Joel De La Garza | The a16z Show Summary

1. Key Themes

AI Agents Are a Categorically New Security Problem

Existing security tools were architected to handle exactly two threat types: humans and malware. AI agents fit neither category, which means the entire defensive stack is mismatched to the threat.

"The challenge with the existing security tools that are out there is they really were built to tackle two things. The first being people and the second is malware. And AI and AI agents and agentic processes are neither one of those things." — Max Pollard [00:00:22]

Safety Guardrails Create a Defender's Dilemma

The same guardrails that prevent attackers from weaponizing frontier models also block blue teams from asking the exact questions they need answered during incident response. Defenders are collateral damage of safety systems designed for attackers.

"The unfortunate side effect of that is, as a defender, I may not be able to respond effectively. Now for Hugging Face specifically, they had the luxury of having open weight and open source kind of in their DNA. And so they were able to, when they saw these cyber refusals or these guardrails being triggered, fall back to GLM-5-2 in their case, but could have been a Qwen model, something that isn't going to have those guardrails in place. And so for defensive teams, flexibility is kind of becoming paramount." — Max Pollard [00:03:26]

Signatures Are Dead; Behavioral Detection Is Breaking Down Too

Static signature-based detection is already obsolete. But even the next generation — behavior-based anomaly detection — relied on the assumption that you could define what "normal" software behavior looks like. Agentic software destroys that assumption entirely.

"Those behavior-based approaches made one sort of upfront bet, which is you could determine how software should behave and you would look for anomalous behavior against that. And now with agentic software, that just doesn't apply... It's like bringing a knife to a gunfight." — Max Pollard [00:15:10]

The Enterprise Attack Surface Is About to Explode via Agentic Apps

The threat isn't just the AI tools employees install deliberately — it's the software they already use becoming agentic. With 6,000–7,000 unique software instances in the average enterprise, and 50% of enterprise apps expected to be agentic by end of 2025, the complexity is compounding faster than defenses can adapt.

"50% of enterprise apps will be agentic by the end of this year... and you can be sure that the half that are not will be rushing to become so in the next year. And there's even less vetting and understanding around what agentic process is, what back-end AI models they're going to be using, what guardrails they install and put in." — Max Pollard [00:10:10]

Model Flexibility Is Becoming a Core Security Requirement

Vendor lock-in to a single model provider is now a security liability. Blue teams need the ability to route around refusals, swap models as capabilities evolve, and avoid being frozen by any single provider's policy decisions — without the cost burden of self-hosting.

"The most important part for blue teams is because of the pace of progress to have as much flexibility as possible to be able to say, hey, when Asterix gets released by OpenAI, I have an upgrade path and I know exactly what's going to improve and what's going to maybe require some TLC." — Max Pollard [00:08:02]

Inference Moving to the Endpoint Is the Next Frontier

The gravitational pull of compute is cycling back toward the edge, repeating the historical client-server ebb and flow — but compressed dramatically in time. Defending inference at the endpoint is a categorically different problem from defending data center workloads.

"We seem to be speed running every technology cycle that's ever happened before this one... we're now seeing all these inference and these tests go into the endpoint. It's just fascinating." — Nick Warner [00:11:22]

AI Is Also the Defender's Most Powerful New Weapon

The same AI capability creating new attack surfaces gives defenders asymmetric leverage in building defensive tooling — compressing what used to require hundreds of researchers and years of work into weeks.

"If we were trying to build what we built five, seven years ago, we'd have to hire hundreds of threat researchers, spend years building out this taxonomy of software, and we're able to do that with thousands of agents in the automated process. We were able to do that in weeks and months." — Nick Warner (attributing to NEO's build) [00:18:57]

2. Contrarian Perspectives

Deception-Based Security — Once Considered "Super Precise" — Is Already Failing Against Agents

Honeypots and deception tools were considered near-perfect detection mechanisms because only an attacker would touch a fake credential. AI agents invalidate this entirely — they explore environments the way an overeager developer would, triggering honeypots innocently.

"There's a honeypot on a developer's device that contains AWS keys. Well, guess what? Our sales rep just asked to deploy something and the agent went and found the AWS key because it thinks that it should deploy it on AWS and now we got a ton of false positives in the deception provider. Even newer approaches that were kind of like, hey, super precise, always going to work are kind of being invalidated." — Max Pollard [00:13:52]

"Patch Everything to Zero Vulnerabilities" Is a Failed Security Strategy

The conventional wisdom that rigorous patch management is the foundation of security is called out as naïve — reaching zero vulnerabilities is treated as a category error, not just an execution challenge.

"Great, we should try and patch everything. We should try and get rid of vulnerabilities, but to think that you're going to get to zero there is also kind of a failed approach." — Max Pollard [00:13:23]

Models Cannot Be Relied Upon to Understand Context and Stop Themselves

Despite the significant investment AI labs make in safety systems, the recent wave of breakouts demonstrates that guardrails are not a reliable containment mechanism — and security teams building around that assumption are building on a false foundation.

"What people have learned is that regardless of guardrails that the AI labs are putting around these things, you can't rely on models to stop themselves or to understand context. And I think the most recent couple of attacks we've seen in the last few weeks really have shown that." — Max Pollard [00:07:08]

The Attack Surface Is Now the "Total Sum of Human Expression"

This is a radical reframing of what security teams are defending against. It's no longer a finite set of known exploits — it is the unbounded space of language itself, making any fixed-rule system structurally inadequate.

"We are moving into a world in which signatures are dead and the attack surface is now the total sum of human expression." — Nick Warner [00:14:48]

3. Companies Identified

Cotool

AI-powered security tooling company focused on giving security teams model flexibility and blue team workflow support. Max Pollard is a founder/operator there. Mentioned as the company building solutions for blue teams that need to route across multiple model providers to avoid refusals and maintain effective incident response.

"We see people saying, we've got Devin and Claude Code and Cursor and we have the open weight stuff running locally or through Fireworks. So it's really all over the map." — Max Pollard [00:12:48]

NEO

Endpoint security company focused on defending against AI-native and inference-style attacks. Nick Warner is associated with NEO. Cited for building controls at the layer between human and AI interaction, specifically at the endpoint level.

"A big part of what we're building is a way to properly set guardrails and controls around the software before it runs. And we thought the best way to do that would be at the endpoint." — Max Pollard [00:06:16]

Hugging Face

Open-source AI model hosting platform. Mentioned in the context of the OpenAI Hugging Face breach, and specifically cited as having an advantage in responding to the incident due to their open-weight DNA — allowing them to fall back to unconstrained models when frontier model guardrails blocked their defenders.

"For Hugging Face specifically, they had the luxury of having open weight and open source kind of in their DNA. And so they were able to, when they saw these cyber refusals or these guardrails being triggered, fall back to GLM-5-2 in their case." — Max Pollard [00:03:26]

Vectra

Enterprise security detection and response tool. Mentioned as a real-world example of AI guardrail false positives — the tool's name matched a veterinary drug name, causing security queries about Vectra to trigger bioweapon filters in model providers.

"There's a security tool out there called Vectra, and it just so happens to be also a drug used by veterinarians to treat dogs or something like that. So we noticed folks using the Vectra tool were hitting a biofilter, right? Oh, this could be used to generate bioweapons, and so we're going to refuse this request." — Max Pollard [00:05:30]

Fireworks (AI)

Open-weight model inference provider. Mentioned as one of the providers blue teams are already using to run open-weight models without the guardrail constraints of frontier model providers.

"We have the open weight stuff running locally or through Fireworks." — Max Pollard [00:12:48]

Devin

AI software engineering agent. Named as one of the agentic tools already deployed in enterprise environments that security teams must account for.

"We see people saying, we've got Devin and Claude Code and Cursor." — Max Pollard [00:12:48]

Cursor

AI-powered code editor. Named as part of the expanding roster of agentic enterprise tools that are rapidly proliferating inside company environments.

"We've got Devin and Claude Code and Cursor." — Max Pollard [00:12:48]

OpenAI

Frontier AI lab. Referenced both in the context of the Hugging Face breach and as a provider whose guardrails create friction for blue teams — and whose future model releases (e.g., "Asterix") are cited as a reason flexibility matters.

"When Asterix gets released by OpenAI, I have an upgrade path and I know exactly what's going to improve and what's going to maybe require some TLC." — Max Pollard [00:08:02]

Anthropic

Frontier AI lab. Mentioned as one of the providers enterprises have relied on and are now questioning in light of new inference risks.

"They were fine using OpenAI or they were fine using Anthropic and now they're like, maybe we need our own inference, maybe we should host our own models." — Nick Warner [00:12:20]

Computer Associates (CA Technologies)

Legacy enterprise software company. Used as a historical reference point for how old-tech companies become annuities — and implicitly contrasted with the current AI disruption that may finally break that pattern.

"There was always a saying that sort of like old tech companies stop becoming companies and become annuities... CA, Computer Associates, was famous for this, which is where, like, hey, we have this product installed on mainframes that have been running since 1968." — Nick Warner [00:16:19]

4. People Identified

Max Pollard

Founder/operator at Cotool, an AI security tooling company. Cited throughout as the primary technical voice on the state of blue team AI tooling, model flexibility, guardrail limitations, and the breakdown of legacy detection approaches. His company launched approximately six to seven months prior to the recording.

"If I see machine speed on another billboard, I'm gonna lose it, which is really ironic coming from us because when we launched six, seven months ago, we had machine speed in our launch." — Max Pollard [00:17:30]

Nick Warner

Associated with NEO, an endpoint AI security company. Identified as a deep practitioner with extensive Black Hat history. Provides the macro framing around inference moving to endpoints and the historical parallels between current AI security challenges and past technology cycles.

"We seem to be speed running every technology cycle that's ever happened before this one... it's just fascinating." — Nick Warner [00:11:22]

5. Operating Insights

Build Model-Agnostic Workflows Before You Need Them

Security teams (and any enterprise team relying on AI for critical workflows) should architect for model portability now, before a refusal, a policy change, or a capability gap forces an emergency switch. The cost of lock-in is measured in incident response time.

"Today those teams have probably two or three options, right? You can roll with Codex or Claude Code and lock yourself into a specific model provider... or you decide, hey, we're going to host open weights — and a single H100 costs 250 grand a year. And so that's just not a viable option for most teams." — Max Pollard [00:08:30]

Use Open-Weight Models as a Fallback Layer for Sensitive Internal Workflows

For any workflow where questions must be asked that resemble attacker behavior — security triage, vulnerability assessment, penetration testing — routing to open-weight models that lack commercial guardrails is a concrete operational workaround available today.

"For defensive teams, flexibility is kind of becoming paramount, right? You need the ability to kind of fall back in the case of refusals." — Max Pollard [00:03:55]

Audit What Agentic Permissions Your Software Has Before It Executes

The security posture question has shifted upstream — from "what did the software do?" to "what is this software set up to be able to do?" Organizations need an inventory of agentic software capabilities and permissions before deployment, not after an incident.

"What we think it requires is a major rethink in understanding who's installing what, what can it do, how's it set up to execute on what it's installed for, and what is it doing? And believe it or not, from a security perspective, most of those questions aren't currently answered." — Max Pollard [00:16:10]

6. Overlooked Insights

The Honeypot Collapse Is a Signal That All Assumption-Based Defenses Are Obsolete

The honeypot failure is treated as a funny anecdote, but it is actually a profound systemic indicator. Deception-based security worked precisely because it exploited the predictability gap between legitimate users and attackers. AI agents close that gap — they behave with the curiosity and thoroughness of an attacker but the intent of an employee. Any defensive technique that relies on predicting the behavioral difference between good and bad actors is now structurally compromised. This is not a tuning problem; it is an architectural one that invalidates an entire category of security investment.

"We saw overnight just like, you know, 100% true positive rate to just like a couple of our customers being like, this thing is like awfully noisy now." — Max Pollard [00:14:38]

The Real Moat in AI Security Is Taxonomic Data, Not Models

Buried in the NEO description is a non-obvious competitive insight: the hard part of building AI-native security isn't access to frontier models — it's the taxonomy of software behavior that the models are trained against and reason over. That corpus, built by threat researchers over years, is now compressible into weeks using AI agents — but only if you have the domain knowledge to direct them. This means the window to build that data asset cheaply is open right now, and first movers who build comprehensive software behavior taxonomies will have a durable advantage that model commoditization won't erode.

"If we were trying to build what we built five, seven years ago, we'd have to hire hundreds of threat researchers, spend years building out this taxonomy of software, and we're able to do that with thousands of agents in the automated process. We were able to do that in weeks and months." — Nick Warner [00:18:57]