Key Moments
Datadog CISO on Securing AI Agents at Scale | Deep Dives with a16z
a16zWant to know something specific about what's covered?
We've already dissected every moment. Ask and we will deliver (with timestamps).
Key Moments
Datadog embraces AI, developing internal tools to vet code intent and manage agent security, instead of blocking adoption. This proactive approach aims to mitigate risks from malicious skills and credential exposure, while acknowledging the challenge of scaling security processes.
Key Insights
Datadog has achieved a 98% adoption rate for some form of AI across all employees, with over 4,000 engineers actively using coding agents.
The company developed an internal 'judge' using an LLM to evaluate the intent behind code, finding a significant number of malicious skills in public marketplaces.
To manage credential access, AI agents are injected with ephemeral tokens when needed, rather than accessing static credential files.
An internal business intelligence tool revealed that AI agents could flatten organizational data permissions, allowing sales reps to access enterprise tier data through natural language prompts.
The security team's 'judge' tool, initially built to vet third-party code contributions to the Datadog agent, was repurposed to identify malicious code in software supply chain attacks and ID extension hijacks.
A significant portion of security leaders expressed a sense of helplessness regarding AI agent security, waiting for commercial solutions rather than building internal capabilities.
Embracing AI adoption to avoid obsolescence
Datadog's CISO, Emilio Escobar, emphasizes a proactive stance on AI adoption, likening the choice to embrace new technologies or risk falling behind. Rather than attempting to block AI tools, which he believes is an ineffective strategy, Datadog chose to enable their use early on. This approach started with a pilot program using Cursor for coding agents, offering 50 licenses to see who would adopt it. The adoption quickly expanded, leading to the current situation where over 4,000 engineers use coding agents, and nearly every employee at the company utilizes some form of AI, including general-purpose tools like ChatGPT and Gemini. This widespread adoption, reaching a 98% rate across the company for some AI tool, underscores Datadog's commitment to integrating AI into its operations to maintain innovation and competitiveness.
Flattening data permissions and the need for new controls
The pervasive use of AI has highlighted new challenges in data security, particularly concerning access controls. AI agents, through natural language prompts, can inadvertently bypass traditional permissioning systems. An internal example at Datadog involved a business intelligence tool that, while using existing data warehouse access controls, allowed a commercial sales rep to query enterprise tier deal performance by simply asking the AI agent. This agent translated the request into SQL, effectively flattening the organizational data structure. Previously, accessing such data required deep SQL knowledge, inherently limiting its reach. This demonstrates how AI can expose data that was technically secured but practically inaccessible, necessitating a re-evaluation of access controls based on context and intent, not just technical permissions. Datadog is addressing this by implementing role-based MCP servers for different user groups, ensuring data governance even with widespread AI tool usage.
Securing coding agents: credential management and malicious intent
On the engineering side, the primary security concerns revolve around what AI coding agents can do, which tools they can call, and how they access credentials. To mitigate credential exposure, Datadog utilizes an open-source sandbox where agents do not directly access local credential files. Instead, credentials are injected ephemerally at the moment they are needed, linked to specific tasks. This is facilitated by CLI tools that provide temporary tokens, ensuring that the agent gains access without possessing static, long-lived credentials. This approach is crucial as developers are increasingly targeted by attackers seeking access tokens to build worms, escape sandboxes, or access production environments. The dynamic injection of credentials significantly reduces the risk associated with compromised agent environments.
The 'judge' tool: an LLM-powered intent evaluator
A key internal innovation developed out of necessity is a 'judge' tool that uses an LLM to evaluate the intent behind a piece of code. This tool goes beyond traditional CVE scanning to determine if code is intended to do harm. It was initially built to scale the review of third-party code contributions to the Datadog agent, a process that previously required two security engineers per review. The 'judge' proved effective in identifying malicious code injected during software supply chain hijacks and ID extension attacks. It was later found to be effective in scanning markdown files as well. Now, this judge is placed in front of every 'skill' that wants to be introduced into agents, helping to identify malicious skills in various marketplaces. Datadog also shares these findings with marketplace providers to help them improve their security.
Addressing the 'empire of no' and fostering innovation
Escobar explicitly rejects the 'empire of no' approach to security, where all new tools and technologies are blocked. He argues that such restrictions stifle innovation and are ultimately ineffective. Instead, the strategy is to embrace new tools and build the necessary security infrastructure to use them safely. This philosophy extends to general employees, who receive ChatGPT licenses without restrictions, allowing them to use the tools for any purpose, including non-work-related tasks like finding recipes. This approach helps avoid 'oops' moments by acknowledging that users will find ways around restrictions, and it's better to provide safe, governed access from the outset.
Shifting developer-security dynamics and the rise of 'real engineers'
The conversation touches on the evolving relationship between developers and security. While developers have always cared about security, the problem, according to Escobar, was that the security tools and processes provided were often perceived as 'crappy'—generating irrelevant alerts and losing credibility. He posits that security engineers are increasingly becoming 'real engineers,' capable of building robust solutions. This shift is partly driven by the need for security teams to keep pace with rapid AI development and the growing complexity of the threat landscape. The idea that developers might not need to write as much code manually due to AI also suggests a potential realignment of talent, with some developers potentially moving into security roles as the demand for both areas evolves and compensation equalizes.
A sense of helplessness among security leaders
A surprising observation from a recent roundtable on agentic security was the prevalent sense of helplessness among many security leaders. Instead of developing internal solutions, many expressed a passive stance, waiting for commercial products to address the emerging security challenges. This contrasts with Datadog's proactive, in-house development approach. Escobar notes that this may stem from a broader trend where some security teams have become more focused on management rather than thought leadership, and companies that are not software-centric tend to buy rather than build their solutions. However, he believes that even within larger organizations, there are individuals with the creativity to develop unique solutions if given the opportunity.
The challenge of volume and hypersensitivity to AI-found vulnerabilities
Looking ahead, Escobar expresses concern not about AI models escaping and causing breaches, but about the sheer volume of vulnerabilities that will be discovered, and the inadequacy of current tools to handle this scale. He also worries about hypersensitivity to findings attributed to AI models, where vulnerabilities are automatically deemed critical simply because an AI found them. This can lead to misallocation of resources and challenges in third-party risk management, as it becomes difficult to argue against a finding once it's labeled as AI-generated. The industry needs to adapt its processes and risk assessment frameworks to cope with the increased volume and potential bias in AI-driven security findings.
Mentioned in This Episode
●Software & Apps
●Companies
●People Referenced
Common Questions
Datadog employs a multi-faceted approach including an open-source sandbox for agents, injecting credentials on-demand, and a custom-built 'judge' tool that evaluates code intent and scans for malicious skills before they are integrated.
Topics
Mentioned in this video
Mentioned as a source for a story about AI going wild, setting a tone of external concern.
The company where the guest CISO works, a key subject of discussion regarding AI adoption and security.
Used as an example for authenticating to a service using an agent with ephemeral tokens, rather than static credentials.
Mentioned as the first coding agent Datadog started with for its AI adoption.
Datadog provided ChatGPT licenses to all employees, including non-developers, to encourage adoption and avoid accidental misuse.
Mentioned as one of the AI tools adopted by employees at Datadog.
Knowledge of SQL was previously a barrier to accessing data in Datadog's internal BI tool, but AI agents can now generate SQL queries.
Mentioned as an example of a service for which agents might need credentials, secured through ephemeral tokens.
More from a16z Deep Dives
View all 61 summaries
48 minHow AI Is Redefining What It Means to Be Creative | Deep Dives with a16z
42 minThe Case for AI That Improves Itself | Deep Dives with a16z
53 minWhy Retention Still Defines Product-Market Fit | Deep Dives with a16z
49 minTeaching AI the Language of Design | Deep Dives with a16z
Ask anything from this episode.
Save it, chat with it, and connect it to Claude or ChatGPT. Get cited answers from the actual content — and build your own knowledge base of every podcast and video you care about.
Get Started Free