Chain of Thought | AI Agents, Infrastructure & Engineering

Attackers used to take months, sometimes 270 days, to weaponize a disclosed vulnerability. Now it happens in weeks, minutes if the incentive is there, and independent reports from Mandiant and CrowdStrike show the average time to exploit has gone negative.
Dan Lorenc's conclusion: finding flaws is no longer the hard part. Fixing them first is.
Dan is the co-founder and CEO of Chainguard. Before that he spent years at Google building the backbone of software supply chain security and created Sigstore. In June his team launched Athena, a coalition of more than two dozen companies including JPMorgan, Cloudflare, Cisco, and Kyndryl, built for the era where AI finds vulnerabilities faster than maintainers can patch them. Last month alone it processed more than 40,000 AI-discovered findings.
In this conversation:
Why the average time to exploit went negative, and what collapsed the fat tail of never-exploited bugs
How models chain "low severity" flaws into working exploits, like Project Zero's zero-click iPhone takeover
Inside Athena: what happens between a member submitting a finding and a fix landing upstream
Why 40,000 findings is not 40,000 CVEs: validation, dedup, and vulnerability archaeology
Fuzzing outpaced patching for a decade, and AI is the first tool that speeds up the fixing side
The Log4j thought exercise for solo maintainers and enterprise CISOs alike
Fork economics, "state your intentions," and defense in depth for agent infrastructure
Chapters:
(0:00) Cold open: how time to exploit goes negative
(0:31) The 20-year assumption that just died
(3:21) What a negative time to exploit actually means
(6:04) Two new realities: attacks democratized, more bugs than anyone knew
(8:55) Chaining tiny flaws: the Project Zero iPhone story
(11:26) Why fixing AI-found vulnerabilities takes a coalition
(13:27) 40,000 findings in one month: submission to upstream fix
(18:06) The agentic pipeline: as few human eyes as possible
(19:03) Fuzzing outpaced patching for a decade
(20:50) The Log4j thought exercise for maintainers and CISOs
(23:49) When no maintainer answers: the new economics of forking
(27:40) Deleting dangerous code to slow the treadmill
(29:35) How security kills entire vulnerability classes
(31:08) Agent infrastructure: defense in depth or nothing
(34:35) Regulation: maintainer liability, frontier labs, DC's busy year
(37:01) Open model economics
(39:55) Gas Town, multiclaude, and going back to normie
(42:47) Why Dan turns the AI memory system off
(45:53) Closing: still the most fun time to build software
Connect with Dan Lorenc:
LinkedIn: https://www.linkedin.com/in/danlorenc/
X: https://x.com/lorenc_dan
Chainguard: https://www.chainguard.dev
Athena: https://www.chainguard.dev/athena
Connect with Chain of Thought host Conor Bronsdon:
Newsletter: https://newsletter.chainofthought.show/
Twitter/X: https://x.com/ConorBronsdon
LinkedIn: https://www.linkedin.com/in/conorbronsdon/
YouTube: https://www.youtube.com/@ConorBronsdon
More episodes: https://chainofthought.show
Thanks to Svix, presenting sponsor of season four of Chain of Thought. Svix delivers billions of reliable webhooks for startups and the Fortune 500. Get started at https://link.svix.com/cot. Qualified startups get $12,000 in credits, and YC companies get $50,000.
Thanks to Walrus, presenting sponsor of season four of Chain of Thought. Walrus Memory gives AI agents portable, verifiable memory that carries context across apps, sessions, and other agents. Get started at https://walrus.xyz/cot.

Agents are like teenagers: profoundly intelligent, extremely resourceful, no fear of consequence, and missing the judgment to know right from wrong at all times. That's how Cisco President and Chief Product Officer Jeetu Patel thinks about securing AI agents, and it's why he says static allow/block rules are already obsolete. Agents are smart enough to route around them.
Jeetu returns to Chain of Thought to map cyber's third phase: an agent trust platform where security and observability fuse into one discipline. He explains how Cisco Cloud Control spins up a digital twin to test every agent-recommended fix before it touches production, why Cisco moved from unlimited tokens to rationing them like headcount, and why the gap between people who are fluent with AI and people who aren't is now a 10x differential, not 10%. He also makes the contrarian case that AI will create more jobs than it destroys  - and of course, we talk infrastructure for this new era. 
We cover:
Why agents need dynamic runtime guardrails instead of static allow/block rules
The agent trust platform: how security and observability are fusing into one discipline
Agentic ops in Cisco Cloud Control: ambient agents, digital twins, and human-in-the-loop
How Cisco rations AI tokens the way it rations headcount
The intelligence, cost, and control trade-offs behind open vs closed models
Action control vs access control: what rights you actually grant an agent
Why every automation step creates a new human bottleneck, and more jobs
Chapters:
(0:00) Agents are like teenagers: cold open
(0:25) Welcome back Jeetu Patel
(1:18) Open weight vs closed models
(2:26) Intelligence, cost, and control: the model trade-off triangle
(10:13) Shrinking model half-life and the economics of frontier training
(11:38) Why token costs still outrun token value
(14:15) Build your own evals and route intelligently
(17:11) Rationing tokens like headcount at Cisco
(19:54) Agentic ops: ambient agents and digital twins in Cisco Cloud Control
(23:01) When to take the human out of the loop
(25:13) Cyber's third phase: the agent trust platform
(28:17) Parenting AI agents: dynamic boundary conditions, not static rules
(31:10) LiveProtect and baking security into the network fabric
(34:40) Action control vs access control for agents
(36:42) What the industry is getting wrong
(37:48) The case for AI creating more jobs and the 10x fluency gap
(42:36) Career paths, entry-level hiring, and upskilling at scale
(45:40) Closing thoughts
Connect with Jeetu Patel:
LinkedIn: https://www.linkedin.com/in/jeetupatel/
X: https://x.com/jpatel41
Cisco: https://www.cisco.com
Connect with Chain of Thought host Conor Bronsdon:
Newsletter: https://newsletter.chainofthought.show/
Twitter/X: https://x.com/ConorBronsdon
LinkedIn: https://www.linkedin.com/in/conorbronsdon/
YouTube: https://www.youtube.com/@ConorBronsdon
More episodes: https://chainofthought.show

Thanks to Svix, presenting sponsor of season four of Chain of Thought. Svix delivers billions of reliable webhooks for startups and the Fortune 500. Get started at https://link.svix.com/cot. Qualified startups get $12,000 in credits, and YC companies get $50,000.

Jitender Aswani was customer zero for Presto at Meta, where a billion daily active users generated queries that took hours to return. He watched that drop to minutes, scaled the same technology at Netflix across 300 million subscribers, and now runs engineering and security at Starburst, the $3.35 billion platform built on Trino.
His argument: every enterprise AI project that stalls is fighting the same hidden battle. The agents can query the model fine. They just can't reach the data. The average enterprise runs 52 to 200 data sources, and a decade of moving all of it into one lake produced ETL debt, governance problems, and pipelines that break whenever a SaaS vendor adds a column.
Federation is the only model that scales with entropy.
We cover:
Why Presto changed what Meta could experiment on, and how that compounded product velocity
What broke when Jitender took the same technology to enterprises running 52 to 200 data sources
Why centralization stopped working once data grew faster than the ability to move it
What happened to Starburst's query volume the day they shipped an MCP server
The FinOps agent that fired queries for 30 minutes against data it never had
How AIDA turns ad hoc analysis into workflows using skills and MCP servers
Why a context graph is different from a knowledge graph, and why ontology decides agent accuracy
(0:00) Enterprises run on 52 to 200 data sources
(0:25) Intro
(2:18) Customer zero for Presto at Meta
(9:50) Scaling to trillions of events at Netflix
(15:11) Taking Trino from Silicon Valley to 10,000 enterprises
(20:24) The 2011 research that predicted conversational analytics
(28:54) Why centralization can't scale with entropy
(32:26) The agent query explosion and what MCP did to volume
(41:44) Inside AIDA, Starburst's conversational analytics product
(46:56) Context graphs versus knowledge graphs
(51:17) Where to follow Jitender's work
Connect with Jitender Aswani:
LinkedIn: https://www.linkedin.com/in/jitenderaswani/
Starburst: https://www.starburst.io/
Connect with Chain of Thought host Conor Bronsdon:
Newsletter: https://newsletter.chainofthought.show/
Twitter/X: https://x.com/ConorBronsdon
LinkedIn: https://www.linkedin.com/in/conorbronsdon/
YouTube: https://www.youtube.com/@ConorBronsdon
More episodes: https://chainofthought.show

Charles Guillemet is CTO of Ledger and the founder of the Donjon, Ledger's internal offensive security lab whose job is to break the company's own products before attackers do. He spent a decade in cryptography and hardware security before Ledger, including designing secure integrated circuits.
His argument is blunt: you cannot secure an AI agent with software alone. As agents start moving real money, API keys and trust scopes leave no physical verification layer, and Charles makes the case that hardware has to sit in the loop.
This one turned into a wide-ranging thought piece (and some debate) on what the agentic economy actually looks like, and how to stay safe inside it.
We cover:
Why Charles thinks "securing an AI agent" with software permissions and API keys is a false promise
The economic asymmetry between attackers and defenders, and how AI is collapsing it
How a policy engine plus a hardware-enforced signature can delegate rights to an agent safely
Why Charles thinks the agentic economy settles on blockchain rails over Visa and Mastercard
Secure elements, HSMs, and zero-knowledge proofs as execution-integrity guarantees
How Ledger uses hardware authorization internally for passkeys, signed releases, and multisig
A practical way to classify assets by threat model and match security to value
(0:00) Why securing an AI agent in software alone is impossible
(0:30) Delegating execution power inside your security perimeter
(2:28) The attack-defense asymmetry AI is erasing
(6:00) The alignment problem and delegating rights to agents
(9:24) Policy engines, intents, and hardware-enforced signatures
(13:19) From developer experience to agent experience
(15:12) Secure elements, HSMs, and execution integrity
(20:00) Zero-knowledge proofs, proving without revealing
(27:24) Convincing the skeptics on agent-driven payments
(34:49) Why Ledger bet on dedicated hardware
(36:15) Hardware as a determinism layer for agents
(38:52) How Ledger uses hardware authorization internally
(43:42) Classifying assets by threat model
(46:55) When attack and defense become symmetric
(48:44) Deepfakes, voice cloning, and the scam wave
(50:04) Closing thoughts on staying safe in the agentic economy
Connect with Charles Guillemet:
LinkedIn: https://www.linkedin.com/in/charles-guillemet/
Twitter/X: https://x.com/P3b7_
Ledger: https://www.ledger.com
Connect with Chain of Thought host Conor Bronsdon:
Newsletter: https://newsletter.chainofthought.show/
Twitter/X: https://x.com/ConorBronsdon
LinkedIn: https://www.linkedin.com/in/conorbronsdon/
YouTube: https://www.youtube.com/@ConorBronsdon
More episodes: https://chainofthought.show

Jiaona Zhang(JZ) is the Chief Product Officer at Laurel, where the team runs its own product on itself to see exactly where AI helps and where it doesn't. Before Laurel, JZ built products at Airbnb, Dropbox, Webflow, and Linktree, and she has taught product management at Stanford for nearly a decade.
Companies are spending billions on AI tooling, but most still can't say where it returns time or revenue. Jiaona breaks down how to get that visibility, why blanket AI mandates backfire, and what it takes to re-architect a team so anyone can ship.
Her argument is simple: stop token maxing and start measuring time back.
We cover:
Why most organizations can't see where AI is actually working, and how Laurel uses time data to fix it
The token max trap that "use AI everywhere" mandates create, and how to drive efficient use instead
Why former managers make the best operators of agent fleets
How Laurel lets PMs, designers, and customer success ship features end to end
The bottom-up plus top-down playbook for re-architecting a team around AI
Why technology moats are falling away while brand and data moats endure
Laurel's bet on returning time to people instead of replacing them
(0:00) The token max trap
(1:47) Why companies can't see where AI is working
(5:03) What Laurel does: turning time into data
(8:53) Agents as an extension of the workforce
(13:43) Why former managers make the best AI users
(18:23) Lean teams and shipping end to end
(22:29) Enabling non-engineers to ship features
(28:30) Re-architecting teams: bottom-up and top-down
(32:09) Keeping your professional identity as AI shifts work
(38:53) The context layer is the new race
(42:06) Fundamentals plus tinkering: how to learn
(48:45) Brand and data moats when tech moats fall away
(54:31) Laurel's movement: returning time to people
Connect with Jiaona Zhang(JZ):
LinkedIn: https://www.linkedin.com/in/jiaona/
Laurel: https://www.laurel.ai/
JZ's Linktree: https://linktr.ee/jz
Connect with Chain of Thought host Conor Bronsdon:
Newsletter: https://newsletter.chainofthought.show/
Twitter/X: https://x.com/ConorBronsdon
LinkedIn: https://www.linkedin.com/in/conorbronsdon/
YouTube: https://www.youtube.com/@ConorBronsdon
More episodes: https://chainofthought.show