WEBVTT

NOTE Sentence-level transcript of https://www.youtube.com/watch?v=wCIYViPd4SU

NOTE One cue per sentence. Cue ids are the line anchors on /transcripts/wCIYViPd4SU.html. A cue ends where the next begins, or 2 s after its last word.

s1
00:00:01.309 --> 00:00:03.309
[music]

s2
00:00:13.280 --> 00:00:13.599
Great.

s3
00:00:13.599 --> 00:00:15.040
Thanks everyone for coming.

s4
00:00:15.040 --> 00:00:16.800
Uh this talk is called Tethered.

s5
00:00:16.800 --> 00:00:18.000
Our agents are us.

s6
00:00:18.000 --> 00:00:23.199
I'm Shu Fang from Two Sigma and let's get started.

s7
00:00:23.199 --> 00:00:26.000
So just a quick explanation.

s8
00:00:26.000 --> 00:00:27.920
Two Sigma is a little quant fund.

s9
00:00:27.920 --> 00:00:41.600
I will also take the opportunity to explain that the name ostensibly is not because we have two co-founders who are very online but because the two sigas are about the volatility sigma the small

s10
00:00:41.600 --> 00:00:43.680
sigma and the large sigma sum.

s11
00:00:43.680 --> 00:00:52.239
So by summing together these individual volatilities we can uh hedge the risk achieve differentiated alpha.

s12
00:00:52.559 --> 00:00:56.879
Now because we are a hedge fund I have to give you all this important legal disclaimer.

s13
00:00:56.879 --> 00:00:57.760
You don't have to read it.

s14
00:00:57.760 --> 00:00:59.280
It just has to be in this.

s15
00:00:59.280 --> 00:01:03.120
And the TLDDR is that I'm not trying to sell you on anything.

s16
00:01:03.120 --> 00:01:06.479
The views are mine and not necessarily the companies.

s17
00:01:06.479 --> 00:01:13.360
Any logos, any other companies I mentioned here are not me endorsing them or telling you to buy their stocks or anything.

s18
00:01:13.360 --> 00:01:16.880
It is purely maybe coincidental.

s19
00:01:17.840 --> 00:01:22.880
But that also is meant to segue into the fact that we are an old company.

s20
00:01:22.880 --> 00:01:34.560
We're 25 years old and clearly we're a very regulated industry, but we've managed to run an ecosystem where everyone at the company has a cloud agent.

s21
00:01:34.560 --> 00:01:37.920
And not only that, but these agents run as their own identity.

s22
00:01:37.920 --> 00:01:43.119
So, we're going to explain how we got here and why we're actually okay with this.

s23
00:01:44.000 --> 00:01:46.560
So, we're first going to do a little horror movie review.

s24
00:01:46.560 --> 00:01:49.360
If any of you have seen us, you don't have to pay attention to this.

s25
00:01:49.360 --> 00:02:05.759
defend if you haven't the TLDDR of the movie is that everyone has these doubles and these doubles are called tethered when the doubles decide to run loose and cause chaos and run around with these golden scissors they're called untetered

s26
00:02:05.759 --> 00:02:18.480
and this is going to somehow relate into my talk so back in June 2025 you know cloud code GA and all that stuff people started using agents through the local

s27
00:02:18.480 --> 00:02:30.000
computer your local machine and it's very powerful but one it was CLI constrained and two it was localized right we wanted to achieve a world where people could use these agents

s28
00:02:30.000 --> 00:02:41.760
from wherever they were whether it be mobile through slack through browsers but still have the ability to run them remote and this is important not just because of the capability

s29
00:02:41.760 --> 00:02:54.879
but many many people technical or not are not comfortable fully operating within a CLI so the question became Okay, how do we actually run these in terms of what identity they run as?

s30
00:02:55.440 --> 00:03:02.080
The conventional wisdom is that you run these as some machine identity that is attached to your user in some way.

s31
00:03:02.080 --> 00:03:05.040
You have a shoe and you have a shoe agent.

s32
00:03:05.040 --> 00:03:10.800
But this quickly collapses and we found this collapsed because of all the reasons that you can imagine, right?

s33
00:03:10.800 --> 00:03:12.879
It's very hard to keep permissions in sync.

s34
00:03:12.879 --> 00:03:17.360
Anytime you're dealing with software licensing, now you have to deal with two licenses.

s35
00:03:17.360 --> 00:03:23.280
uh there's certain systems that do not support multiple identities interacting with the same underlying data.

s36
00:03:23.280 --> 00:03:31.360
You know, stuff like Google Workspace, your emails, etc. And then how some systems are going to block as a first step.

s37
00:03:31.360 --> 00:03:34.560
So you have to you're just going over the barrier of entry.

s38
00:03:34.560 --> 00:03:40.799
And then you also have to figure out how you actually manage the public and private boundaries.

s39
00:03:41.680 --> 00:03:45.040
So obviously it's like why don't we just run these as the user, right?

s40
00:03:45.040 --> 00:03:49.760
How do how do we run these remotely as the exact same user identity?

s41
00:03:49.760 --> 00:03:58.239
And as a result, all the capabilities, all the access, all those previous constraints are no longer valid.

s42
00:03:59.760 --> 00:04:03.439
And we already had the info for this and I imagine a lot of you do too.

s43
00:04:03.439 --> 00:04:10.879
If you don't, I would uh encourage investing in it, which is that you know you could have a Kubernetes cluster.

s44
00:04:10.879 --> 00:04:16.880
You have all all of your clusters, your regions, etc. And you have name spaces for individuals, right?

s45
00:04:16.880 --> 00:04:27.759
And the reason we had this is because we often already needed this capability not for the agentic purposes, but for all the automated operations that we need to do that did not

s46
00:04:27.759 --> 00:04:30.160
suit confinement to someone's local machine.

s47
00:04:30.160 --> 00:04:43.919
So we'd run automated jobs, you know, code containers usually operate on this principle, research notebooks, etc. And every single user already had these namespaces existing in every single region and everything in it runs as the user.

s48
00:04:43.919 --> 00:04:46.320
A very simplistic way of how this works.

s49
00:04:46.320 --> 00:04:53.360
Some trigger is going in to your controller and it's saying, "Hey, I need to spin up some compute resources.

s50
00:04:53.360 --> 00:05:06.320
You have a separate identity service that a sidecar in the pod pulls down from to allow your actual containers to run and mount that identity and it runs as you.

s51
00:05:07.280 --> 00:05:14.080
So of course there are big dangers with this right and you know the first danger you may imagine is an internal danger.

s52
00:05:14.080 --> 00:05:19.440
How do you actually differentiate who or what took action right?

s53
00:05:19.440 --> 00:05:23.120
You have you and your U agent are now the exact same identity.

s54
00:05:23.120 --> 00:05:26.639
That's why I grew this mustache so you could tell the difference between us for now.

s55
00:05:26.639 --> 00:05:33.039
But uh you really want to know that differentiation because certain actions that can be taken.

s56
00:05:33.039 --> 00:05:39.680
You want to audit, you possibly want to block and you want to just have the trace, right?

s57
00:05:39.680 --> 00:05:51.520
You want to have the attribution to determine, hey, was it someone operating as the human operating purely human actions or was it the agent identity doing these things?

s58
00:05:53.680 --> 00:06:03.759
Another danger and perhaps a bigger one is we all know that for all of these capabilities and LOMs in general, it's essential you have access to the external web.

s59
00:06:03.759 --> 00:06:09.759
These are point in time mathematical functions that cannot actually update based on current data.

s60
00:06:09.759 --> 00:06:11.440
So it's like open internet access.

s61
00:06:11.440 --> 00:06:15.520
That's why it's a core capability, web search, web fetch tools, right?

s62
00:06:15.520 --> 00:06:21.759
The problem is once you have that capability, you leave yourself open to huge vulnerability vectors.

s63
00:06:21.759 --> 00:06:24.479
One of which is exfiltration risk.

s64
00:06:24.479 --> 00:06:31.199
This is one we are deeply concerned with in terms of possibly losing IP, you know, just exposing our sensitive information.

s65
00:06:31.199 --> 00:06:47.680
but also certainly the possibility of untrusted content flowing back in and you know prompt injection just malware and vulnerabilities are all big risks there and then something we separately deal with is just the ability to make sure we don't

s66
00:06:47.680 --> 00:07:01.440
u use licensed content without the right copyrights or actual licensing right you can map this to the golden scissors that they use and us so this is kind of our biggest fear to be honest

s67
00:07:01.599 --> 00:07:08.880
So we are a finance firm and in finance there's a concept of obviously risk and return.

s68
00:07:08.880 --> 00:07:20.240
So when we think about what is the positioning on the risk and return graph there's huge value in allowing agents to run you but also there's very high risk.

s69
00:07:20.240 --> 00:07:26.080
What we generally want to do is make sure we capture as much of the value as possible but reduce the risk.

s70
00:07:26.080 --> 00:07:29.039
We're optimizing that ratio of return over risk.

s71
00:07:29.039 --> 00:07:31.440
Some of you may know the sharp ratio.

s72
00:07:31.440 --> 00:07:38.479
We're looking at that from the perspective of how do we let agents run as users and optimize that return.

s73
00:07:38.479 --> 00:07:42.400
And the ways we need to do this, right, are to solve those two critical problems.

s74
00:07:42.400 --> 00:07:47.599
One, differentiating access attributed to the human versus the agent.

s75
00:07:47.599 --> 00:07:52.880
And two, somehow getting safe web access in place.

s76
00:07:54.400 --> 00:07:58.879
So the first thing we did is this attribution step, right?

s77
00:07:58.879 --> 00:08:06.879
And how we did this is we use a header and we make sure that every single agent continues to append to that header.

s78
00:08:06.879 --> 00:08:11.759
And this is something we've all hopefully done in some way, right?

s79
00:08:11.759 --> 00:08:12.560
Trace IDs.

s80
00:08:12.560 --> 00:08:14.800
You've you've all done this in deterministic code.

s81
00:08:14.800 --> 00:08:20.560
Making sure that your observability stack propagates through a trace ID through disparate systems.

s82
00:08:20.560 --> 00:08:32.320
How we did it is very similar to how you would do it for trace ID except we are dealing with a certain difference in the control vector which is the agent itself right and

s83
00:08:32.320 --> 00:08:46.000
you can force you know using certain HP clients using MCPS using skills to make sure that that header initially gets populated and everywhere else along the way continues to be populated right you have a lot more deterministic

s84
00:08:46.000 --> 00:08:55.760
control over agents and the harnesses and the frameworks than you may ink and you can enforce it with some of the already existing primitives.

s85
00:08:56.720 --> 00:09:10.160
Now this gets very interesting because this is not only giving us the proper identification of who did something right it actually goes beyond that and no longer are we confined by

s86
00:09:10.160 --> 00:09:24.959
just knowing the act identity but we also actually get the full provenence through the system right as we deal with multiple steps in the system we are able to replay the entire chain of actions that actually led to some end result.

s87
00:09:24.959 --> 00:09:36.160
So the comparison here is if we had used that shoe agent identity we wouldn't have this and we would just know that at some point shoe agent triggered this initial flow

s88
00:09:36.160 --> 00:09:49.440
into the span but we don't actually know hey those subsequent actions how do we properly trace back to that origination point with this header this trace ID we get that full propagation

s89
00:09:49.440 --> 00:09:59.839
and the actor is still me right it's still my identity And the second step that we needed to fix is this web access.

s90
00:09:59.839 --> 00:10:00.560
Right?

s91
00:10:00.560 --> 00:10:06.160
A lot of web access these days uses indexes for search.

s92
00:10:06.160 --> 00:10:06.320
Right?

s93
00:10:06.320 --> 00:10:11.440
I think cloud code's native one is Brave web browser and it uses a Brave index.

s94
00:10:11.440 --> 00:10:14.959
Well, we were like, hey, why don't we see what Google has, right?

s95
00:10:14.959 --> 00:10:21.600
Google is at its core hopefully still a search company and they do this index generation already.

s96
00:10:21.600 --> 00:10:35.519
And it turns out they actually do offer something specifically for regulated industries like ours that allows you to use their web index but within your existing VPC your you know network controls right and it's called

s97
00:10:35.519 --> 00:10:37.279
web grounding for enterprise.

s98
00:10:37.279 --> 00:10:48.240
It basically works like this where it's still within the exact same network boundary where you're probably running your cloud agents and stuff like that and offers two core capabilities

s99
00:10:48.240 --> 00:10:50.000
search and fetch.

s100
00:10:50.000 --> 00:10:50.240
Right?

s101
00:10:50.240 --> 00:10:53.839
So the exact capabilities we want to mirror, we leverage that.

s102
00:10:53.839 --> 00:10:55.360
We have all these guarantees.

s103
00:10:55.360 --> 00:11:02.079
There's one tiny downside, which is the data is obviously not going to be completely fresh, right?

s104
00:11:02.079 --> 00:11:07.360
And the constraints around this last I checked, it's fresh within 24 hours.

s105
00:11:07.360 --> 00:11:10.560
And for more regularly updated websites, it's fresh within 6 hours.

s106
00:11:10.560 --> 00:11:20.480
But for most use cases that you may have for agents, that's probably more than sufficient and completely removes this external egress vulnerability vector.

s107
00:11:21.440 --> 00:11:33.440
Now the second question is how do we actually ensure the agents use web grounding and again this is very simple with the existing primitives right you just need to make sure that they don't get confused

s108
00:11:33.440 --> 00:11:49.920
and you certainly block the access itself but just for user experience and stuff like that you need to make sure those tools themselves that are already existing and primitive and native to these agent harnesses and frameworks and such are actually blocked right again here's cloud code example.

s109
00:11:49.920 --> 00:11:52.000
I think every other hotness has the same thing.

s110
00:11:52.000 --> 00:11:53.440
Web search, web fetch.

s111
00:11:53.440 --> 00:11:54.640
We just deny those tools.

s112
00:11:54.640 --> 00:11:55.920
It's like, hey, you can't even use these.

s113
00:11:55.920 --> 00:12:00.000
These are not even in your suite of tools available to you.

s114
00:12:00.000 --> 00:12:13.440
Instead, we use the redirection going through, you know, MCP CLI and actual client code using the supported paths, uh, skills, whatever to make sure that whenever someone does need the capabilities of web access,

s115
00:12:13.440 --> 00:12:17.440
it goes through that web grounding cache index.

s116
00:12:21.279 --> 00:12:38.880
So takeaways from this talk basically make sure you ted your agents right letting them run around untetered you know is very dangerous we want to tar them and it's much safer to do so and in fact if we go back to that initial slide of how we consider this relative to the risk and expected return

s117
00:12:38.880 --> 00:12:49.839
because of some of the things we found while doing this we actually believe we didn't lose expected value while huge hugely reducing the risk, right?

s118
00:12:49.839 --> 00:13:01.920
So, the index certainly lags, but we get a ton more observability by just using that tagging primitive versus the actual uh just pure identity verification.

s119
00:13:03.920 --> 00:13:18.399
And I think this is [sighs and gasps] one thing people should really consider, especially people working at companies, enterprises, which is that there are a ton of things happening in the Genai landscape that are probably scary to us

s120
00:13:18.399 --> 00:13:24.880
that make your security teams really afraid that feel like, hey, they are too far on the frontier, right?

s121
00:13:24.880 --> 00:13:26.720
You you're like, I wouldn't run this locally.

s122
00:13:26.720 --> 00:13:32.399
I wouldn't run a open cloud agent on my local machine with full permissions, right?

s123
00:13:32.399 --> 00:13:38.480
There's all these horror stories and you know various anecdotes about why this is bad.

s124
00:13:38.480 --> 00:13:49.680
But in an enterprise again you can figure out how to leverage your enterprise resources to actually reduce those risk factors and get the real value out of the capabilities

s125
00:13:49.680 --> 00:13:53.440
and this is where you should be investing that time.

s126
00:13:54.800 --> 00:13:59.120
So what we ultimately shipped is this entire framework, right?

s127
00:13:59.120 --> 00:14:12.959
We have the ability to run cloud agents as user identities uh because of all of those guard rails and vectors we put in place and using different kind of

s128
00:14:12.959 --> 00:14:20.000
interface vectors to actually operate with them so that people who are not comfortable with CLIs can leverage them but certainly for other cases as well.

s129
00:14:20.000 --> 00:14:34.320
And as part of that, we made sure to ship out just a managed fleet of cloud, you know, whatever agents for every single user in this remote fashion that they can already interact with so that we can continue to deploy and improve

s130
00:14:34.320 --> 00:14:37.279
what is actually available to individual users.

s131
00:14:37.279 --> 00:14:50.639
But also the core capability itself of being able for every anyone at the company to deploy an agent that runs in the cloud remotely with their full identity is there and is something we are comfortable with.

s132
00:14:51.920 --> 00:14:56.000
So to finish up, uh, everything I talked about actually happened last year.

s133
00:14:56.000 --> 00:15:07.600
So if you are interested at all in wanting to build and see what we're working on now, or even better, if you're like, that was horrible, we could do so much better.

s134
00:15:07.600 --> 00:15:10.320
We are hiring and we encourage you to apply.

s135
00:15:10.320 --> 00:15:17.360
If you have any experience in any of these domains, you can check that QR code, check that link.

s136
00:15:17.360 --> 00:15:19.279
Yeah, that's it.

s137
00:15:19.279 --> 00:15:20.940
Any questions?

s138
00:15:20.940 --> 00:15:22.940
[applause]

s139
00:15:26.240 --> 00:15:32.240
What do you think about local connected to agents for enterprises?

s140
00:15:32.320 --> 00:15:38.320
Uh, not the views of my company, but personally I I think that is

s141
00:15:38.320 --> 00:15:39.120
question.

s142
00:15:39.120 --> 00:15:39.680
Yeah, sorry.

s143
00:15:39.680 --> 00:15:44.240
His question was how do how do I view local LLMs for enterprise usage?

s144
00:15:44.240 --> 00:15:56.320
And I think local in the sense that we manage ourselves is probably where we eventually want to go for a lot of our token use and inference because of cost because of deprecations

s145
00:15:56.320 --> 00:16:01.360
because of you know every time Frontier Lab drops a new model you see some degradation.

s146
00:16:01.360 --> 00:16:12.000
It's just there's too much volatility in that that we don't need to risk as the openweight models kind of become more advanced and sophisticated.

s147
00:16:22.959 --> 00:16:24.959
request.

s148
00:16:31.920 --> 00:16:32.160
Yeah.

s149
00:16:32.160 --> 00:16:36.959
So as you can see the header is not purely differentiating in itself.

s150
00:16:36.959 --> 00:16:42.560
Someone someone could certainly populate that, but the actor the identity itself will not be me, right?

s151
00:16:42.560 --> 00:16:54.800
So some someone could I guess write in that they're using some agent, but the core previous identity itself is not mimickable, not like actually interceptable, right?

s152
00:16:54.800 --> 00:17:04.079
So we still we have both we have both the originating identity and that you know all of your identity ecosystems and chains to ensure that but also the header.

s153
00:17:04.079 --> 00:17:05.520
part of the header.

s154
00:17:05.520 --> 00:17:06.799
Yeah, that that that is separate.

s155
00:17:06.799 --> 00:17:16.000
The header is just XSLm agent and then you still have some way you you need some way to actually determine the identity of who's coming.

s156
00:17:26.559 --> 00:17:44.559
Yeah, I you know gen generally all of our RPC in some way has an initial entry point that is like populatable with that header and then once it actually goes downstream you know you make sure that same with trace ids is part of the span internally within the So

s157
00:17:45.039 --> 00:17:52.000
can you clarify how the use of Google index addresses the prompt injection issue?

s158
00:17:52.000 --> 00:17:52.320
Yeah.

s159
00:17:52.320 --> 00:18:01.600
So the core things about this index is not only is it a cached index, it is it has a lot of other controls and safety guarantees around it.

s160
00:18:01.600 --> 00:18:07.120
It is specifically made for these curated financial like um highly regulated industries.

s161
00:18:07.120 --> 00:18:10.960
So they themselves are doing some of their own curation on top of it.

s162
00:18:10.960 --> 00:18:13.679
Now certainly I think that creation could fail.

s163
00:18:13.679 --> 00:18:22.640
It's probably done using Gen AI but the prompt injection risk is much far reduced because everything still remains internal.

s164
00:18:24.960 --> 00:18:26.960
Yep.

s165
00:18:33.679 --> 00:18:37.039
Do you mean how they're being used?

s166
00:18:38.400 --> 00:18:38.640
Yeah.

s167
00:18:38.640 --> 00:18:50.080
I I think it's critical um in the sense that that behavioral data is something we can further configure based on right like that we we do try to ensure that not everyone

s168
00:18:50.080 --> 00:18:58.240
at the firm can see what your agents are doing right like there's stuff certainly work-wise but also more sensitive information that might be privileged to you.

s169
00:18:58.240 --> 00:19:00.400
So your session data is kind of localized.

s170
00:19:00.400 --> 00:19:09.840
Now that behavioral data in the session data is very powerful because it can define additional configuration that can be applied to these agents for the purposes of making the user experience better.

s171
00:19:09.840 --> 00:19:24.720
So we we try to leverage that to figure out what to configure further not just based on someone's like hierarchical persona but actually based on their usage to make sure that their experience continues to improve actually based on what they're doing.

s172
00:19:26.640 --> 00:19:28.960
Uh we're almost out of time.

s173
00:19:28.960 --> 00:19:38.880
me and my co sorry I'll take the last question you're saying you have a process for letting individuals create their own

s174
00:19:38.880 --> 00:19:53.760
yep I mean how do you go about like anybody there is a process for like agents across the company

s175
00:19:54.799 --> 00:20:00.400
yeah uh for building our own agents you know we we use some of the existing frameworks for agent building.

s176
00:20:00.400 --> 00:20:04.559
Obviously all the genai harnesses are very good at using those frameworks to build agents.

s177
00:20:04.559 --> 00:20:07.280
So you have a lot of agents proliferating based on that.

s178
00:20:07.280 --> 00:20:09.679
In terms of provision, everything is already provision.

s179
00:20:09.679 --> 00:20:15.679
All this is every single user at the firm has all the necessary infrastructure in place.

s180
00:20:15.679 --> 00:20:17.120
So that's not really a worry.

s181
00:20:17.120 --> 00:20:21.600
They can build an agent, deploy it as necessary into their namespace running as their identity.

s182
00:20:21.600 --> 00:20:38.240
the the aspect of how do agents then become like a universal companywide or larger beyond a individual users uh agent you know goes through your standard kind of mechanisms right like hey is there going to be proper production support is there the right security

s183
00:20:38.240 --> 00:20:51.719
it's like any application you might develop uh yeah so me and my colleagues will stick around here if anyone wants to talk further you know I guess if you're sticking around I can also take more questions but thanks for coming to this

s184
00:20:51.719 --> 00:20:53.719
[applause]