AI Engineer Code Summit · Tue 10 Nov 2026 · Continental 1–3

Swarms on both sides

Karan Vaidya runs Composio, which connects agents to the apps companies use. His talk is about running a company's security and operations on swarms of agents, and what the company has to own before that's safe: the access map and the perimeter.

Karan Vaidya, Composio · recording covers the last 11 min · Links and further reading
The threat

Attackers already run agents

Exploits now arrive before patches do: the time from a patch to an exploit used to be 63 days, and is now far shorter. By his figures, eighty to ninety percent of attacks are now carried out by agents, at a speed and volume no human team can follow.

So defense has to be agents too. A security team reading alerts by hand is already behind.

Evidence: transcript 00:00:41 · the recording starts about five minutes into the slot; his opening is missing

The defense

Swarms that watch the company

One swarm sweeps the outside world every few hours, reading threat feeds, advisories and researchers' posts, and checks whether a new attack pattern matches the company's stack. Another runs every 30 minutes over the company's own activity logs. Clear matches get flagged at once. Anything it isn't sure about goes into a queue a person reviews in the morning, so engineers can sleep.

The same pattern runs operations. Most incidents follow a change (a deploy, an environment variable, a config), so each change triggers a swarm that watches error patterns and posts a suggested rollback or fix in Slack within minutes.

“We just can't go down.”00:03:38
The reading: the human doesn't disappear; their job changes. Agents handle the volume around the clock, and a person makes the uncertain calls in the morning. The swarm filters so the person only sees what needs judgment.

Evidence: transcript 00:01:56, 00:03:38

The access

Broad reach, granular access

To find problems before they spread, agents need access to everything the company uses, and the more access, the more useful they are. But it has to be granular: even large swarms can be tricked by prompt injection or simply make mistakes, and broad write access can take down production or leak customer data. The average company uses 106 apps, and getting scoped access right across all of them is a lot of work; that mapping is what Composio sells.

“So to be able to do that correctly, you need to give right amount of access to all of these agents.”00:05:49
The reading: access is a layer you own: a deliberate map of who can do what, where, kept as carefully as the data itself.

Evidence: transcript 00:05:49

The perimeter

A firewall on both sides

Swarms read unfiltered text, and none of it is fully trustworthy: anything can be used to poison an agent's input. In the deterministic era a web firewall protected applications from known-bad traffic. Agents need the same idea, in both directions.

“In case of non-deterministic agents, you want something similar protecting.”00:07:15

On the way in, detection layers flag likely prompt injection before it reaches the agent's context; Composio trains small models on the injection patterns it sees across the tool calls on its platform. On the way out, a second check stops misaligned actions, because something can still get through. And credentials are scoped from the start.

Evidence: transcript 00:07:15

The pattern

Swarms on both sides

His closing patterns: give each swarm its own area so their contexts don't conflict, give them connectivity, and treat a firewall as a must.

The reading: this is the security side of owning the stack. Besides the data and the checks, a company running on agents owns the access map (who can do what, in which app) and the perimeter (what goes in, what comes out), and keeps a person on the calls the swarm can't make.

Evidence: transcript 00:09:39