Latest / AI for Founders with Ryan Estes / Do you know where your AI agents are?

Transcript

Do you know where your AI agents are? · AI for Founders with Ryan Estes

0:00
Your AI agents are out there right now touching your customer
0:03
data, your financials, your emails, and you have 0 idea what
0:06
they're doing with it. Most founders are one stolen API
0:09
token away from a bankruptcy Reddit post.
0:12
It happened to someone last week and the worst part is they never
0:15
saw it coming because they were too busy moving fast to look
0:18
down at the Cliff they were running towards.
0:20
Now your AI agent has a memory. That memory has no permission
0:23
system, so when your analyst asks it a question it might
0:27
answer with residue from the CEO's private emails still
0:30
floating in its context window. No breach required, no hacker
0:34
needed. Just an agent doing exactly what
0:36
it was built to do. But what if you could wrap every
0:39
single agent you run in a security layer so tight that
0:42
even someone stole your credentials?
0:44
Those credentials physically cannot leave your machine.
0:47
What if every token, every session, every tool call had a
0:50
guardian watching it in real time like a hound at the gates?
0:54
Here's the question I want you to sit with If your AI agents
0:57
got subpoenaed tomorrow, could you actually account for
0:59
everything they have touched, read and sent on your behalf?
1:03
Welcome to AI for founders. I'm Ryan Estes.
1:05
My guest today is Jason Casey, CEO of beyond Identity, and he's
1:10
pulling back the curtain on Ceros, a free trust execution
1:14
layer for AI agents that every founder running Claude Code or
1:17
any agentic workflow needs to know about right now.
1:21
This one is for builders moving fast who refuse to get burned.
1:24
And the AI for foundersnewsletter@aiforfounders.co
1:28
is where I break down exactly what founders need to know
1:31
before they build it, pitch it, or ship it.
1:33
If you're not subscribed, your competitors probably ours.
1:36
So go get smarter at AI for founders.co.
1:39
And if this episode made you think twice about your AI set
1:41
up, a five star review would mean the world and keeps these
1:44
conversations coming to you every week.
1:47
Speaking of getting in front of the right people, if you're a
1:49
founder, operator or investor who wants to build serious
1:52
authority through podcasting, Kick caster.com is the agency
1:56
that gets you booked on the shows your audience is already
1:59
listening to. They handle the outreach, the
2:01
positioning, the pitching, all of it.
2:03
So you just show up and deliver. Go check them out at
2:05
kickcaster.com. That's kick Caster by MO Burst.
2:10
Jason, welcome back to the show. Thanks so much for joining me.
2:14
Thanks for having me. Good to be back.
2:15
You bet. Now people, if they want to get
2:18
a deep dive now, first of all, Jason is head honcho over at
2:22
Beyond Identity that's beyond identity.com.
2:24
We're going to talk about Beyond Identity dot AI and we had an
2:28
interview previously a couple of months ago that kind of took a
2:32
deep dive into kind of the the core of Beyond Identity's
2:36
platform, which is identity defense, basically getting rid
2:40
of passwords so you can have higher accuracy with
2:44
authentication. But you're back today to talk
2:47
about a really important subject and a new product launch for you
2:50
guys called Cerro. Why don't you give us a, a kind
2:53
of a high level view of this new product and congratulations.
2:59
Thanks. So yeah, the, so Cerro's
3:02
project, it's a, it's a play on words of Ceribus, but Cerro's is
3:06
available from a domain perspective and Cerro's is
3:11
really our response to non human identity.
3:15
And the first use case is AI assistance.
3:19
So we take a step back. Every organization right now is
3:23
faced with a dilemma and they're whether they're putting it on
3:26
themselves or it's being put on them by their board or their
3:29
investors. And that dilemma is the world
3:32
has changed. AI is now here, it changes
3:35
everything. What are you doing about it?
3:37
How are you becoming more efficient?
3:38
How are you leveraging AI in your organization to be AI
3:41
native, right? So like gone are the days of
3:44
digital transformation and now we're talking about AI
3:47
transformation and there's various milestones of AI
3:50
transformation, right? Like did you turn on AI and in
3:54
the entire like tech stack that your business already uses and
3:57
then you've called yourself AI enabled.
3:59
Clearly that's superficial. Clearly that's not what we're
4:01
talking about. Or have you really kind of ask
4:04
the fundamental questions of why is my business organized the way
4:07
it is? What are the assumptions around
4:09
my business's organization and processes rooted in in the
4:14
expectation that a human has to do all of this work and a human
4:16
has a certain cost and a human has to work in a certain way?
4:20
AI native means you question all of these foundations and you're
4:24
able to kind of realize that some of them can be given up and
4:28
that you can actually change your business architecture and
4:31
you can simplify or, or really restructure how you operate and,
4:37
and, and AI enables it. So that's kind of like the
4:40
positive. That's the benefit, right?
4:41
I can run fast, I can do things I didn't have to do before.
4:44
I I need less capital, etcetera, etcetera.
4:48
Now, the dark side of this is when you look at how an agent
4:53
works, when you look at when an agent is doing its best, what
4:57
you have to give it, it's no different really than an
5:01
employee or a contractor. You have to give it access to
5:04
systems and services. You have to some of these
5:06
systems and services require secrets and credentials.
5:10
You have to give it access to customer data.
5:14
You have to give it access to financial data if you want the
5:17
benefit for that part of the business.
5:20
And and then unlike a human right, like you can't really
5:26
train the AI. You can maybe steer it a little
5:28
bit, but you know, training is decided for you by the big model
5:31
providers. And, and so, yeah, there's a lot
5:35
of security concerns that you've got to kind of navigate there.
5:38
And at the at the zoom out, we see big companies kind of doing
5:42
one or two things, either hitting the pause button and
5:46
saying, stop, let's figure this out will only allow it to be
5:51
used in exceptional circumstances with, with very
5:53
limited risks and scope. Or the other end of the
5:57
spectrum, which is this is the way of the future.
6:01
You guys just let me know when you're going to figure out how
6:04
to deal with it. But we're going to risk accept
6:06
this for now and just run real fast because if we don't, we're
6:09
going to get beat by this other company.
6:11
Ceros is our response to that fundamentally insolvable
6:16
dilemma, right? Like a business can't operate at
6:18
those two barbells. Those are kind of two extremes.
6:21
Ceros is our answer of how do you actually run as fast as you
6:25
can? How do you truly transform your
6:27
business to be I native while not blindly accepting the
6:31
security risk that this agent will bring into your
6:34
environment. So Ceros is what we call a trust
6:37
execution layer for the agent. It gives the agent an identity.
6:41
It clues that identity to the device that agent executes from.
6:45
It tracks the provenance and the delegated authorization of that
6:48
agent from a human user or or from another agent that spun it
6:52
up. It does a bunch of other things
6:55
as well. But for the organization that
6:58
uses seros, at a bare minimum you get 2 things, visibility and
7:03
what's going on into your environment with the with the
7:05
same kind of beyond identity guarantee we talked about last
7:07
time. Credentials don't move.
7:09
So there will be no beyond identity managed credentials
7:12
that the agent through inaction or coercion can leak steel,
7:18
exfil, etcetera or you can use some of the more advanced
7:22
features of Ceros and actually put policy around what's
7:25
actually going on in your environment.
7:27
So I just put a lot out there. Let me stop real quick and let
7:29
you respond. You bet.
7:32
I love it and it's very relevant to what's going on right now.
7:35
It reminds me of the commercial in the 90s where it would say,
7:40
do you know where your children are right now?
7:43
Kind of acting, asking the same thing.
7:44
Do you know where your AI agents are right now?
7:47
And the answer is largely no, you know.
7:50
You know what they're doing. Yeah.
7:52
What are they doing right now? So, you know, I think a lot of
7:55
people companies are coming to this conclusion of kind of the
7:59
the risk they've been taking maybe the last 12 months with AI
8:02
within their organization. And I think you probably have a
8:05
great seat of what some of this is because it's not being
8:07
disclosed. Obviously if you have a bunch of
8:09
big oops, you're just going to kind of keep that under wraps,
8:11
but you see it happening. So I would say timeline wise,
8:15
probably about a year ago is when companies started being
8:17
like, OK, we're getting open AI subscriptions for everybody on
8:21
the team and we need to figure out how we're going to leverage
8:24
AI to create unfair advantages. And so, you know, people start
8:28
like dumping financial data onto into open AI servers.
8:33
They're they're, you know, God only knows what kind of IP went
8:36
on to there. So maybe you could get us some
8:38
like nightmare scenarios of truly kind of the risk that is
8:42
involved with just like let's say using the big LLLLMS
8:46
unrestrictedly. Yeah.
8:49
So a couple things, right? Like #1 when you use LLM, there
8:55
is some specific set up that you need to go through that
8:57
authorizes the LLM to essentially train on your data
9:00
or not, right? So number one, you really don't
9:02
want them training on your proprietary data.
9:04
So we've certainly seen people do everything that you just said
9:08
in the unmanaged instance, right?
9:10
Just lock, stop and barrel. So the implication there is
9:15
future models might actually be able to regurgitate some of that
9:18
data as it gets trained on, right?
9:19
No different than I'm sure you, I'm sure you and your listeners
9:23
have have heard of these scenarios where pick pick a
9:28
Harry Potter book, open it to a random page, drop 10 words from
9:33
a sentence into ChatGPT or anthropic and it will finish the
9:38
chapter for you. Right?
9:40
And this just has to do I I think the study found something
9:43
like a 70 to 80% reproduction rate of the Harry Potter novels.
9:47
And, and again, like it's they're the the novels are lock
9:52
stop copied in the model, but the models do train against
9:57
these the source material in a way to be able to kind of
10:01
reproduce them in a, in a fairly effective way.
10:04
You don't want that to happen to your information, right.
10:07
So that's, that's kind of the the simple one more interesting
10:09
one, and this one's made the round.
10:11
So they probably heard about this is the the agent has access
10:19
to a data store and the authorization levels and the
10:24
scoping of what's in that data store is not actually threaded
10:28
through the agent model, right? So let's say somebody, an
10:33
analyst makes a query for something and that agent has
10:38
essentially a residue in its context window leftover from
10:42
some analysis it was doing on the CE OS e-mail.
10:46
And so the contents of that CE OS e-mail, which were a residue
10:49
in the context window, basically, or then, yeah, the LO
10:51
Ms. gonna happily reuse it, right?
10:53
And and push it back into the response.
10:56
So the, the, what's happening there is this concept of data
11:01
permissions and threading, right?
11:04
So a, so these agents work with a context.
11:06
A context is, is kind of like a memory, but not exactly.
11:10
We, we push stuff into the context until we reach the
11:13
limits of the context. When we reach the limits of the
11:15
context, then we do a little bit of spring cleaning, right?
11:17
What do we not wear anymore? What do we still wear regularly?
11:19
Let's throw some of it away and what, what not?
11:24
There's no permissions in the context.
11:26
There's no ownership bits in the context.
11:29
There's no, there really is no concept of data versus
11:34
instructions in that context. So we've seen a lot of people
11:37
actually build out agents that don't quite recognize that and
11:43
essentially map data sources and, and kind of invocation
11:47
environments without really thinking through, you know,
11:52
it's, I don't know if you would still call it privilege
11:54
escalation, but kind of data access privilege escalation just
12:00
through either the agent not being smart enough to do it
12:03
initially or the agent not clearing its contacts or the
12:06
agent not doing per context based flushes on a per user
12:10
basis. Some other interesting things
12:14
that we've seen MCP tools and skills directories on GitHub,
12:23
basically hosting malicious prompts and doing indirect
12:27
injection through like a plug in load of of this malicious skill
12:31
or a tool like a malicious tool execution from an MCPX from like
12:35
a public MCP service. Some things that we haven't seen
12:40
that I, I, I suspect exist or will be coming soon are like
12:45
prompt assembly. So remember when I was talking
12:49
about that context window? You can assemble things over
12:51
time my exploit. Why?
12:53
Why not assemble the exploit over time, right?
12:57
Like if, if I understand enough about the agent in the looping
13:00
or if I understand enough about how memory is used to re persist
13:03
things in the context off of disk my, my, I don't have to
13:08
assemble my prompt in one go, right?
13:11
And then once I've assembled my prompt, my my adversarial
13:14
prompt, I could even potentially get it persisted like
13:18
persistence and kind of the classic malware model, right?
13:21
And I could potentially get it persisted and re brought into
13:25
the context on certain kind of context trigger words.
13:28
So I think these things are coming, the things that I think
13:33
are exciting, and this is kind of the stuff that we're starting
13:35
to kind of do some pioneering work on is actually tracking
13:39
risk at a context level. So every time your agent makes
13:42
an LLM call, you could think of that as a context loop or an or
13:45
an or a yeah, we think of it as a context loop, right?
13:49
It builds the context, it goes out it the LOM will give some
13:53
sort of summary information, maybe a set of tool call
13:55
executions. Every tool that the agent then
13:57
can execute against. It has an identity, it has a
13:59
Providence. It should be on a bill of
14:01
materials. In theory, it could have scopes
14:05
and authorizations attached to it, right?
14:08
So you could actually track that through the loop.
14:10
And so you could almost think of it like paint colors, right?
14:13
Like whenever you mix colors in the context, there's rules of
14:17
mixing and you know, maybe blue is red is risky and blue is safe
14:21
and certain types of mixings only go to red.
14:24
And when my context is red, maybe my permission shrink and
14:28
my tool execution list is much, much smaller than before.
14:31
And as my context gets flushed or or pruned, it goes blue again
14:35
and my permissions kind of come back.
14:37
So getting in more into like dynamic permission execution,
14:41
that's more of a defender's toolkit.
14:42
But yeah, we we see a lot of kind of exciting things like
14:46
that both on the adversary and the defender side.
14:50
This episode is brought to you by a dangerous idea.
14:53
It's called reading, specifically the AI for Founders
14:56
newsletter. 47,000 founders strong now.
15:00
And it's the good stuff. No top ten AI tools that will
15:03
change your life written by someone who doesn't ship
15:05
product. It's just real breakdowns of
15:07
what's actually working in AI, who's raised, who failed, who
15:11
pivoted, and which founders quietly built $1,000,000 in ARR
15:15
while everyone else was arguing on X.
15:18
It's written for people building with AI every week.
15:20
You get tactical frameworks, unfair advantages, breakdowns of
15:24
real companies, and the occasional existential question
15:27
about whether your startup is intelligent or just well
15:29
branded. It's free, it's sharp, it might
15:31
mildly offend your current workflow.
15:33
Go to aiforfounders.co and subscribe before your competitor
15:37
does, because the only thing worse than being replaced by AI
15:40
is being replaced by a founder who reads.
15:43
That's the newsletter at AI for founders.co.
15:45
Now back to the show. Yeah.
15:47
And that kind of customization has become critical, you know,
15:50
because I guess we're where we're at right now.
15:52
Well, I mean, you know, we last summer we started to have
15:54
agents, but we're we're like in the midst of like post open claw
15:58
and what that means, you know, to have looping to have agents
16:02
like out there running amok. And so really what I'm seeing
16:05
now is organizations are saying like, OK, we need to dial up a
16:08
giant MCP of absolutely everything, absolutely
16:12
everything. So there's context so which we
16:14
can build, you know, agents that aren't siloed by division or by
16:18
anything. So they're creating an MCP that
16:21
has everything, all the emails, all the, the note taker apps,
16:26
all the slacks, everything, everything's getting dumped into
16:29
here. So they can create these really
16:31
effective agents. And then what's going to happen
16:33
is as people are bringing those online, they're going to realize
16:36
that they just trained up a really valuable skill set, a
16:38
really valuable agent. So you're going to have a
16:41
marketplace, people will be like, hey, don't, don't do XYZ
16:45
for Google Calendar and Slack. We already have that.
16:48
We can build that in now. So it, and correct me if I'm
16:51
wrong, but it sounds like with Ceros, you'll be able to have
16:53
kind of a customization in the marketplace where you can design
16:57
and build agents with a trust layer built in that's fully
17:00
customizable to the scope of what you want.
17:02
And not only that, but as you're kind of purchasing agents in a,
17:06
in a marketplace, you can also maybe scan to see if there is
17:09
that malware, because that's, that's a big apprehension right
17:12
now for people to dive into open claw at all is like, boy, it
17:15
seems like there's a big gamble there.
17:18
Yeah, Ceros. It's the high level of Ceros.
17:21
So Ceros lets you essentially execute an agent with a level of
17:25
safety, right? So you don't have to understand
17:28
all the bits and bytes of how that agent was built and how
17:30
it's going to work. If you wrap it with Ceros, Ceros
17:33
will contain it, Ceros will give you visibility and then Ceros
17:36
will let you set policy on what risks you're willing to accept
17:41
or not. Right.
17:44
That so that's kind of Ceros at a high level.
17:47
But yeah, it's a, it's an interesting phenomenon, right?
17:49
The agents are incredibly powerful and and we're we're in
17:55
that phase right now of here. Not just all the things that it
18:00
can do, but it can tear down a lot of these walls.
18:03
Like you were saying, look, you don't need Google Calendar, you
18:06
don't need this, you don't need that.
18:08
You know, there's another interesting way of looking at
18:10
it. Imagine you're going to strike
18:11
off and start your, your company today, right?
18:13
New company today. An interesting thought
18:16
experiment. Let's say the only thing you're
18:19
you you buy to start with is a subscription to GitHub, a
18:24
subscription to Claude code and maybe Google workspace, right?
18:29
Because you still need e-mail, right?
18:32
Why do you need anything else, right?
18:38
Because like, and I'm, and I'm sure maybe not everyone did the
18:41
same journey. So I'll explain a little bit.
18:42
But like, as you, as you mature and learn how to use an AI
18:45
agent, right, you always start with prompting the agent with
18:48
discovery. Then you move into getting the
18:50
agent to do things for you. Then you start to realize that
18:53
the when, when you're just prompting the agent to do things
18:55
for you, the, the responses can be varied.
18:58
They're not necessarily consistent.
18:59
They're not necessarily complete with respect to all the things
19:02
you want it to enumerate over. And so that you then realize,
19:05
all right, I'm in a slightly different pattern.
19:07
I want an agent to build essentially a skill which is a
19:11
combination of like deterministic scripts that
19:16
always do exactly what you say and always enumerate everything
19:19
and probabilistic prompting that wraps and pipelines those
19:23
scripts together, right. So it's kind of like the natural
19:25
phase of evolution. And, and as you start to do
19:28
this, you start to realize that like, all right, the power of my
19:33
organization is, is really about how much of my data I can get to
19:38
this agent. And, and then everyone will say,
19:41
well, I wonder if I can kind of reach into my database XI wonder
19:45
if I can reach into Salesforce. I wonder if I can reach into
19:47
that. But then the second thing you
19:48
realize, especially if you're starting from scratch, is like,
19:51
why? Why do I even need that to start
19:53
with? I have a repo.
19:54
Git does a great job of telling me about files that have changed
19:58
over time. It does a great job of tracking
20:00
identity of those changes. It does a great job of telling
20:02
you about cryptographic Providence of each of those
20:06
changes. Right.
20:09
So yeah, why wouldn't I want my marketing and my product docs to
20:13
be in the get repo? Because then I could do things
20:15
like have a series of skills or sub agents that's always running
20:20
the consistency check between product marketing copy.
20:24
Product management, product spec, engineering spec and QA
20:28
spec, right? And then code reviews and like
20:30
just having it in a tight loop and always kind of coming out
20:33
and saying here are your errors and here are your omissions.
20:35
Here are your inconsistencies, right?
20:39
I could go on and on and on with this, but like that just opens a
20:43
completely different way I think of thinking about how you
20:46
organize a a company, a business.
20:49
Over here for a second, largely because it, we're, we're kind of
20:52
doing this anamorphic thing, you know, where it's like I have my
20:56
swarm of agents and I have the architect and I have the
21:00
marketing director and I have the data analysis.
21:03
So what we're doing is that we're giving them human
21:05
characteristics. And, and I, you've seen this
21:08
before in emerging technologies when like all the skew morphic
21:11
stuff was happening with the iPhone.
21:13
Like if you wanted to like have a potentiometer, it looked like
21:16
a knob because it's familiar to us.
21:18
And then slowly, like that kind of dissipates, like just when
21:21
we're talking about the advancement of where AI agents
21:24
are going, do you think they're like, can it kind of humanizing
21:27
of them into roles is like limiting kind of the way we can
21:31
think about how they actually can work?
21:32
Because to your point, yeah, we build everything up and we kind
21:35
of want to give them positions. So there's kind of a checks and
21:38
balances also, just so it makes sense to my mental org chart.
21:42
But is there another way to do it?
21:44
Yeah. So I, I, I think so.
21:46
I, I suspect so. I'm only hedging because I still
21:49
think we're early, but we, we balance in the other direction.
21:53
So our documentation is actually more optimized for agent
21:56
ingestion than human ingestion. And that's purposeful.
22:00
So right, when we, when we think about the agentic workflow, you,
22:04
you, you're immediately confronted with the fact that an
22:06
agent will be able to, to bury you in paperwork, right?
22:09
Like an agent is like the big law firm that's coming after
22:12
you, they'll always be able to just bury you in tunes and tunes
22:14
of stuff you can't hope to keep up, right?
22:17
So what do you do? Well, I would say the knee jerk
22:20
reaction is I'm going to get an agent to manage my agent and
22:24
maybe that's appropriate in some circumstances, but not for this
22:26
particular problem. For this particular problem, you
22:29
have to think of it more of what is the lens that I can measure
22:35
the output of the agent through That could be deterministic and
22:41
not every problem fits that category, but a lot of them do.
22:44
And so we skew thinking not of agents as being representations
22:52
of humans, but we think of them more in terms of kind of
22:56
business functional outcomes, and we try and structure our
22:59
documentation in the repo to be optimal for their ingestion.
23:05
So to make that a little bit more specific, what is the
23:09
smallest markdown file in terms of not not consuming too much of
23:13
the context that sets enough of the constraints I need for this
23:18
particular agent to write great product marketing copy that
23:23
stays inside the guardrails of my product road map that but
23:28
that also mirrors the writing styles of of XY or Z depending
23:34
on the particular task, right? And I don't think I would have
23:39
necessarily written like a memo, an e-mail or something like that
23:45
to someone in marketing to do that, right?
23:47
But, but we all are for this agent that's basically helping
23:52
us refresh our copy. I'll give you, I'll give you
23:53
another example. I want I, I, I, I try and do a
24:00
lot of analysis on what people are talking about.
24:04
And the analysis that I try and do is like rate of change
24:07
analysis, like is a topic ascendant.
24:10
There is a topic on decline. And so I'm trying to figure out
24:14
how do I do this? How do I get this into the agent
24:17
itself in a deterministic way? And, and So what we ended up
24:21
doing is we had the agent build a browser plug in.
24:25
The browser plug in basically follows me on my morning
24:29
research when I'm kind of reading all of these things.
24:31
The browser plug in creates a Jason squirt or Jason BLOB of
24:35
the content of when I'm in research mode of any of these
24:39
particular things. And then the minute this shows
24:42
up on my machine, my agent has built already built a script
24:47
that basically processes this and then does analytics and uses
24:51
the agent for things like entity analysis, topic analysis,
24:55
sentiment, all of that kind of stuff.
24:57
And then it invokes a script, right?
24:59
So again, getting back to determinism to then figure out
25:02
things like rate of change, like it, are they talking about this
25:04
more this week than last week, this month and last week, are
25:07
they talking about it less? Can we use this as an indication
25:10
of shift and focus? So like, again, I, I don't think
25:15
I would have ever been successful asking a marketer to
25:17
go do that for me. I probably wouldn't have been a
25:20
great use of their time, but it, it was 2 hours of mucking around
25:24
with Claude and and now it's a, it's a functional pipeline and
25:28
it's a ton of documentation there, but it's not written for
25:31
me. It's written for Claude, you
25:33
know. Sting in the language that best
25:36
suits it, and then basically it's translating that back to
25:38
English to speak to you. Yeah.
25:42
Yeah, it's, it's it's fascinating because we're in the
25:45
infancy of what we're calling agents right now.
25:48
You know, I, I have my entire repos in a cloud code project
25:55
that are prioritized top to bottom that I have notes on.
25:58
And what I was working on is something very similar.
26:01
I want something that follows me across browser tabs as it's kind
26:03
of keeping tabs on my work and, and things like that to make
26:08
basically recommendations, predictive recommendations of
26:11
how what I'm using could be applied to the projects I'm
26:13
working on. Yeah, You know, I haven't had
26:17
much success, but I did have a recommendation on this game I'm
26:20
working on. Can I do a quick tangent and
26:21
tell you about this game I'm working on?
26:24
OK. Because largely when we're
26:25
talking about AI stuff, I I think it's valuable not to think
26:29
about it as an engineer, but rather a scientist, which is to
26:32
say, I want to have little experiments going so I can feel
26:35
my way around of like, dude, what's the limitations of what
26:37
what can be done here? And that will affect my work all
26:40
the way downstream. So anyway, I put together this
26:43
the game, and the game is basically you're in a Waymo car
26:46
and stuck in a Blizzard. And the Waymo can't drive
26:49
because all the senses are sensory cameras and stuff are
26:54
covered by the snow. What you don't know is, is that
26:56
the blizzard's never going to end.
26:58
This is an apocalyptic Blizzard. It's taking over mankind.
27:01
And so as this kind of slowly real realization happens that
27:06
then you have to start using whatever's in the car to fashion
27:09
tools, to go hunt, small game to do, to build shelter, to try and
27:13
build fire. And so it's building on it like
27:16
that eventually you have to leave the car.
27:18
And we're kind of getting into like what that's going to be.
27:20
So right now it's just kind of a a text based game, but I built a
27:27
browser basically to that reads kind of the articles I'm
27:31
interested in and then offers ideas of how it could affect the
27:34
plot. Because ultimately I want this
27:36
to kind of evolve into AI. Don't know some kind of post
27:40
apocalyptic weird war zone, but we'll get there.
27:43
And it's it's not great, but it was a good example of like kind
27:46
of thinking outside the box to see what exactly is possible
27:50
with with agents, as it's kind of like travelling with you and
27:53
your work. A lot of big, I think
27:57
productivity gains is going to come from, you know, the AI
28:01
observing your workflows and making recommendations of how to
28:03
tighten everything up, either by creating custom software or to
28:08
actually recommend software that already exists.
28:10
So, and, and we're not quite there yet, but, but right now
28:14
this is what, what I'm experimenting with my what my
28:17
friends are experimenting with and I I'd love and really why I
28:20
wanted to have a conversation with you is because I am the guy
28:23
with the repo and Claude code being like, what can we do now?
28:27
What I don't know when I'm sitting there in the terminal,
28:30
you know, cranking out code is like, what should I be worried
28:34
about right now? Like I could really use Ceros
28:36
because actually I don't know what I don't know as far as like
28:38
exactly what kind of exposure I'm, I'm walking into
28:44
blindfolded. So in in perspective of Ceros,
28:48
just kind of the UI, like if I'm before I'm preparing to get into
28:52
my projects or maybe I have an agent built, how do I integrate
28:55
Ceros into the project that I'm working on?
28:58
So it's that that part's actually super simple.
29:00
So if you go to beyond identity dot AI, there's a super simple
29:06
sign up to create a Ceros tenant.
29:09
And for personal use, we don't even charge.
29:11
You guys can just use it for free.
29:13
Ceros is an A little agent. So you install it actually just
29:17
like you install Claude, I believe, I believe it.
29:22
Basically it's just like a curl with a URL and then you pipe,
29:26
pipe, bash it. It will install locally.
29:30
It will update itself to kind of always stay latest and right now
29:35
you just type Ceros, space quad and then any quad parameters you
29:39
want and that's it. We will probably be pushing an
29:44
update soon to where we basically will install an alias,
29:49
so you won't even have to type Ceros if you have us installed.
29:51
Anytime you execute quad, we'll just be there.
29:54
So the whole idea with the quad agent is to not really get in
29:58
your way and to not change your workflow.
30:01
The Claude or the Ceros UI from an administrator perspective is
30:07
about showing you what agents are active, what they're doing.
30:12
So think of it, think of it like a set of tiered discovery.
30:15
So what agents, what AI agents exist, IE installed in my
30:19
environment? Of those installed agents, which
30:21
ones are actually have active sessions?
30:23
Of those active sessions, what ecosystem do they appear to be
30:26
using? Bedrock, Vertex, Anthropic,
30:29
NVIDIA O Llama, what kind of models, blah, blah blah.
30:33
Right now we're going very, very deep on clod code.
30:36
So if you actually dig into clod code, we're going to report on
30:41
essentially the clod code style assets.
30:43
So clod code style assets, Think of it as what is it, skills
30:48
plug, insurance hooks, MCP services, LSP, etcetera.
30:53
Permissions, I'm going to forget some, there's like 8, but all of
30:58
these represent surface area for security management, whether
31:03
it's exfil, prompt injection, over permissioning, etcetera.
31:08
And that's basically what we're going to eyeball and watch.
31:11
We also have a policy layer that lets you actually express.
31:17
You think it is like letting you paint your, your, your tolerance
31:20
to risk. Another way is just letting you
31:22
express what's allowable and what's not allowable in your
31:25
environment. And it basically would supersede
31:29
anything that you kind of hit yes, no, maybe on when you're
31:32
actually kind of, you know, doing the the old person casino
31:36
gamble exercise. So yeah, we're basically going
31:42
super deep on clawed code to start with.
31:44
We'll do the agent discovery for all the agents, but like the the
31:47
agent specific artifacts that I just walked through right now is
31:51
really focused on clawed code. OK.
31:54
So as I'm developing, I have Ceros installed.
31:58
It's gonna prevent me from making any mistakes that I
32:01
already outlined. What I don't want to happen,
32:04
that's safe to say. Yeah, also the other, I'm sorry.
32:09
Oh, go ahead, please. The, the, the other thing that
32:12
I, I almost forget to mention sometimes the the classic beyond
32:16
identity property of, of having a device bound attestation, a
32:19
device bound credential, continuous posture, continuous
32:22
authorization, basically a credential that never moves like
32:24
that's there as well. So if you're just running Claude
32:27
today, Anthropic gives you an API token.
32:30
And that API token, whether it's served up through Oauth or
32:33
whether it's served up from the API token interface, it's
32:36
stealable, right? You can copy it and paste it
32:38
elsewhere and use it elsewhere. So on what end?
32:42
Service theft on the other end, like misdirection, right?
32:45
Like get your token, start running nefarious content
32:47
through there, get Anthropic to flag you as a bad guy, shut your
32:50
service down. And then I kind of go do the
32:52
other thing I really want to do, right?
32:54
So when you're running Seros, that can't happen.
32:57
We firewall that Anthropic token essentially in our cloud
33:01
environment. The only thing that exists from
33:03
our cloud environment down to your endpoint where Claude is
33:06
running is our device bound credentials.
33:10
And it doesn't matter if we're talking about initial access or
33:13
kind of the session based identity and the session based
33:15
authentication. All of those are device bound.
33:18
And for the nerds in the audience, we're using something
33:21
called Depop for the session. And on the device bound stuff,
33:25
it's just, it's just our classic device bound credentials in the
33:27
TS, whatever the environment happens to be, anything from
33:30
Apple Secure Enclave to TPM 2 to AWS Nitro.
33:35
But yeah, so that those properties, which is kind of
33:38
like the Beyond Identity Foundation is, is there as well.
33:40
So you will not suffer credential theft, session
33:43
hijacking, anything like that if you're running Ceros from day 0.
33:47
Amazing. So that's to say that all the
33:49
API keys are stored safe locally on my machine.
33:53
Unless someone was actually here, you know, and I'm bound
33:56
and gagged in the closet, that's not gonna happen.
33:59
But the API keys aren't stored on your machine.
34:01
The API key in the cloud. That's right.
34:04
Yeah, the API keys are in the cloud.
34:06
The only thing in your machine are keys that physically can't
34:08
come off your machine. Yeah, right.
34:11
So remember that, that that trusted execution environment,
34:14
quick mental image. Imagine a jail and there's a
34:17
there's a notary in the jail, right?
34:19
Monkey with a pen. That monkey will can't come out
34:22
of the jail. The jail has no door.
34:24
And the way you authenticate is you get the monkey to sign stuff
34:26
for you. So someone gives you a
34:28
challenge, you stick it through the bars, the monkey signs the
34:30
challenge, it gives it back to you, right?
34:32
That's called the naked signing. The monkey sometimes attaches
34:35
policies to signing, right? So it could attach a biometric,
34:39
it could attach a local pen. In fact, you probably
34:41
experienced this type of monkey policy when you buy coffee with
34:45
your iPhone or with your Android device, right?
34:47
You tap and you smile or you tap and you punch pin in.
34:50
Same things happening there. That pin or that biometric is
34:54
being turned into call, call it a an H Mac that's being sent
34:58
into that through that jail bar. The monkey then looks at it and
35:03
if it if it, if it's what it expects, it then says, all
35:05
right, now give me the document or the challenge.
35:07
You send that through the bars and it then signs the challenge
35:10
and sends the sign challenge back to you.
35:13
But the monkey in the pen can't leave the jail.
35:17
What did Monkey do? A monkey's really happy just to
35:21
sign stuff. He loves it in there.
35:23
He he's very safe inside. Amazing.
35:27
That sounds really cool. And then also the, the, just the
35:30
monitoring. So like knowing and is that a
35:32
dashboard that you log into where it says like, OK, here's
35:35
where all your agents, here's what they're doing, here's what
35:37
they're working on, here's all the APIs that keys that they
35:40
have, here's all the tokens they're using.
35:42
Basically it's just kind of a a live ticker.
35:46
Yeah, exactly. Oh, and that could seems highly
35:50
satisfying to keep an eye on. The yeah.
35:53
So our first goal really is discovery.
35:55
Like we already have policy there, but like we're putting
35:58
more effort into discovery. So if you, if you are using this
36:03
product, you'll see a lot of rich dashboards, but you'll also
36:06
see them probably change on a week to week basis because
36:08
that's where we're putting a lot of our resource and energy.
36:12
The thing that I want to shift to by summer, I guess I'd
36:15
technically, I don't know when this is going to air, but the
36:17
thing I want to shift to you by summer is a more dynamic policy.
36:22
So right now our policy is kind of a static policy engine.
36:25
So for instance, you can say what security controls must be
36:28
present to even launch clawed code successfully with an
36:30
authorization. Like if crowd strike's not on
36:33
the device, don't launch clawed or don't allow clawed to launch
36:36
with an authorization token. And then the an example of
36:40
continuous is, hey, this can be your personal device.
36:43
I'm fine with you running it on a BYOD or non managed device,
36:47
but if the firewall and disk encryption or screen locker ever
36:52
disabled, withdraw authorization from the Claude instance.
36:56
Like those are examples of the policy that you can do right
36:58
now. Where I want to get us this
37:00
summer is more dynamic policies. Remember earlier I was talking
37:03
about that agent loop, Like every time the every time you
37:05
travel that loop, you technically have a new context.
37:08
It might only differ by a little bit, but technically it's new,
37:11
right? That context has associated
37:13
risk, risk of prompt injection, risk of information leakage,
37:17
right, risk, risk, risk. And when it comes back from the
37:22
LLM, like the LLM is stateless, right?
37:24
The LLM is not really what you're worried about.
37:26
What you're worried about is the LLM will send some data back in
37:29
what's called tool calls and then your agent will just start
37:32
executing stuff on MCP or built in tools, right?
37:36
And that's when you have a chance for data, data leakage,
37:39
data loss, exfil, C2, etcetera. That is when permissions matter
37:46
the most, right? Restrictive or or permissive.
37:51
And so when I say dynamic policy, what I really mean is
37:54
tying the risk in the moment of the context in that loop to the
37:59
permissions that are available for that tool execution in that
38:02
moment, if that makes sense. So and that's that's where I
38:05
feel like we can make a lot of hay in terms of keeping things
38:10
secure, but also reducing the administrative burden of it.
38:16
What about the the risk people are worried about installing
38:19
Ceros? What should they be concerned
38:21
about and how are you kind of like protecting for the user
38:24
from its own product? Yeah, let's see.
38:27
So Ceros is built in the same way that we built our core
38:32
authentication software. It's signed, it follows an S
38:37
bomb process. It, it itself uses device bound
38:42
credentials. It follows standard protocols
38:45
like everything we do is IETF for W3C or what not.
38:50
So it's been vetted and we're being used today by over 10
38:54
million identities for their protection.
38:57
And we've had experience, you know, defending organizations
39:00
pretty much up and down the gamut from, you know, bored kids
39:05
all the way to nation state level adversaries.
39:10
Amazing. So make a case for like who
39:16
should be most alerted to the the exposure they have right now
39:20
and these kind of like safety protocols that they should be
39:22
going through. I think enterprise is all over
39:24
this. They understand, you know, if
39:27
you're a small team, let's say you, you started, you know,
39:31
yeah, jamming away and you create a product, you have
39:34
subtraction. You, you got a dozen people.
39:36
So now you have kind of like a little bit of risk there.
39:40
Make make a case maybe, I guess for those two scenarios, you
39:43
know, you're, you have a small team, you're moving fast.
39:46
You want to encourage people to like experiment, but you want to
39:50
make sure they're hedged. What what is most on the
39:52
forefront of danger for those guys?
39:54
So here's a simple one, and this is just a new story I saw on
39:57
Reddit the other day. You you probably have as well.
40:00
It's the guy who is like, Hey, do I need to declare bankruptcy?
40:04
My API token just got stolen and I got a Claude bill for like a
40:07
bazillion tokens, right? So from a an engineer
40:12
engineering manager perspective, there's just like a hyper
40:15
practical benefit of running Ceros immediately, which is that
40:19
won't happen to you, right? That that that's that's that's
40:23
the simple. Run it, get it out of your way.
40:27
If nothing else changes, just know that using device bound
40:30
credentials, that problem is never going to happen, right?
40:33
Yeah, token service theft or reputational damage, right?
40:38
The the next thing is around visibility.
40:42
And I would say a lot of this has to do with, look, I'll,
40:46
I'll, I'll, I'll argue that everyone should be worried about
40:48
security, but the reality is, is not everyone is actually worried
40:50
about security if you sell into the regulated environment,
40:55
right? If you sell to people that are
40:59
targets, a theft or kind of adversarial targeting
41:03
perspective, this is something they're actually going to
41:07
require you to start reporting on this year.
41:09
Whether it's something as simple as like a third party risk
41:12
report that they want you to go through to something more
41:15
complicated like the, the the EUAI laws that ever actually
41:19
just come out. The we think the US auditors are
41:24
actually going to start asking questions this year about AI
41:26
controls. So like, what's your, what's
41:28
your example there to the auditor?
41:31
And what's the control that like you actually feel good that you
41:34
could respond in a, in a situation to and what is
41:38
response even look like? So, you know, I would say it's a
41:42
it's a pretty broad set of applicability.
41:46
The the set it and forget it portion is really valuable to
41:49
everyone around service theft and reputational damage.
41:52
But like the discovery and policy enforcement after that is
41:55
like that's it's pretty powerful.
41:56
Like why you need to embrace AI to stay a lot.
42:02
I think that's just the truth now of the world.
42:05
How do you but you can still die, right?
42:09
Like you can run fast with a with a with a sword and cut your
42:13
own leg off. Sarah's going to help you not do
42:16
that. You.
42:18
Know what I, I, why I'm really excited to, to throw it into a
42:22
Claude code is because I've noticed that there is kind of a
42:26
depleting feeling when you're using AI, particularly clawed
42:30
code. And I, I've been trying to
42:31
figure out why and I'm talking to a bunch of different people.
42:34
A lot of people report this. It's kind of draining at the end
42:36
of the day and there's different kind of things I'm doing as far
42:39
as like making sure I get my push ups in before I hit the
42:41
computer. Also staying locked in on one
42:44
project, seeing it through for a full day.
42:46
Those kind of things are helping, but I think a big part
42:49
of it, too, is just kind of an innate fear of like, Oh my God,
42:54
I don't want to break something horrible.
42:56
So from like a CYA perspective, you know, it's like, OK, Cyrus
43:00
has my back. There's nothing I can do outside
43:03
of, you know, these skills that I set forth for it.
43:06
And I can kind of keep an eye on what everything's doing.
43:08
Because that's the other part too, is that you start spitting
43:11
up projects and now suddenly, you know, you got 24 live things
43:14
and like you kind of forget, you know.
43:17
So I feel like from an emotional level, just as kind of like
43:20
someone out here experimenting, it feels feels good to know that
43:23
like Cyril's has your back. Well, not even do you forget,
43:26
but like, you're probably working in a team, right?
43:30
How do you there? There's nothing to forget.
43:33
You never know everything that's going on in your environment
43:35
unless you actually have instrumentation and controls
43:37
present, right? Their team, if they're a good
43:40
team, are constantly experimenting.
43:43
They're constantly trying new things.
43:45
They're constantly discovering like prompt script, prompt
43:48
script patterns that they want to elevate into new skills.
43:51
Why wouldn't you want a little century in the background on
43:55
everybody's shoulder saying, hey, that skill you just pushed
43:58
into the project, not to user space or not to managed and not
44:01
even into a a production repo. That skill is a little bit
44:05
problematic because it wants to use this tool and has this
44:08
particular prompt and it's really susceptible to this style
44:11
of injection. And it's really susceptible to
44:14
exfil if this data were ever being handled like what?
44:18
You're never going to keep all of that in your memory to start
44:20
with. So why wouldn't you want that
44:22
sort of oversight? Very simple, I love it.
44:27
Any other features or benefits you want to make sure we we
44:29
review? That we could talk about this
44:33
for a really long time. I I just to try it.
44:38
The bare bones is if you use Ceros, you're not going to know
44:43
it's there and it's going to protect you right out of the
44:45
gate from any sort of token theft and session hijacking
44:49
using advanced device bound attestation, right?
44:52
And then from there is where it can kind of help you with
44:57
defending against bad things for a breach and incident
44:59
perspective to also just understanding what's going on in
45:02
your environment to also being an answer for where your
45:05
customers are going to start having questions around how you
45:07
manage their data in your AI systems.
45:12
Amazing. Can I ask you a personal
45:13
question? Yeah, Beyond Identity dot AI is
45:17
the website where you can check this out.
45:19
It's totally free for personal use.
45:20
Right? Incredible.
45:23
And it's a gorgeous website. Why is there a giant alien
45:26
mothership in the hero section? The look, we, we, we are trying
45:33
to be more fun with this particular we're trying to show
45:38
a little bit more of our personality and what we do.
45:41
We're, we're, you know, that we, while we are a diverse group of
45:45
people, we do have a strong interest and I'd say like
45:48
science fiction and, and sometimes it kind of feels like
45:53
we're living in science fiction when you start to see what's
45:55
possible and when you start to read some of the headlines.
45:57
And actually, I have no idea if this is even true.
46:00
I saw a headline on Reddit, so like 5050, right?
46:02
But like, it was like Donald Knuth astounded that Claude code
46:07
solves an open problem for him in one week, right.
46:11
So, yeah, I don't know this the IT it, it does feel like we're
46:14
living in a magical time in that like the things that
46:18
traditionally you haven't been able to do because of the amount
46:21
of people and effort it took and the payoff just made it not seem
46:25
economical. But now it's possible.
46:28
And it doesn't have to be a business.
46:29
It could be a personal project like your game or, or or
46:31
whatnot. But like that level of, of
46:38
achievement, just being able to do it makes us feel like we're,
46:40
we're living in the future. And so I would say, you know, we
46:43
just, we're trying to show a little bit more of our kind of
46:48
outlook and, and background. And, you know, we love dogs.
46:51
And so Ceros is also kind of a little bit Cerabus inspired.
46:55
Which is the Hound of Hades, a multi headed dog that guards the
46:59
gates of the underworld to prevent the dead from leaving.
47:03
Exactly I. Love it.
47:06
I love it. Yeah.
47:07
That's so fun. I mean, I, I again, like there
47:10
isn't an innate unease with all this.
47:13
It's so exciting. I mean, that's The thing is it's
47:15
so exciting. It's so much fun.
47:16
And you can do all this stuff and it's.
47:17
Nobody really knows what the limit is.
47:19
And we're rushing into it. It's so fast, but there's like
47:22
an underlying unease. But I feel like injecting kind
47:24
of like novelty and fun into these, into everything, like
47:29
makes it like, makes me more enthusiastic about it.
47:32
So I love that answer. If you're like, yeah, man, we're
47:34
in the future. We don't know what planet we're
47:37
on right now. It's great.
47:38
And balance that with some like classic Greek mythology.
47:42
You know, we all needed it. The Hound of Hades protecting
47:45
our our back from the underlord. Exactly.
47:51
Incredible, Jason, I really appreciate it.
47:53
Everybody check out and download Beyond Identity CIROS, Beyond
47:57
Identity dot AI. Where's the best place for
48:00
people to connect with you online personally?
48:03
Hit me up on X or LinkedIn. Done and done.
48:07
We will post the links in the show notes below.
48:09
Of course, we'll post the the the links to Beyond Identity
48:13
where you can check out Cerro. So I'm excited to get this
48:15
started. I have a a big vibe code
48:17
community here in Denver that's swollen to maybe 400 people.
48:20
And I'm going to drop it in the WhatsApp chat and, and let
48:23
people know about it. Thanks, Jason.
48:26
Awesome, thanks for having me. You are about to spend anywhere
48:30
from 100,000 to $300,000 on your kids college education, and
48:34
that's not a small bet. And right now there's a very
48:37
real chance that they graduate and can't find a job.
48:40
Not because they weren't smart enough, not because they didn't
48:43
work hard enough, but because the job market changed and
48:45
nobody told them. Employers are hiring AI native
48:49
candidates, people who don't just know their field, but know
48:51
how to work with AI at a professional level.
48:54
And most colleges are not teaching this.
48:56
Not even close. AI native student.com is the
49:00
program that fills that gap. It takes high school and college
49:03
students and teaches them how to actually think and work with AI
49:06
the way top companies expect on day one.
49:08
So your investment in their degree actually pays off.
49:12
You're already paying for tuition, housing, textbooks.
49:15
This is the one thing that actually makes it all worth it.
49:17
Go to ainativestudent.com because a diploma is a starting
49:21
point. Being AI native is what gets
49:23
them hired. That's AI native student.com.