When AI Agents Cross the Boundary: Securing the AI Factory

0:00Vikram Varakantum: In mid-July, OpenAI disclosed that models undergoing a cybersecurity evaluation escaped their testing environment and carried out a real-world intrusion. The agent was given a test, and instead of solving for that test, it found a way out of the sandbox environment, reached the open internet, and went looking for the answer key by exploiting a zero-day vulnerability, escalating privileges, and ultimately reaching Hugging Face's production infrastructure, using stolen credentials and additional vulnerabilities along the way. No person appeared to have instructed the models to target hugging face.

0:33Vikram Varakantum: But what people did do is give the model an objective, significant autonomy in an environment they believed was safely contained. And that distinction matters because it's a warning about what changes when AI stops answering questions and starts taking actions on its own. The conversation you're about to hear was recorded before this incident became public, but it addresses the questions the incident has now made it impossible to ignore. Like, can you identify every agent operating inside your business? Can you contain its access, observe its behavior, stop it at machine speed? Is security built into your infrastructure, or is it added after the agent is already running?

1:10Vikram Varakantum: Recorded at Cisco Live, we talked with WWT Global Head of AI Cyber, Isvan Berko, Vikram Varakantam, Portfolio Owner of AI Defense at Cisco, and Trevor Calder, a Principal Technologist at NVIDIA, to examine what it takes to secure AI at the speed it now operates. Because the next agent that crosses that boundary may not be trying to cause damage, it may simply be trying to finish the job that you gave it. This is the AI Proving Ground podcast from Worldwide Technology. Let's jump in.

1:47Vikram Varakantum: Well, gentlemen, welcome to the AI Proving Ground podcast. Yes, thank you for taking the time. I know Cisco Live is an incredibly busy time of year for everybody, meetings and whatnot. So we're going to be talking about security today. I mean, certainly over the last several months, security has been through every possible scenario you can think of. I mean, certainly headlined by Mythos, but we're also talking about the rise of agentic identity. We're talking about AI factories moving into production. We're talking about security teams becoming AI workload owners. I mean, the list goes on and on.

2:16Vikram Varakantum: Isvan, maybe just set the table for us from the onset. that what has all of this action and motion and complexity, how has that shifted the conversation with CISOs and with security teams and what they have to do to really handle what's coming next?

2:30Istvan Berko: Yeah, I think the interesting thing about it is that we were talking a lot about what we're going to have to do, right? We have to improve the performance of the analytics. We have to be able to respond faster. We need to be able to get better observability across our estates, right? That time's gone. We have to actually do that now. So, you know, a lot of the conversations is, you know, in the past we were saying, Genentech is on the rise. How are we going to solve it? Now people have to put a stake in the ground and say, we need to start getting solutions. We need to start reacting to this today, not in three months, not in six months.

3:09Istvan Berko: So a lot of the engagements we're seeing with customers is, what's our 30-day plan? What's our 60-day plan? And it's not anymore what's our plan for next year to address these things.

3:20Vikram Varakantum: And Vikram, were those conversations, do you think, happening already? Or is what Mythos is adding to the equation just accelerating and amplifying how we need to talk about it? Yeah, I think, as Evan put earlier, a lot of us just moved on from planning to doing it now stage of this equation, right? A quarter ago, we were more talking theoretical about how do you secure models or applications. The agent, it completely changed the landscape to, you know, how do we get this deployed? How do we deploy it at scale? And how do we start doing this securely from the get-go? I think our observation, if you see, let's just go, what we launched at RSA to now what we're announcing at Cisco Live, a lot of the claw moment, like what we call it, is like really pulled forward and said agents are now part of your digital workforce.

4:09Vikram Varakantum: and Mythos in one sense accelerated some of those conversations to see not only how to take this to production, but how do we take this to production day one with identity as its core, observability as its baseline. So we understand the behaviors of these agents before they go into production and the production is happening now, you know, just in a span of three months, a lot has changed. And Trevor, just to kind of tie off on what we're seeing here at Cisco Live, how is anything that you've been learning or talking about with customers or other partners or even anything like from the keynote, how is that adding to the conversation right now in terms of how we need to respond?

4:45Istvan Berko: Yeah, I think the pace has really picked up since we last got together in March. I heard a term the other day of someone speaking that we need to move at the speed of agents. So I think that the whole community is reacting to that. And actually, one of the interesting things is, as a security community, we are pulling together because we're going to have to share information, work on models together, work on patches together for our partners that deliver the solutions. We just provide insights and access in the silicon and software layers, but we rely on our partners to actually deliver the solution.

5:23Istvan Berko: So we're, at NVIDIA, we're trying to figure out what other insights can we provide their solutions so that they can react faster and actually implement protections and defense at the point of attack. Yeah. And one of the things that I love about the partnership between NVIDIA and Cisco, for instance, is that thing where there's capabilities that's coming down to the silicon layer. There's, you know, everything from the DPU controls at the host level into the network, into the software layer. We need to become far better integrated that we were in the past and being able to leverage some of that new capabilities that NVIDIA has been innovating in the AI factory space and bringing that into the broader security ecosystem, right?

6:15Istvan Berko: it.

6:16Vikram Varakantum: Yeah, I think absolutely that, you know, just to kind of key up to that, right, the notion of SecureIF Factory where security is a feature from the get-go all the way from silicon to the workload and to the model itself and how we are closely partnering with NVIDIA and partners like WWT to be able to not only think, you know, kind of we see this as security first, observability built into that and governance and operationalize it with the partners like WWT as a part of the whole equation helps drive the momentum towards how teams are moving from conceptual stage of thinking about AI-ready infrastructures to AI-production-ready infrastructures.

6:54Vikram Varakantum: That moment is now and that is happening. And the second part to add to what you mentioned already is this is being driven both at the infrastructure layer, also at the application builder layer. This is where the motion between all of us to see how do you not only enable infrastructure security and application team to bring all of this together. as a combined end-to-end stack that includes security at its core, observability as a layer, and governance and operations built in from day one. That makes a huge difference for teams to move at machine speed scale.

7:27Istvan Berko: And one thing I want to ask you, this change is also driving the way that Cisco needs to innovate. right? We've seen huge amounts of announcements this week, and it feels like, you know, where in the past, products used to come out quarterly and annually. I mean, we're seeing a slew of products coming out, it feels like, on a weekly basis from Cisco and new capabilities and new features.

7:58Vikram Varakantum: No, I think at the fundamental level, things are moving at machine speed. I think we publicly stated, and specifically the product that I'm responsible for, the AI difference, We specifically stated in February of this year, almost 80 % of our product starts with Codex at its layer first. The goal here is to bring AI as a core thesis of how we work as well, where all of us use some kind of a claw. We release our own version of a defense claw. So we're trying to embrace how we do things ourselves with AI, but at the same time building for AI. I think as you rightly called out, a lot of this also comes down to partners like NVIDIA, is helping us build the tools and the toolkits, like the models and the toolkits to be able to accelerate our product development life cycles.

8:42Vikram Varakantum: We are kind of moved to a weekly cycle right now that still feels that we are lagging behind. It's funny that you say, you feel like you're lagging behind. We're talking about moving at machine speed, agent speed. I mean, everything is moving so fast. It's fun. I'm wondering from your conversations that when you're interfacing with customers, organizations that are trying to put this into an action plan, what are their questions in terms of trying to wrap their heads around it? Are they able to do that? Are they understanding the shift that needs to be made? Or is there a learning curve?

9:14Istvan Berko: I think there's a lot of the learnings already. Customers are starting to get more mature around it because they have had to do that, right? I've seen where, you know, six months back, we used to have to go in and say, let's explain AI security to you and let's understand the ecosystem that you need to defend around. We don't really need to have that conversation every day anymore. But now it's more about, for instance, they've had the past year different kinds of agents. They've allowed certain parts of their business to innovate with AI. And the challenge is getting visibility and observability around that, right?

9:51Istvan Berko: It may be frontier labs. It could be internal models. It could be the open clause, the NEMO clause, right? So I think a lot of them are saying, we don't even know where in our environment we have to structure controls. And with Mythos, a big part of it is reducing that blast radius. Every agent that is built on a model that may hallucinate and do something unexpected is a risk to the organization. And how do you bind that down to the right blast radius around it, getting observability around all these as-a-service models as well? because agents don't only live in frontier models and on local GPU hardware.

10:32Istvan Berko: It also lives in your third-party SaaS platforms and different kind of applications you may have within the environment. So getting visibility, I think, is a key component so that you can identify those controls. And I think, Vikram, what you said is within Armour, for instance, we had six domains. and we've realized that identity is actually a core component so identity used to be in our infrastructure domain but we actually see it's so critical now to the agentic conversations right you need to be able to really see that agent as practitioner in your business so that means they need the right kind of identity associated with them.

11:22Vikram Varakantum: I do want to get back to some of like the silicon and infrastructure layer that we just mentioned. Trevor, whether it's Bluefield STX or BF4, how is that enabling each of those layers? Why is that important from a security perspective?

11:36Istvan Berko: Yeah, I think with the advent and the uptake of autonomous agents, any nefarious workload, was a problem before on the compute, but now they have the ability to move around and move quickly. So we need to have a separate security domain that protects your infrastructure. And we've talked about this air gap or isolation for years. Now people are actually implementing it. So in our reference architectures, there's a DPU in every compute node, GPU compute node. And that DPU provides a set of resources, increasing CPU resources, very important increase in memory resources where you can run software applications separate from the compute nodes and truly implement, you know, layer four firewalls all the way up to layer seven today.

12:35Istvan Berko: And, you know, some of that's in software in the DPU. But what we really try to expose is the analytics, real-time analytics that you can get by monitoring memory accesses and the PCI bus as well as the network. And the way we do that is expose gates and security engines to our partners here that provide the solutions through DOCA. And you've probably seen some of the announcements. We've had DocaFlow that is focused on programmable interfaces on the network. Then we had DocaArgus, which we talked about in March, and that's giving you analytics and memory access using our RDMA technologies. And now we've just announced this week, GTC Type-A, DocaVault, because these agents are using file-based accesses.

13:27Istvan Berko: So now we have to go protect everywhere they're moving. So their files move into storage. We need to be in the storage nodes. So what you saw with the Vera Bluefield 4 SDX platform that Jensen was talking about is a bluefield now in storage hardware that will couple with that bluefield in the compute node and provide you the full protection across the secure AI factory.

13:54Vikram Varakantum: This episode is supported by Vast Data. Vast Data's high-performance storage platform is purpose-built for AI and analytics workloads, delivering massive scale, speed, and simplicity for the most data-intensive applications. Power your AI and analytics pipeline with Vast Data's next-generation storage platform. I like how you said this is not just happening. It's happening everywhere, right? Vikram, how should we think about multi-tenancy? How should we think about policy, agentic tools like Defense Claw? I mean, give us a little bit more there. Yeah, and I think just to kind of tie both of the conversations together, agents are becoming part of the digital workforce, wherein most teams are getting to the stage of comfort level of assigning them tasks, giving them access to enterprise tools, and kind of starting to treat them like coworkers, right?

14:44Vikram Varakantum: And that changes the narrative completely to even spun earlier around, they need to have the identity, they need to have the attribution to be able to know who this agent, you know, The announcements that we've seen at Cisco Live from the Duo team is being able to attribute how many agents are tied to your own individual identity and then extending that further into NHI to say when these agents are running in workloads, how do you kind of like one, assign the identity to isolate them and monitor them and observe them at the infrastructure layer? So you're not only looking at East-West, but also access to the tools and the data.

15:17Vikram Varakantum: And the last part of the list I also want to call out is this is happening across all surface areas. As you've seen our announcement with Workday, we are also powering agentic platforms that our partners are running themselves. This is where, you know, bringing back to the question you asked about, like Brian, is now policy becomes a universal construct that cuts across identity, model choice, guardrails across any surface area. where we are seeing customers start to think about is agents and where they run, how to secure them with a single substrate of definitions, and that are developer accessible.

15:52Vikram Varakantum: I think the big part I want to call out is a big emphasis on what we are starting to see is if you start from the beginning stage of building these agents, enabling developers to build them with security built in, it just becomes an easier conversation downstream.

16:05Istvan Berko: Yeah, and we have to do all of this with new innovations, new kind of control planes, et cetera. And then one of the big things is we have to do this without impacting performance, right? Absolutely, 100%. When we're talking about AI factories, we can't put an agent on GPU workload that's going to reduce the performance by 20%. That's just not an option. So building all of this and at the same time building it around security and continuing to even improve performance through those platforms is incredibly important at this stage, right? Yeah, with Vera Rubin coming out now, we're talking 800 gig east to west and into the north-south as well.

16:52Istvan Berko: So this is a lot of service area to cover, and we're hoping that some of the hooks and visibility that we've given you guys through DOCA to Bluefield will enhance your end-in solutions.

17:07Vikram Varakantum: Yeah, absolutely. I think one of the key parts I want to call out is it's a built-in conversation, not a bolt-on conversation. I think that's the key for us is having the telemetry to be able to build it into layers by default. I mean, what you bring up is a super interesting point is when we think about agents and kind of governing them, latency and the decision-making timeframe becomes a huge part of the conversation. You know, we couldn't rely on partners like NVIDIA, for example, making our model choices because part of when we think about guardrails, guardrails need to be along with the agent in the infrastructure they are running in alongside the workload, isolated from east-west drop.

17:47Vikram Varakantum: The reason for all of this is, you know, these are millisecond decisions an agent has to act. Any delay to that has significant like downstream impact when you have a multi-agent system. And all of this, you know, needs to operate at wire speed to a degree. This is where while, you know, you're looking at like the infrastructure level capabilities, you also start to think about model level capabilities that are portable and performant. You mentioned downstream negative effects. Just give me an example or two about what you're talking about there. Yeah, I think one of the things that we started to observe over the last quarter is moving from the realm of like answer questions, chatbot and RAG applications.

18:26Vikram Varakantum: Most of the people were very tolerant about like the response times that are coming back. It's just more of a productivity question that waiting for a few more seconds doesn't really impact the experience of the user. When you're starting to think about multi-agent systems that you have operationalized to take actions on your behalf, every millisecond counts in that conversation because every agent that is handing off a decision to the next agent is waiting for that decision to be done. And now doing this securely, inspecting it, every latency factor adds up over time.

19:00Istvan Berko: Yeah, and that's like you were saying about at the speed of the agents, right? If we look into the future as well, where attackers are going to be leveraging agentic architectures to attack as well, you know, we need to be able to defend. And so every second matters, especially with this reactive and predictive kind of security controls that we need to put in place to prevent attackers from leveraging the same technology. We are creating ROI for a business. They're creating ROI for the attack campaigns. And just to your point, with the speed change, we used to be comfortable in the storage world of doing file access and software.

19:46Istvan Berko: And that's just not going to be sustainable with agents. So you have agents that are now tenants in your AI factory. Hopefully they're being productive for you, not working against you. And then those ones that are even working with you for you, your intended agents might start drifting. They might go to you. You don't want them to access someone else's set of files. And we're enabling that now at the silicon level. instead of doing that in software.

20:18Vikram Varakantum: Yeah. I think kind of bring, just kind of build upon what you just said. One of our observation has been every agent has a unique personality. And, you know, we're going from the case of general purpose, like a blueprint-based build-out to my agent is personalized to my business objective. One of the things that we announced at Cisco Live is what we call is adaptive testing. So you know you have to break your agent before somebody else breaks you, but you also need to know how to secure it. We kind of look at this as personalization of security at an agentic level right now, where people building the agents need to be equipped with the tools and the frameworks to be able to operationalize it before they get to production to make sure that you're not crossing the boundaries of what your trust are.

21:05Vikram Varakantum: The second one is condensing the organizational goals and governance principles and boiling it down to a guardrail that can be bound to an agent. All of this becomes important, and you do this at the speed of how AI software is being built out. So we need to move fast, very fast, but we also need to do it securely. Isvan, you mentioned just a while back about Armour. Tell us more about Armour for those that may be unfamiliar with it, and then after you do that, talk to us about how it's connecting the security approaches of both NVIDIA and Cisco.

21:39Istvan Berko: Yeah, so as you know, In WWT, we developed a framework that's with NVIDIA and Cisco on board as well. Essentially, it's an operational model. So it's designed to help customers look at the holistic nature of AI because AI is not anymore the domain by itself. It's integrating everything, right, from the infrastructure to business processes to, you know, operations on a daily basis. So we've got six domains in the past. As I said, it was governance compliance, infrastructure, data layers, secure operations, secure development lifecycle, and now identity as well. So we're actually coming out with a new version in the next month and a half or so.

22:29Istvan Berko: And the interesting thing is when we actually worked with Cisco with their threat-informed defense framework and how they actually look at the attacker methodologies, it's a perfect fit, right? From the one side, we're building the controls and identifying that there's no gaps. On the other side, we can validate those gaps with the threat-informed kind of research that Cisco has been doing. So, yeah, we just did a talk yesterday about that as well, and it's a really good conversation, right?

23:04Vikram Varakantum: Vikram, how is what Isvan just described, enabling the secure AI factory? You know, if you can't have any downtime in a factory, that's the worst-case scenario. How is the Armour framework helping ensure that the AI factory is always up and running? No, I think I would bring Isvan, which is a very important, interesting question, right? At Cisco, we've been very focused around threat landscape research because AI landscape is changing rapidly. So is the new threat models that are coming in from an AI application perspective. Cisco publishes an annual report on AI security, but we also have taxonomy and a framework.

23:44Vikram Varakantum: What it all boils down to is we're very focused around finding the latest and the greatest in terms of the threat landscape and operational and the tools and the toolkit at a product level. But where Armour really fits into that is enabling our customers to be able to operationalize this and help make them decisions across different cross-functional boundaries and make it production-ready day one. I think part of it is not about just technology, the process, the people, and the operations thing. And all of this accelerated with NVIDIA at its core so that we can think about scaling rapidly from an infrastructure perspective.

24:18Vikram Varakantum: So bring it all together, right? Our customers are looking at secure AI factory as an infrastructure that is production ready, not only just from a technology performance, but also from an operation standpoint. This is where it all comes together for us. Yeah, I think when you think about armor or security, you're thinking about governance and guardrails. But, you know, maybe Trevor, speak to why something like the armor framework actually lends itself to speed and rapid scale.

24:45Istvan Berko: Yeah, I'd like to say in silicon, we like to do difficult things. And those things are very complex. And then in software, we try to abstract that and provide it to our partners so that they can use that difficult thing that we accomplished. We need the partners to then present something to the end user that's consumable. And it's very difficult to do at the silicon and SDK layers. So Armor is understandable. It's consumable. been in several conversations where it's come up and people have a good understanding of, as we kind of led off with, we're not having the why question conversation anymore.

25:25Istvan Berko: They have a good understanding of why. And now with a wrapper around it with armor, people can actually go out and deploy it.

25:33Vikram Varakantum: Yeah. It's fine. If we're no longer having that why conversation, which feels like a bit of a breakthrough compared to, you know, years past, where do you hope that that kind of momentum continues to go if it's no longer about why what do you hope we're kind of talking about at this time next year as it relates to securing ai securing the ai factory and so forth i think

25:52Istvan Berko: a lot of it's going to be around emerging capabilities because the models today is the worst day ever going to be so and where we're going to be in a year's time i honestly i wouldn't even try and think right 30 months ago i would have been completely wrong where we were now So I think the interesting thing is how do we innovate? How do we choose partners that's going to innovate with us? Because it's not good enough to just select partners that have a good product today. You need a team of researchers. You need to have a team that's going to grow with the industry. have the researchers able to actually innovate fast enough to keep up.

26:43Istvan Berko: And I think that's going to be differentiated, right? I think we're going to see vendors moving faster. We see Cisco's moving incredibly fast, research being key aspects of it. And then also, I think just from a customer perspective, we're going to start seeing those assistants on the AI side become agentic systems right so assistant to a system so instead of having this spiky kind of agent interaction we're going to see 24 by 7 agents running actually doing work so the whole ecosystem around controls just just in time access management, those kind of things is going to have to be key.

27:29Vikram Varakantum: Vikram, if we, yeah, unfair question is asking about a crystal ball. Nobody can tell what's going to happen, you know, in the next few months, let alone the next year or so. So maybe, Vikram, the right question is what should organizations and IT and security leaders do so that they're flexible and adaptable for an uncertain future? Yeah, I think I'm going to lean on like what I said. It's like, it's more about like picking the right partners, picking the right practices, because three months is a long time in this domain. Three months, everything has changed. And to kind of create back in terms of how we adapted ourselves is the team that, you know, is really good at figuring out how to operationalize models, build products with models at scale, have cutting edge research around, you know, innovating new concepts and put them in the open domain.

28:17Vikram Varakantum: One of the things that we've been practicing as a team is open source stuff so that, you We learn from the feedback of the community so we can iterate fast. This kind of brings our innovation cycle to iterating rapidly and building rapidly. Now, bringing to the question that you asked, what should our customers can leverage from this is, one is be open to the idea that things are rapidly evolving. Make loose coupling decisions with scale and innovation in mind. And it's possible. I think while it seems everything is changing, something still remains the same. The goalposts that you're setting yourself.

28:51Vikram Varakantum: So a lot of that still remains the same around organizational governance structures, like how do you bring technology as an enabler into this thing? And I'm going to see the reality of agents becoming part of your digital workforce where they're very objective-focused, long-running. All of these are happening. And what it comes down to is picking the right frameworks, operationalizing the right frameworks, and bringing teams together across the board with a common goal in mind of acceleration and pace. And we see that happening across the customers that we work with already, right? We are starting to see teams of AI developers, AI platform teams, legal and security, everybody acting together as one unit to basically take advantage of this rapid moment in time where AI is truly becoming an accelerator for driving business outcomes.

29:38Vikram Varakantum: Well, Trevor, any additional priorities? I mean, Cisco Live happening here in Las Vegas, certainly GTC Taipei happening kind of simultaneously, good inflection points to take inventory to understand what we need to do. So what would some good priorities for the back half of 2026 be to kind of accomplish what Vikram just described?

29:56Istvan Berko: Yeah, I think what I would ask of our end users, you know, our partners, customers, is along the lines of the open source community development, you know, OpenClaw fastest adopted open source, you know, project ever. This is just going to continue. We would love to see what your workloads are stressing in the fabrics, in the compute nodes, in the storage. So working closely with us to get that feedback loop so that we can in turn run at agent speed to put things in the silicon, put things in the SDK, expose capabilities that are already there, repurposing them for what's needed tomorrow, which literally is going to be tomorrow.

30:40Istvan Berko: Tomorrow we'll need a new solution. So that's what I would suggest is just don't sit at the end line as the end customer. Come into the design fold because what you're buying today will evolve 12 months from now. And the data that you have is precious and vital for us to understand what these workloads are actually doing. All right.

31:03Vikram Varakantum: Thanks to Isfan, Vikram, and Trevor for joining. The lesson here, organizations can't wait for the technology to settle before building the identities, guardrails, infrastructure, and operating practices required to control it. The systems will continue changing. The responsibility will not. And so securing the AI factory is now a continuous discipline of observing behavior, limiting access, testing what can break, and designing every layer to respond at machine speed. This episode of the AI Proving Ground podcast was co-produced by Naz Baker, Cara Kuhn, and Sarah Chiodini. Our audio and video engineers were John Knobloch and Brian Gagliano.

31:40Vikram Varakantum: My name is Brian Felt. Thanks for listening, and we'll see you next time.