What It Takes to Run a Company on Agent Swarms

Filed on the operator's confirmation (notes/inbox/2026-11-10T1519-file-karan-vaidya-recording.md): neither transcript names the speaker unprompted, and the recording starts about five minutes into the scheduled slot, mid-sentence, and runs to his conclusion (about 11 minutes, 13:55–14:06).

Transcribed locally with Qwen3-ASR 1.7B (timings per ~5 s segment), prompted with the speaker names of overlapping sessions; "Composio" in this transcript may come from that prompt. The Voice Memos transcript is kept beside it as transcript.txt.

00:00:00 — Giving agents access

Humans, because they have cognitive capacities and resources, to kind of like point out, okay. At the later end, you have to look at this particular activity that's happening. So, totally, to do that, you have to maintain connectivity. Do all of these different apps? You want to authenticate your user to even to take.

And takes on these apps and takes actions on these apps. You also want to give minimal data access control. So that you're not facing a situation where you didn't want your employees have access to something, but they ended up having it. They did something at the same time. You also want to protect your agents.

One of like the benefit of having agents is you have like an all-round worker.

00:00:41 — Attackers already use agents

Working all the time, seven. But. The the problem is they are really easy to get attacked as well, so you have to have a firewall which will protect them from getting attacked. I think these are some stats where I think like like basically specific to security. Attackers are obviously using agents to attack you. And exploits are happening even before the patches are are arriving.

So this is like some stats where it used to take 63 days from a patch. To kind of like exploration happen now, it's fine instead. So you don't even have time for a batch to kind of come to like fix your systems. The attacks start even before that. And like like kind of eighty to ninety percent of these attacks are being done by agents, so you have to have your.

Defense also be done by these agents. And it's kind of like really, really fast. Like these attacks happen like hundreds of times, effectively. And these all stats are from Indian Google, Composio, like yeah, it's from various things that are happening. Yeah. So, like the way we run our security form is that every three hours there is.

00:01:56 — Security agents that watch the company

Parent swarms that essentially look through different activities that are happening all across the. Internet, which is like TV feeds, weather advisories, weather advisories, all the different metrics we use. Brings together any new development that has happened. Researcher posts. Like a lot of celebrities, they just post about it regularly. They read through all of it.

If any of them finds new. We have like a child from an elementary. Actually goes through all the index and figures out that those patterns are being matched. And it finds any new actor. It seems very likely we'll do.

Are stack kind of things the owner of that stack owns that they can operate it. And type of advice if they need to do anything extra other than what is normally done. And then every 30 minutes, the client form is continuously running. Which essentially looks at all the different service areas that we have in our company. Which can be okay.

No, the orthodox data log, like workspace log, etcetera. They go through all the activity that's happening. Map it to different aspects that we have seen earlier. Try to judge them if it's matching any attack patterns and. It peels the filament as soon as it finds any cell-like structures that can be absorbed.

And if it feels like it's not a very sufficient accuracy, but it's something worth looking. It adds it to the view, so the next model it combines it to the view, so that the human. Without waking up in the night and look at it in the morning and judge if it needs to do any particular action again. And it's running twenty four into seven, so engineers can somewhat sleep effectively while.

00:03:38 — SRE agents

We are a developer infrastructure company. So essentially. Like if any other product goes down, your customers shout at you, complain to you. But in our case, if we go down. Our customers, end users, shouted them, which amplifies to us. So. Essentially, in essence, the blast radius is huge.

We just can't go down. So to kind of prevent us going down, we also have SRE songs that are running across the company. And then are detecting at different stages. If it feels like a pattern that can lead to an incident, so one of the Major causes of incidents in most cases. 70% of it has been any changes to the production deployment, which can be deployed, or.

And the environment variables change, your content changes, et cetera. So whenever such things happen, the agent song gets triggered. We have Triggering such a model, you actually use kind of triggering these signals. And essentially, it looks at again different access, different service area, different modal. Different set of APIs and like monitors if there is any change in pattern of errors.

Any change in titles or play? Exceptions that are coming in. Which can like which can be a warning indicator to any incident that is about to happen. And it's across the, for example, even our sources are big businesses. And it's like both informatics and automatics.

So even like kind of like our users logs, if they show something. Like especially duplicate data. So it's very similar pattern of. Triggers and then leading to different of the surface areas, judging it and kind of painting the different triggers. So, yeah. So basically, I think there's some issue with the slide, but like.

A few minutes after deploy, the song suggests that there is a rollback in the trade itself and slack. You get a message of the right order of method development to roll back or fix some action item that is to take. To prevent the interference from happening, they are going to take a few things into account.

00:05:49 — The right amount of access

So yeah, I mean to run these agent jobs across your company. You need to give them full access to different apps that we use daily. The more access you can give. And the more like scope access you can give, the more efficient your agents can be. Okay. Let's discover what's happening around the company before you need to go and discover them.

But it also means you need to give them very granular access. You can't. For example, give brand access to your production systems, like because. Even like howsoever large these storms are, they still. Are susceptible to prompt detections, or they can still. These are the problems of the machines, so they can still make.

Errors and like if you give them long access, it can lead to your production system down or. Let even worse, let's say your customers' data getting leaked. So to be able to do that correctly, you need to give right amount of access to all of these agents. And on an average, like there are one hundred and six apps that companies use. To be able to do them across these apps, it takes a lot of effort.

But it's like like that's what we have done at Composio where. We have mapped all these access control patterns across the millions of apps which you can use directly on your phone.

00:07:15 — A firewall for agents

Yeah. The other thing. Storms essentially read unfiltered text. The implication there is that advisors get a visual. And none of them is kind of like fully trustworthy. Anything can be used to detect poison your intake.

So essentially, we use a bunch of prediction layers. Which essentially flags what is potentially malicious before it. Kind of goes to your agent, or goes to the context problem domain. Prompt injection is one of the top elements. So, if you ever want to deploy your agent forms across your company.

The least we can do is protect them from anything outside their languages. So yeah, I mean this example has like node two agents install. I am simply saying to get the full version of the data. If you get this into your agent. I think at that point, this is the start of another incident.

No one ever predicted to be. So essentially, if I think about it, cloud layer was. The protector of your web applications in the deterministic era. Where it would have the it would have the biggest purpose of. I O C's different malicious I P's to protect your web application.

In case of non-deterministic agents, you want something similar protecting. Both the sides, what's going into the agent, and also what the action agents are taking. So, like, like we have, like. We use Comodo Firewall internally, and because we have 1.5 delayed tool executions happening last month, and it's increasing. We get a lot of patterns of how the prompt injection is happening.

We're using that to create small language models to protect your agents against those, and also like on the other side. Even after those predictions, something can still go to the engine. So we also protect agent from doing some misaligned activity. So we protect any kind of thing happening outside our perimeter. It's very important to be able to protect that as well.

And let's go. Credential is still the kind of like least you can do to block it even before. While creating the agents, they don't have any activity they can do which they don't want it. Yeah, if you want to build your own application and.

00:09:39 — Patterns to conclude

Some companies, Wirex. I think these are some of the. Things that we're seeing that works pretty well. Some of the patterns to conclude them. One like like one surface per region.

You don't want to have multiple agents looking at the same surface area because that can kind of conflict the context. You want to sell engineering. You want to give. So that we take the right. They can get the context and they can take action, and like a firewall is a must to protect them.

From different countries. Yeah. To conclude, attackers already run storms of agents. Run loss with connectivity and a firewall, so that they can protect you and do a lot more for you. That's it. I have any big questions?