The Lethal Trifecta Is Already on Your Laptops — Michael Patterson, Coder

AI Engineer · 20 min · 208 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

00:12How's everybody doing?
00:16Coolio.
00:18Well, it's nice to be presenting to you all.
00:20I hope we're all having a good time here at the the AI Dev Conference the AI Engineers Conference.
00:26Um, my name's Michael Patterson.
00:28I'm a staff solutions engineer here at Coda.
00:31Today, I want to talk to you about the lethal trifecta.
00:36So, we're a bit of a small crowd.
00:38Uh, can I get a raise of hands?
00:39Has anyone heard of the lethal trifecta?
00:43All of us or half of us.
00:45So, about 50/50.
00:47Fantastic.
00:48So, what I'm going to do is explain a little bit about what the lethal trifecta is and what we've learned here at Coda and addressing it.
00:59So, I'm going to start off by removing these Grenada notes from the presenter view.
01:06Sorry.
01:10Want to start off just uh on a quick recap of agentic AI in 2025.
01:162025 was undoubtedly the year of the AI agent.
01:21Everybody had a new agentic tool, Microsoft, Salesforce, AWS, uh, Claude Code basically changed the game when it when it came out last March.
01:32Everybody was using this stuff.
01:36And I have a a quick story.
01:38So, Vibe coding was was a really big thing.
01:43Um, Jason uh had this Twitter post about how agentic coding changed his life.
01:51He's pushing out all of this code, making all of these new changes to his product.
01:56This was the future for him.
01:58And then, I think less than 24 hours later an agent or 2 days later, he posts on Twitter again and says, "Agentic AI just destroyed my product, deleted my production database.
02:11And how can anyone ever use Agentic AI?"
02:15Um the thing is a AI agents are very powerful, but they create problems.
02:26Um everyone here familiar with Open Claw?
02:29Right?
02:30So, what's the deal with Open Claw, right?
02:33It's a really, really cool tool.
02:34You can put your own AI on a computer, and it can essentially be your personal assistant, do all of this really, really awesome stuff for you.
02:44But you've probably seen everyone is saying, "If you're going to use Open Claw, you need to buy a Mac Mini and put it on a different computer than your personal computer,
02:54right?"
02:55Because it's got all these security vulnerabilities.
02:57The last thing you want is Open Claw to go download all of your sensitive files, put it up on the internet, download viruses on the internet, put that on your laptop, and then delete all your personal files so that you don't have them, but the rest of the world does.
03:13So, there are quite a few issues with agents that we are still wrapping our heads around and how to securely develop with with AI agents.
03:21So, today I'm going to spend a little bit of time talking about the lethal trifecta, if you haven't heard of it, and how Coder is addressing uh the principles of Agentic security,
03:32and how folks are coming to us so that they can address these problems and scale out AI at their company.
03:39So, a little bit about Coder.
03:41Coder was founded in 2017.
03:44Um it was founded by three teenagers who were making Minecraft mods, and they They tired of having to configure VMs constantly to run Minecraft so that they could develop mods on it.
03:55Somehow they stumbled on an $80 million company.
04:00Um we're very proud of them.
04:01What Coded does is it delivers consistent, reliable, and secure remote development environments.
04:09Those environments can be stood up pretty much anywhere you want.
04:12They're configured with Terraform.
04:14We're open source.
04:16We're model agnostic.
04:17We're cloud agnostic.
04:20Uh you can host this on premise and we find that um this is a really, really good solution if you need a self-hosted model for developer environments or agentic environments.
04:33We're trusted by some of the biggest companies here in the United States and across Europe.
04:39Uh here's some of the names on our board.
04:42We're in I believe six of the top 10 big banks, lots of hedge funds, lots of three-letter government agencies.
04:49Essentially, if a SaaS model doesn't work for you, if you've got on-prem infrastructure, if you cannot have code sitting on a developer's laptop or in some kind of uh
05:03uh perimeter that you cannot control, Coded is usually a good solution uh just like these companies need it.
05:10So, what is the lethal trifecta?
05:14The lethal trifecta was a term coined by Simon Ellison and it's a essentially three layers, three threat layers to the attack surface.
05:24One is if you have your agent on a laptop, that could be clawed code, open claw, codex, right?
05:34Well, that laptop has access to private data.
05:38That can be personal information as files on your computer, credentials, company IP, databases.
05:46So, now your laptop has access to it.
05:49Your agent now has access to this private data.
05:52Now that it has access to this private data, it can also ex- uh communicate to the internet.
05:59Right?
05:59So, it has access to private data and it can put that data on the internet.
06:04And not only can it put that data on the internet, it can also download things off the internet.
06:09So, this is a problem because you don't have oversight into what exactly that agent might do when you prompt it.
06:19So, one of these three isn't really a big problem.
06:24But, two out of three is completely unacceptable in any kind of secure enterprise environment.
06:30Having all three is basically not acceptable.
06:33It's not if, it's when you're going to have some kind of security incident by having an agent on that laptop.
06:42And so, here I've got a a couple of attack scenarios.
06:45I'm sure everyone here has heard of prompt injection, which is essentially um you have some kind of malicious guidance in the information source that an agent would trust.
06:55So, it might be looking at error messages, it might be looking at support tickets, it might be looking at CICD logs.
07:01And it's very easy for a malicious actor to put something in any of those messages and the agent just accepts that as a source of truth and can do something that you didn't expect it to do.
07:14Context poisoning is in that same realm where you're essentially putting bad information into documentation, into data, anywhere where you're going to your agent is going to grab information.
07:27And then, if there's any malicious data in there, the agent is going to go ahead and run with it and do whatever it wants.
07:33And then, there's privilege escalation, right?
07:35So, everyone's familiar with the privilege the the least privilege access principle, right?
07:40And generally, we're giving agents access to pretty much everything because it needs access to do the work, right?
07:47And so, any one of these prompt injections or context poisoning can unwittingly escalate the privilege of that agent so it can do things that it shouldn't do, drop a table,
07:59upload, make requests, or post things that it shouldn't be able to do.
08:04So, how do we address that?
08:07Um there are three pillars of the lethal trifecta.
08:11There are three pillars of the of agentic security.
08:15We call it the trifecta of agent security.
08:17The first thing is you want to control data access.
08:21If you're going to use an agent, you don't want it on your laptop, you want it in an environment that is secure, preferably a virtual environment, right?
08:31That's going to block private file access, is going to prevent destructive actions on your machine because it's on some other machine.
08:38Then, you restrict that external communication.
08:42So, if you're going to put that agent on some kind of box, a VM, it's going to now be uh isolated architecturally from your network.
08:52It's only going to be able to go to domains that you want it to go to.
08:56It's going to be on your VPN, your VPC, it's going to go through a firewall, and then anything that that agent is doing on that box, that traffic is going to be governed.
09:06You're going to be able to see every little thing that it does, and if it ever breaches that perimeter, you should have some way of alerting your admins, alerting yourself
09:16that your agent is going somewhere it shouldn't so that you can effectively kill that VM, kill that agent.
09:22And then, you want to lock down uh the content and the contact and the access.
09:27So, you want to lock down the permissions, you want to restrict what access it has to, you want tightly scoped credentials credentials.
09:34The thing about agentic security is it's really no different from sound security practices for anyone, right?
09:42And we think that because AI is so powerful, we can just give it whatever it needs and it's not going to make the same kind of mistakes, not going to it's not exploitable by other
09:52vulnerabilities that a human would be.
09:54So, we want to make sure to separate that machine, secure that environment, intercept any kind of uh communication that that agent might do to the uh to the wider internet.
10:07So, I'm going to kind of quickly go over what it looks like uh deploying agents at scale at really, really large companies.
10:17What are the blockers to adoption?
10:19Why companies don't want to do this?
10:22Uh what are the challenges if you do uh decide to roll out agentic AI at a company?
10:27And the questions you can expect if you're trying to lead an initiative to get uh AI at your company.
10:34So, some challenges to expect, right?
10:37Before adoption, um you pretty much need security approval from CISOs.
10:42You need buy-in from DevOps because they're the ones that have to roll this out to teams.
10:47You're going to need real-world examples of, "Hey, this is why I need it.
10:52This is the workflow I want to do."
10:54And the trick here is if you're not getting these approvals, if you're at a company right now and they are not letting you use agents, most people are going to use their personal
11:06cloud subscriptions, their personal uh ChatGPT subscriptions, put that on the laptop because they do get tangible benefits from using AI.
11:15They're just not being authorized by the company.
11:17They're going to get that stuff done anyway.
11:19We call that shadow AI.
11:20Just like shadow IT, when you're bringing your own VMs, you're bringing your own uh technology into your company to get the work done.
11:27Shadow AI is just unauthorized usage of AI on your laptops.
11:33Um it's a real problem because once you get AI on your laptop, you're using your personal subscription, the enterprise doesn't know what's happening, and usually uh agentic AI can do a lot of damage
11:46really fast.
11:47We're starting to see a new term in the industry called ninja AI, which is shadow AI at scale, where you're not just having one agent breaking stuff, you've got multitudes
11:58of agents doing lots of things at an organization that no one knows until it's too late that a whole lot of stuff has gotten broken.
12:06So, um if you were going to adopt AI at your company, you need to make sure that there are good outcomes, right?
12:15Usually, companies come to us, they start with the developers because they're getting the most use out of using AI, but you want to be adaptable.
12:23You need to be rethinking your architecture.
12:25You need to be rethinking how you're going to protect your organization from incidents like agents dropping databases, uh deleting personal information, uploading customer information, essentially uh extracting your company's IP
12:40onto the public internet.
12:44So, once you start wanting to bring AI, you're going to definitely need to be talking to the security people.
12:51What are they What is the CISO uh concerned about?
12:54How do I stop agents from violating best practices?
12:58How do I put boundaries around these agents, right?
13:02I I I personally talk to to CISOs probably once or twice a week, and they're saying, "Hey, we understand the value of AI.
13:11We want to bring AI.
13:12We want people to go as fast as they can on the the development AI superhighway, but I need guardrails for them, right?
13:20And I can't just have my platform team or this business team come to me and say, 'Hey, we need AI.
13:27I need you to bless it because if anything goes wrong, it's not anyone's fault but the chief security team's problem, right?"
13:36And they don't want the finger being pointed at them because someone used Agentic AI and they didn't know what they were doing or they didn't have the proper guardrails
13:46for Agentic usage at the company.
13:49Uh platform admins, DevOps, infrastructure, security engineering, they're worried about observability.
13:56What are these agents doing?
13:58How do I know it's doing?
13:59How do I get every call that they make to an LLM provider in some kind of observability tool?
14:05And how can I then set up some kind of alerting for that without also getting alert fatigue?
14:11So, another thing that's happening is maybe we do get some kind of observability around AI, but now there's alerts going all over the place.
14:19Once you get alert fatigue, you stop really looking at what's actually happening.
14:24Everything AI is doing just becomes noise and you're missing the really, really critical things that actually need to be addressed.
14:31And then another thing is if I am going to roll out AI, how do I actually set this up in a repeatable, consistent, reliable, secure way for everyone at the company?
14:43Lastly, developers are going to have concerns as well.
14:47There is still a holy war happening where some of the most technical people are not quite converted that AI can do code better than them, right?
14:56They're worried about more technical debt, more code bloat, more security vulnerabilities, and spending most of their time fixing AI slop versus just doing it themselves.
15:06And then if they are going to put Claude on YOLO mode and have it crank out a bunch of PRs, how do I make sure that that agent isn't doing stuff that would actually get me in trouble, right?
15:18Because at the end of the day, someone is going to be accountable when an agent actually does something that we didn't expect it to do.
15:26So, I'm going to talk a little bit about how you can address all of these guardrails that everyone is concerned for.
15:35Uh the first thing is cloud development environments, and this is something that Coder does, right?
15:40You want a remote execution layer.
15:43You want a remote environment.
15:44You don't want it on your laptop.
15:46You want to go to a URL.
15:48You want to RDP.
15:49You want to SSH into something that is not your laptop, but something that is in a secure environment that has been blessed by the security team, by the platform team, and let agents
15:59write code, execute code on cloud infrastructure that um is isolated, that has right-scoped permissions, and cannot communicate to anything unless you allow it to communicate to that um to that public internet.
16:16So, this is kind of what it would look like, right?
16:20Instead of putting things on your local machine, you go to an isolated cloud environment.
16:24Right now, it can only do You can only work on the code that's in there.
16:29It can only touch credentials that are in there.
16:31It can only touch data that you purposely put into that development environment.
16:37Right?
16:38Um CDEs accelerate AI productivity because the thing is if you grab a a project and you put it on your laptop, what do you have to do to get that project running?
16:51You got to download dependencies.
16:53You got to update your your path.
16:56If your computer's running Python version 3, but this project needs Python version 2, you're going to get conflicts.
17:04You have to create virtual environments.
17:07You have to do a lot of extra stuff that while it may not break your laptop, you really don't want to go through the trouble of doing that.
17:15It would be better if you had a consistent cloud environment that was already configured to run that application, right?
17:21And so, everything that Coder does uh that helps developers, they don't have to worry about mucking around the shell, mucking around their precious laptop.
17:28They can just go to this lightweight or heavy VM, and everything's already ready to go, and they can just start developing.
17:36Well, that same thing is true for agents, right?
17:40If you put an agent on a fresh box and say, "Download this GitHub repo and run the project."
17:44What is it going to do?
17:45It's going to read the contents.
17:46It's going to say, "Oh, I need to start downloading stuff."
17:49You never know where it's going to download things from, and if it grabs things from some kind of registry, that registry could be contaminated.
17:56You really want things to already be ready so that the agent could just start developing.
18:02Um the next thing is a model proxy.
18:06And this is really just something in between that uh agent or that model on your machine before it hits the LLM provider, it needs to go through a box where we're
18:18sniffing all of that traffic, and we're able to log every little thing that it's doing, right?
18:24So, here you can see normally in in a in a normal scenario, the agent would be sitting somewhere, and it can just go straight to the internet, straight to the model provider, and get what it needs.
18:35But the solution is really simple, right?
18:37Before the agent hits the model provider, it goes to your proxy server, it goes through your gateway, right?
18:45And it can sanitize, it can strip injections.
18:48If you have like if you accidentally put credit card data into a prompt, you don't want that going to the LLM provider.
18:55Uh model proxy can strip that, and it logs everything that's happening.
19:01Lastly, you want an agent firewall.
19:04So, when that agent starts executing at the process level, you want to make sure that uh it can't run commands that you haven't already blessed, right?
19:14So, on that remote environment that goes to the proxy, if it runs if that agent for whatever reasons runs gh repo delete or drop this table, you want some kind of agentic firewall that's looking at the process logs and saying, "Do not run this."
19:33That that command is denied.
19:36And so, these are the three ways architecturally you can protect your organization from an agent going crazy.
19:44So, don't have time to run a demo right now, but if you're interested, please come over to our Curder booth.
19:53We're opposite and to the We're opposite of this stage and over to the left.
19:58Um And just some key takeaways, right?
20:01Agents are powerful, but be aware of that lethal trifecta.
20:04Make sure that you've got some way of seeing everything that that agent is does.
20:09It's okay to go slow so that you can think about your architecture, know what your infrastructure actually needs.
20:17My name is Michael Patterson, staff solutions engineer.
20:20Would love to talk to you guys about how you can securely develop with agents.
20:24Thank you for your time.