WEBVTT NOTE Sentence-level transcript of https://www.youtube.com/watch?v=abw_m-DRi1k NOTE One cue per sentence. Cue ids are the line anchors on /transcripts/abw_m-DRi1k.html. A cue ends where the next begins, or 2 s after its last word. s1 00:00:12.960 --> 00:00:15.480 How's everybody doing? s2 00:00:16.000 --> 00:00:18.000 Coolio. s3 00:00:18.680 --> 00:00:20.520 Well, it's nice to be presenting to you all. s4 00:00:20.520 --> 00:00:26.240 I hope we're all having a good time here at the the AI Dev Conference the AI Engineers Conference. s5 00:00:26.240 --> 00:00:28.040 Um, my name's Michael Patterson. s6 00:00:28.040 --> 00:00:31.360 I'm a staff solutions engineer here at Coda. s7 00:00:31.360 --> 00:00:36.400 Today, I want to talk to you about the lethal trifecta. s8 00:00:36.400 --> 00:00:38.040 So, we're a bit of a small crowd. s9 00:00:38.040 --> 00:00:39.520 Uh, can I get a raise of hands? s10 00:00:39.520 --> 00:00:42.520 Has anyone heard of the lethal trifecta? s11 00:00:43.360 --> 00:00:45.280 All of us or half of us. s12 00:00:45.280 --> 00:00:47.120 So, about 50/50. s13 00:00:47.120 --> 00:00:48.600 Fantastic. s14 00:00:48.600 --> 00:00:59.320 So, what I'm going to do is explain a little bit about what the lethal trifecta is and what we've learned here at Coda and addressing it. s15 00:00:59.760 --> 00:01:06.120 So, I'm going to start off by removing these Grenada notes from the presenter view. s16 00:01:06.120 --> 00:01:08.120 Sorry. s17 00:01:10.840 --> 00:01:16.960 Want to start off just uh on a quick recap of agentic AI in 2025. s18 00:01:16.960 --> 00:01:21.040 2025 was undoubtedly the year of the AI agent. s19 00:01:21.040 --> 00:01:32.800 Everybody had a new agentic tool, Microsoft, Salesforce, AWS, uh, Claude Code basically changed the game when it when it came out last March. s20 00:01:32.800 --> 00:01:35.920 Everybody was using this stuff. s21 00:01:36.560 --> 00:01:38.600 And I have a a quick story. s22 00:01:38.600 --> 00:01:43.080 So, Vibe coding was was a really big thing. s23 00:01:43.080 --> 00:01:51.000 Um, Jason uh had this Twitter post about how agentic coding changed his life. s24 00:01:51.000 --> 00:01:56.680 He's pushing out all of this code, making all of these new changes to his product. s25 00:01:56.680 --> 00:01:58.800 This was the future for him. s26 00:01:58.800 --> 00:02:11.959 And then, I think less than 24 hours later an agent or 2 days later, he posts on Twitter again and says, "Agentic AI just destroyed my product, deleted my production database. s27 00:02:11.959 --> 00:02:15.840 And how can anyone ever use Agentic AI?" s28 00:02:15.840 --> 00:02:26.520 Um the thing is a AI agents are very powerful, but they create problems. s29 00:02:26.520 --> 00:02:29.800 Um everyone here familiar with Open Claw? s30 00:02:29.800 --> 00:02:30.280 Right? s31 00:02:30.280 --> 00:02:33.040 So, what's the deal with Open Claw, right? s32 00:02:33.040 --> 00:02:34.840 It's a really, really cool tool. s33 00:02:34.840 --> 00:02:44.040 You can put your own AI on a computer, and it can essentially be your personal assistant, do all of this really, really awesome stuff for you. s34 00:02:44.040 --> 00:02:54.720 But you've probably seen everyone is saying, "If you're going to use Open Claw, you need to buy a Mac Mini and put it on a different computer than your personal computer, s35 00:02:54.720 --> 00:02:55.360 right?" s36 00:02:55.360 --> 00:02:57.880 Because it's got all these security vulnerabilities. s37 00:02:57.880 --> 00:03:13.120 The last thing you want is Open Claw to go download all of your sensitive files, put it up on the internet, download viruses on the internet, put that on your laptop, and then delete all your personal files so that you don't have them, but the rest of the world does. s38 00:03:13.120 --> 00:03:21.760 So, there are quite a few issues with agents that we are still wrapping our heads around and how to securely develop with with AI agents. s39 00:03:21.760 --> 00:03:32.160 So, today I'm going to spend a little bit of time talking about the lethal trifecta, if you haven't heard of it, and how Coder is addressing uh the principles of Agentic security, s40 00:03:32.160 --> 00:03:39.440 and how folks are coming to us so that they can address these problems and scale out AI at their company. s41 00:03:39.440 --> 00:03:41.680 So, a little bit about Coder. s42 00:03:41.680 --> 00:03:44.239 Coder was founded in 2017. s43 00:03:44.239 --> 00:03:55.760 Um it was founded by three teenagers who were making Minecraft mods, and they They tired of having to configure VMs constantly to run Minecraft so that they could develop mods on it. s44 00:03:55.760 --> 00:04:00.400 Somehow they stumbled on an $80 million company. s45 00:04:00.400 --> 00:04:01.880 Um we're very proud of them. s46 00:04:01.880 --> 00:04:09.000 What Coded does is it delivers consistent, reliable, and secure remote development environments. s47 00:04:09.000 --> 00:04:12.600 Those environments can be stood up pretty much anywhere you want. s48 00:04:12.600 --> 00:04:14.400 They're configured with Terraform. s49 00:04:14.400 --> 00:04:16.079 We're open source. s50 00:04:16.079 --> 00:04:17.959 We're model agnostic. s51 00:04:17.959 --> 00:04:20.079 We're cloud agnostic. s52 00:04:20.079 --> 00:04:33.200 Uh you can host this on premise and we find that um this is a really, really good solution if you need a self-hosted model for developer environments or agentic environments. s53 00:04:33.200 --> 00:04:39.680 We're trusted by some of the biggest companies here in the United States and across Europe. s54 00:04:39.680 --> 00:04:42.200 Uh here's some of the names on our board. s55 00:04:42.200 --> 00:04:49.720 We're in I believe six of the top 10 big banks, lots of hedge funds, lots of three-letter government agencies. s56 00:04:49.720 --> 00:05:03.320 Essentially, if a SaaS model doesn't work for you, if you've got on-prem infrastructure, if you cannot have code sitting on a developer's laptop or in some kind of uh s57 00:05:03.320 --> 00:05:10.720 uh perimeter that you cannot control, Coded is usually a good solution uh just like these companies need it. s58 00:05:10.720 --> 00:05:14.760 So, what is the lethal trifecta? s59 00:05:14.760 --> 00:05:24.919 The lethal trifecta was a term coined by Simon Ellison and it's a essentially three layers, three threat layers to the attack surface. s60 00:05:24.919 --> 00:05:34.000 One is if you have your agent on a laptop, that could be clawed code, open claw, codex, right? s61 00:05:34.000 --> 00:05:38.440 Well, that laptop has access to private data. s62 00:05:38.440 --> 00:05:46.400 That can be personal information as files on your computer, credentials, company IP, databases. s63 00:05:46.400 --> 00:05:49.600 So, now your laptop has access to it. s64 00:05:49.600 --> 00:05:52.880 Your agent now has access to this private data. s65 00:05:52.880 --> 00:05:59.640 Now that it has access to this private data, it can also ex- uh communicate to the internet. s66 00:05:59.640 --> 00:05:59.880 Right? s67 00:05:59.880 --> 00:06:04.120 So, it has access to private data and it can put that data on the internet. s68 00:06:04.120 --> 00:06:09.680 And not only can it put that data on the internet, it can also download things off the internet. s69 00:06:09.680 --> 00:06:19.560 So, this is a problem because you don't have oversight into what exactly that agent might do when you prompt it. s70 00:06:19.560 --> 00:06:24.280 So, one of these three isn't really a big problem. s71 00:06:24.280 --> 00:06:30.720 But, two out of three is completely unacceptable in any kind of secure enterprise environment. s72 00:06:30.720 --> 00:06:33.919 Having all three is basically not acceptable. s73 00:06:33.919 --> 00:06:42.160 It's not if, it's when you're going to have some kind of security incident by having an agent on that laptop. s74 00:06:42.160 --> 00:06:45.240 And so, here I've got a a couple of attack scenarios. s75 00:06:45.240 --> 00:06:55.840 I'm sure everyone here has heard of prompt injection, which is essentially um you have some kind of malicious guidance in the information source that an agent would trust. s76 00:06:55.840 --> 00:07:01.960 So, it might be looking at error messages, it might be looking at support tickets, it might be looking at CICD logs. s77 00:07:01.960 --> 00:07:14.040 And it's very easy for a malicious actor to put something in any of those messages and the agent just accepts that as a source of truth and can do something that you didn't expect it to do. s78 00:07:14.040 --> 00:07:27.280 Context poisoning is in that same realm where you're essentially putting bad information into documentation, into data, anywhere where you're going to your agent is going to grab information. s79 00:07:27.280 --> 00:07:33.200 And then, if there's any malicious data in there, the agent is going to go ahead and run with it and do whatever it wants. s80 00:07:33.200 --> 00:07:35.400 And then, there's privilege escalation, right? s81 00:07:35.400 --> 00:07:40.720 So, everyone's familiar with the privilege the the least privilege access principle, right? s82 00:07:40.720 --> 00:07:47.680 And generally, we're giving agents access to pretty much everything because it needs access to do the work, right? s83 00:07:47.680 --> 00:07:59.160 And so, any one of these prompt injections or context poisoning can unwittingly escalate the privilege of that agent so it can do things that it shouldn't do, drop a table, s84 00:07:59.160 --> 00:08:04.000 upload, make requests, or post things that it shouldn't be able to do. s85 00:08:04.000 --> 00:08:07.480 So, how do we address that? s86 00:08:07.480 --> 00:08:11.920 Um there are three pillars of the lethal trifecta. s87 00:08:11.920 --> 00:08:15.600 There are three pillars of the of agentic security. s88 00:08:15.600 --> 00:08:17.800 We call it the trifecta of agent security. s89 00:08:17.800 --> 00:08:21.800 The first thing is you want to control data access. s90 00:08:21.800 --> 00:08:31.480 If you're going to use an agent, you don't want it on your laptop, you want it in an environment that is secure, preferably a virtual environment, right? s91 00:08:31.480 --> 00:08:38.800 That's going to block private file access, is going to prevent destructive actions on your machine because it's on some other machine. s92 00:08:38.800 --> 00:08:42.200 Then, you restrict that external communication. s93 00:08:42.200 --> 00:08:52.880 So, if you're going to put that agent on some kind of box, a VM, it's going to now be uh isolated architecturally from your network. s94 00:08:52.880 --> 00:08:56.520 It's only going to be able to go to domains that you want it to go to. s95 00:08:56.520 --> 00:09:06.160 It's going to be on your VPN, your VPC, it's going to go through a firewall, and then anything that that agent is doing on that box, that traffic is going to be governed. s96 00:09:06.160 --> 00:09:16.080 You're going to be able to see every little thing that it does, and if it ever breaches that perimeter, you should have some way of alerting your admins, alerting yourself s97 00:09:16.080 --> 00:09:22.640 that your agent is going somewhere it shouldn't so that you can effectively kill that VM, kill that agent. s98 00:09:22.640 --> 00:09:27.400 And then, you want to lock down uh the content and the contact and the access. s99 00:09:27.400 --> 00:09:34.600 So, you want to lock down the permissions, you want to restrict what access it has to, you want tightly scoped credentials credentials. s100 00:09:34.600 --> 00:09:42.640 The thing about agentic security is it's really no different from sound security practices for anyone, right? s101 00:09:42.640 --> 00:09:52.720 And we think that because AI is so powerful, we can just give it whatever it needs and it's not going to make the same kind of mistakes, not going to it's not exploitable by other s102 00:09:52.720 --> 00:09:54.560 vulnerabilities that a human would be. s103 00:09:54.560 --> 00:10:07.600 So, we want to make sure to separate that machine, secure that environment, intercept any kind of uh communication that that agent might do to the uh to the wider internet. s104 00:10:07.840 --> 00:10:17.680 So, I'm going to kind of quickly go over what it looks like uh deploying agents at scale at really, really large companies. s105 00:10:17.680 --> 00:10:19.760 What are the blockers to adoption? s106 00:10:19.760 --> 00:10:22.200 Why companies don't want to do this? s107 00:10:22.200 --> 00:10:27.400 Uh what are the challenges if you do uh decide to roll out agentic AI at a company? s108 00:10:27.400 --> 00:10:34.200 And the questions you can expect if you're trying to lead an initiative to get uh AI at your company. s109 00:10:34.200 --> 00:10:37.040 So, some challenges to expect, right? s110 00:10:37.040 --> 00:10:42.760 Before adoption, um you pretty much need security approval from CISOs. s111 00:10:42.760 --> 00:10:47.440 You need buy-in from DevOps because they're the ones that have to roll this out to teams. s112 00:10:47.440 --> 00:10:52.200 You're going to need real-world examples of, "Hey, this is why I need it. s113 00:10:52.200 --> 00:10:54.360 This is the workflow I want to do." s114 00:10:54.360 --> 00:11:06.839 And the trick here is if you're not getting these approvals, if you're at a company right now and they are not letting you use agents, most people are going to use their personal s115 00:11:06.839 --> 00:11:15.200 cloud subscriptions, their personal uh ChatGPT subscriptions, put that on the laptop because they do get tangible benefits from using AI. s116 00:11:15.200 --> 00:11:17.280 They're just not being authorized by the company. s117 00:11:17.280 --> 00:11:19.000 They're going to get that stuff done anyway. s118 00:11:19.000 --> 00:11:20.720 We call that shadow AI. s119 00:11:20.720 --> 00:11:27.320 Just like shadow IT, when you're bringing your own VMs, you're bringing your own uh technology into your company to get the work done. s120 00:11:27.320 --> 00:11:33.360 Shadow AI is just unauthorized usage of AI on your laptops. s121 00:11:33.360 --> 00:11:46.200 Um it's a real problem because once you get AI on your laptop, you're using your personal subscription, the enterprise doesn't know what's happening, and usually uh agentic AI can do a lot of damage s122 00:11:46.200 --> 00:11:47.360 really fast. s123 00:11:47.360 --> 00:11:58.040 We're starting to see a new term in the industry called ninja AI, which is shadow AI at scale, where you're not just having one agent breaking stuff, you've got multitudes s124 00:11:58.040 --> 00:12:06.240 of agents doing lots of things at an organization that no one knows until it's too late that a whole lot of stuff has gotten broken. s125 00:12:06.240 --> 00:12:15.080 So, um if you were going to adopt AI at your company, you need to make sure that there are good outcomes, right? s126 00:12:15.080 --> 00:12:23.000 Usually, companies come to us, they start with the developers because they're getting the most use out of using AI, but you want to be adaptable. s127 00:12:23.000 --> 00:12:25.080 You need to be rethinking your architecture. s128 00:12:25.080 --> 00:12:40.560 You need to be rethinking how you're going to protect your organization from incidents like agents dropping databases, uh deleting personal information, uploading customer information, essentially uh extracting your company's IP s129 00:12:40.560 --> 00:12:43.360 onto the public internet. s130 00:12:44.160 --> 00:12:51.200 So, once you start wanting to bring AI, you're going to definitely need to be talking to the security people. s131 00:12:51.200 --> 00:12:54.960 What are they What is the CISO uh concerned about? s132 00:12:54.960 --> 00:12:58.480 How do I stop agents from violating best practices? s133 00:12:58.480 --> 00:13:02.200 How do I put boundaries around these agents, right? s134 00:13:02.200 --> 00:13:11.000 I I I personally talk to to CISOs probably once or twice a week, and they're saying, "Hey, we understand the value of AI. s135 00:13:11.000 --> 00:13:12.360 We want to bring AI. s136 00:13:12.360 --> 00:13:20.520 We want people to go as fast as they can on the the development AI superhighway, but I need guardrails for them, right? s137 00:13:20.520 --> 00:13:27.240 And I can't just have my platform team or this business team come to me and say, 'Hey, we need AI. s138 00:13:27.240 --> 00:13:36.600 I need you to bless it because if anything goes wrong, it's not anyone's fault but the chief security team's problem, right?" s139 00:13:36.600 --> 00:13:46.440 And they don't want the finger being pointed at them because someone used Agentic AI and they didn't know what they were doing or they didn't have the proper guardrails s140 00:13:46.440 --> 00:13:49.440 for Agentic usage at the company. s141 00:13:49.440 --> 00:13:56.360 Uh platform admins, DevOps, infrastructure, security engineering, they're worried about observability. s142 00:13:56.480 --> 00:13:58.120 What are these agents doing? s143 00:13:58.120 --> 00:13:59.800 How do I know it's doing? s144 00:13:59.800 --> 00:14:05.840 How do I get every call that they make to an LLM provider in some kind of observability tool? s145 00:14:05.840 --> 00:14:11.600 And how can I then set up some kind of alerting for that without also getting alert fatigue? s146 00:14:11.600 --> 00:14:19.600 So, another thing that's happening is maybe we do get some kind of observability around AI, but now there's alerts going all over the place. s147 00:14:19.600 --> 00:14:24.280 Once you get alert fatigue, you stop really looking at what's actually happening. s148 00:14:24.280 --> 00:14:31.400 Everything AI is doing just becomes noise and you're missing the really, really critical things that actually need to be addressed. s149 00:14:31.400 --> 00:14:43.680 And then another thing is if I am going to roll out AI, how do I actually set this up in a repeatable, consistent, reliable, secure way for everyone at the company? s150 00:14:43.680 --> 00:14:47.160 Lastly, developers are going to have concerns as well. s151 00:14:47.160 --> 00:14:56.000 There is still a holy war happening where some of the most technical people are not quite converted that AI can do code better than them, right? s152 00:14:56.000 --> 00:15:06.560 They're worried about more technical debt, more code bloat, more security vulnerabilities, and spending most of their time fixing AI slop versus just doing it themselves. s153 00:15:06.560 --> 00:15:18.839 And then if they are going to put Claude on YOLO mode and have it crank out a bunch of PRs, how do I make sure that that agent isn't doing stuff that would actually get me in trouble, right? s154 00:15:18.839 --> 00:15:26.600 Because at the end of the day, someone is going to be accountable when an agent actually does something that we didn't expect it to do. s155 00:15:26.600 --> 00:15:35.440 So, I'm going to talk a little bit about how you can address all of these guardrails that everyone is concerned for. s156 00:15:35.760 --> 00:15:40.960 Uh the first thing is cloud development environments, and this is something that Coder does, right? s157 00:15:40.960 --> 00:15:43.240 You want a remote execution layer. s158 00:15:43.240 --> 00:15:44.960 You want a remote environment. s159 00:15:44.960 --> 00:15:46.640 You don't want it on your laptop. s160 00:15:46.640 --> 00:15:48.440 You want to go to a URL. s161 00:15:48.440 --> 00:15:49.360 You want to RDP. s162 00:15:49.360 --> 00:15:59.320 You want to SSH into something that is not your laptop, but something that is in a secure environment that has been blessed by the security team, by the platform team, and let agents s163 00:15:59.320 --> 00:16:16.120 write code, execute code on cloud infrastructure that um is isolated, that has right-scoped permissions, and cannot communicate to anything unless you allow it to communicate to that um to that public internet. s164 00:16:16.120 --> 00:16:20.040 So, this is kind of what it would look like, right? s165 00:16:20.040 --> 00:16:24.800 Instead of putting things on your local machine, you go to an isolated cloud environment. s166 00:16:24.800 --> 00:16:29.080 Right now, it can only do You can only work on the code that's in there. s167 00:16:29.080 --> 00:16:31.320 It can only touch credentials that are in there. s168 00:16:31.320 --> 00:16:37.520 It can only touch data that you purposely put into that development environment. s169 00:16:37.520 --> 00:16:38.320 Right? s170 00:16:38.320 --> 00:16:51.320 Um CDEs accelerate AI productivity because the thing is if you grab a a project and you put it on your laptop, what do you have to do to get that project running? s171 00:16:51.320 --> 00:16:53.240 You got to download dependencies. s172 00:16:53.240 --> 00:16:56.440 You got to update your your path. s173 00:16:56.440 --> 00:17:04.959 If your computer's running Python version 3, but this project needs Python version 2, you're going to get conflicts. s174 00:17:04.959 --> 00:17:07.199 You have to create virtual environments. s175 00:17:07.199 --> 00:17:15.199 You have to do a lot of extra stuff that while it may not break your laptop, you really don't want to go through the trouble of doing that. s176 00:17:15.199 --> 00:17:21.439 It would be better if you had a consistent cloud environment that was already configured to run that application, right? s177 00:17:21.439 --> 00:17:28.960 And so, everything that Coder does uh that helps developers, they don't have to worry about mucking around the shell, mucking around their precious laptop. s178 00:17:28.960 --> 00:17:36.480 They can just go to this lightweight or heavy VM, and everything's already ready to go, and they can just start developing. s179 00:17:36.480 --> 00:17:40.080 Well, that same thing is true for agents, right? s180 00:17:40.080 --> 00:17:44.840 If you put an agent on a fresh box and say, "Download this GitHub repo and run the project." s181 00:17:44.840 --> 00:17:45.920 What is it going to do? s182 00:17:45.920 --> 00:17:46.920 It's going to read the contents. s183 00:17:46.920 --> 00:17:49.480 It's going to say, "Oh, I need to start downloading stuff." s184 00:17:49.480 --> 00:17:56.720 You never know where it's going to download things from, and if it grabs things from some kind of registry, that registry could be contaminated. s185 00:17:56.720 --> 00:18:02.760 You really want things to already be ready so that the agent could just start developing. s186 00:18:02.920 --> 00:18:06.320 Um the next thing is a model proxy. s187 00:18:06.320 --> 00:18:18.880 And this is really just something in between that uh agent or that model on your machine before it hits the LLM provider, it needs to go through a box where we're s188 00:18:18.880 --> 00:18:24.240 sniffing all of that traffic, and we're able to log every little thing that it's doing, right? s189 00:18:24.240 --> 00:18:35.040 So, here you can see normally in in a in a normal scenario, the agent would be sitting somewhere, and it can just go straight to the internet, straight to the model provider, and get what it needs. s190 00:18:35.040 --> 00:18:37.480 But the solution is really simple, right? s191 00:18:37.480 --> 00:18:45.000 Before the agent hits the model provider, it goes to your proxy server, it goes through your gateway, right? s192 00:18:45.000 --> 00:18:48.760 And it can sanitize, it can strip injections. s193 00:18:48.760 --> 00:18:55.480 If you have like if you accidentally put credit card data into a prompt, you don't want that going to the LLM provider. s194 00:18:55.480 --> 00:19:01.200 Uh model proxy can strip that, and it logs everything that's happening. s195 00:19:01.200 --> 00:19:04.000 Lastly, you want an agent firewall. s196 00:19:04.000 --> 00:19:14.400 So, when that agent starts executing at the process level, you want to make sure that uh it can't run commands that you haven't already blessed, right? s197 00:19:14.400 --> 00:19:33.240 So, on that remote environment that goes to the proxy, if it runs if that agent for whatever reasons runs gh repo delete or drop this table, you want some kind of agentic firewall that's looking at the process logs and saying, "Do not run this." s198 00:19:33.240 --> 00:19:36.280 That that command is denied. s199 00:19:36.280 --> 00:19:44.280 And so, these are the three ways architecturally you can protect your organization from an agent going crazy. s200 00:19:44.280 --> 00:19:53.280 So, don't have time to run a demo right now, but if you're interested, please come over to our Curder booth. s201 00:19:53.280 --> 00:19:58.520 We're opposite and to the We're opposite of this stage and over to the left. s202 00:19:58.520 --> 00:20:01.080 Um And just some key takeaways, right? s203 00:20:01.080 --> 00:20:04.360 Agents are powerful, but be aware of that lethal trifecta. s204 00:20:04.360 --> 00:20:09.720 Make sure that you've got some way of seeing everything that that agent is does. s205 00:20:09.720 --> 00:20:17.160 It's okay to go slow so that you can think about your architecture, know what your infrastructure actually needs. s206 00:20:17.160 --> 00:20:20.080 My name is Michael Patterson, staff solutions engineer. s207 00:20:20.080 --> 00:20:24.360 Would love to talk to you guys about how you can securely develop with agents. s208 00:20:24.360 --> 00:20:26.800 Thank you for your time.