lives and is managed only on the customer's iPhone/Android and is never persisted by Bee; everything is encrypted with no opt-out and no bypass; all workloads are fully transparent and audited to guard against internal threats; trusted dependencies are minimized.",
      "Key flow: phone runs a sophisticated attestation pipeline that verifies both integrity and that the specific workload appears in a public transparency log (Sigstore, transcribed 'six store'), then shares the key with the front-end backend, which replicates it to nodes inside confidential compute; they run their own inference across all kinds of models, which is harder than for a typical AI company.",
      "Keys held in memory get a forced 7-day expiration — 24 hours was rejected because a user might not open their phone for a day and would miss things; 7 days is their estimate of the useful time horizon.",
      "Deploy gating is two-tier: a separate dedicated team (or teams) inside Amazon owns the privacy side and the transparency log, their signing keys are hardcoded into Bee's client apps and backends, and Bee's team can influence but not control them; any change needs very high-level sign-off, which at a company Amazon's size is 'virtually impossible.'",
      "Because the process is slow, it's split: a base image carrying the tools that measure boot, manifest, workloads and node data, then a per-deploy manifest published to the transparency log — which lets two high-profile external audit firms (and internal auditors) retrieve any image or data ever deployed and trace weak spots.",
      "After self-verification the VM issues a certificate that embeds the transparency proofs and attestation documents into the certificate itself; this requires a private CA because public certificates would populate the public CT log. A lighter-mode proxy doing normal TLS with attestation is planned but doesn't exist yet.",
      "It's all normal EC2 instances, and the trusted codebase is only ~20k lines in a memory-safe language — most of it attestation verification — deliberately small enough to audit, reusing trustworthy existing software rather than inventing crypto."
    ],
    "takeaways": [
      "Don't treat your cloud provider's privacy guarantees as your own: once you're inside the provider, you must defend against internal threat, which means attestation, transparency logs and deploy-signing held by a team you cannot control.",
      "Keep the trusted computing base small enough to actually audit — ~20k lines of memory-safe code, mostly attestation verification — and reuse well-established crypto instead of rolling your own (the Telegram lesson).",
      "Publish workload identity to a public transparency log (Sigstore) so any user or auditor can independently verify the code handling their data is genuine, and keep every image and manifest ever deployed retrievable for forensic tracing.",
      "Pick key-lifetime and expiry windows from real user behavior, not from a security slogan: 24-hour key expiry breaks users who don't open their phone daily, so they settled on 7 days.",
      "Assume personal agents will run continuously for days without the user's device online — architect for a stateful runtime with persistent encrypted memory rather than request/response backends.",
      "For agent safety, don't rely on training or prompting the agent to behave: sandbox it and remove its ability to do harm, putting a human-gated step in front of any change it wants to make."
    ],
    "topics": [
      "privacy",
      "encryption",
      "confidential-computing",
      "attestation",
      "agents",
      "wearables",
      "supply-chain-security",
      "sandboxing"
    ],
    "tools": [
      "Bee",
      "Amazon",
      "AWS EC2",
      "Sigstore (transcribed as 'six store')",
      "Claude Code (transcribed as 'cloud code')",
      "iPhone",
      "Android",
      "Telegram",
      "OpenClaw (transcribed as 'open claw')"
    ],
    "quotes": [
      {
        "text": "you can learn virtually everything about the person within the just like one week of wearing the B device which is extremely sensitive. I think we one of the most sensitive uh capture device on the market now.",
        "at": "01:12",
        "url": "https://www.youtube.com/watch?v=IvE8n-ylFYY&t=72s"
      },
      {
        "text": "Amazon itself provides strong security and privacy guarantees but if you Amazon and you using Amazon stuff there is like much more uh serious security stuff you need to do.",
        "at": "01:43",
        "url": "https://www.youtube.com/watch?v=IvE8n-ylFYY&t=103s"
      },
      {
        "text": "Our goal was to uh build a system that no one inside of uh Amazon will be able to ship anything unnoticed.",
        "at": "07:20",
        "url": "https://www.youtube.com/watch?v=IvE8n-ylFYY&t=440s"
      },
      {
        "text": "when I was a telegram like we reintroduced like build our own crypto and that was like questionable way of doing stuff. So, I try not to do the same at Amazon, obviously.",
        "at": "12:56",
        "url": "https://www.youtube.com/watch?v=IvE8n-ylFYY&t=776s"
      },
      {
        "text": "I think nothing works except like sandboxing and just not giving them a way to hurt themselves. It's like you know our brains they can't stop the heart at will right",
        "at": "14:19",
        "url": "https://www.youtube.com/watch?v=IvE8n-ylFYY&t=859s"
      }
    ],
    "words": 2369
  },
  "summary_url": "/#IvE8n-ylFYY",
  "transcript": {
    "html": "/transcripts/IvE8n-ylFYY.html",
    "txt": "/transcripts/IvE8n-ylFYY.txt",
    "vtt": "/transcripts/IvE8n-ylFYY.vtt"
  }
}