Insecure Agents — Episode 37: Malte Ubl, CTO at Vercel
Podcast: https://insecureagents.com
Listen: https://open.spotify.com/episode/732dac34tWoMUpVmaNqpaW
Transcript (auto-generated, lightly edited for clarity).

Malte Ubl: I actually have a lot of thoughts. Okay. 'Cause I think Mythos is essentially a major successful psyop, and everyone was talking about it, and not because they care about it, because their CEOs are talking about it.

Allie Howe: There's a transition happening from programming models to programming harnesses. What's driving that shift?

Malte Ubl: I think the next thing is that as an enterprise, I don't wanna bind myself to Claude or to Codex, some kind of managed agent or some kind of, like, SDK that AWS brings out or that, like, OpenAI ships.

Allie Howe: A sort of a hot topic online recently is CFOs questioning token spend.

Malte Ubl: One person who spent $40,000 in one month. What's going on? I don't have the answer. I'm very curious, right? Like, 'cause maybe they did something awesome.

Allie Howe: How close are we to software factories? Is that, like, the end goal, in your opinion? Like, what are- where are we headed?

Malte Ubl: I think software factories are gonna be quite personalized. Our agent has access to your observability data, and it has also access to your source code.

Allie Howe: Hey, my name's Ali Howell. Welcome to another episode of the Insecure Agents podcast. I'm your host. I'm super excited to be recording here today at Vercel's HQ in San Francisco. I'm here with Malte Ubl. He's the CTO of Vercel, leading Vercel's infrastructure and engineering here. He spent 11 years at Google previously, and I'm super excited to chat with him today about the new DeepSec security harness that Vercel published. Malte, would you like to introduce yourself?

Malte Ubl: Yeah. My name is Malte. I mean, you already said most of the things. It's been four years at Vercel. I love this place. And I've been personally vibe coding quite a bit especially since Opus 4.5 came out in late December. Built stuff like just Bash, which is like a sandbox for, for Bash execution. It doesn't have a VM. Chat SDK and now DeepSec, which is the, the new, newest baby which has I think been really helpful to lots of teams out in the open.

Allie Howe: Amazing. I saw on a LinkedIn post you said that there's a transition happening from programming models to programming harnesses. What's driving that shift?

Malte Ubl: Yeah. I think you can really think of the- The abstraction's going one level up, and I like... Th- I think this is actually a very emerging trend. So we will have, I think, more tooling in the future to, to help folks like manage this thing. But I think when you think about maybe three months ago still, you would've thought, "Okay, I as an enterprise, I don't wanna bind myself to ever to Anthropic or forever to OpenAI," right? So I want an abstraction that allows me to program this and like, you know, whether it's the response API or the legacy OpenAI API, it doesn't really matter.

Like I, I'm always just programming against the AI SDK. And I think the next thing is that I don't really, as an enterprise, I don't wanna bind myself to Claude or to Codex or to the, some kind of managed agent or some kind of like SDK that AWS brings out or that like OpenAI ships, right? I don't, I don't want to have this like vendor lock-in. So what if I could kind of go one level up and say, "Okay, can I program an agent that can run on all these ar- harnesses?" And I think that's kind of the next step. That's something we are working on, and I think that the industry is kind of going that direction.

Allie Howe: Yeah, that makes sense for sure. And as DeepSec, which we mentioned, the new security harness that you created, a good example of that?

Malte Ubl: It is because- Yeah... that support, it, it's, it's really a coding agent wrapper in some ways, right? Like, and it supports both Codex and Claude, and then you can also use different models with them if you, if that's your, your choice.

Allie Howe: Yeah. Amazing. Yeah, for those that don't know what DeepSec is, can you take a second to explain the purpose of it and how you started with it, why you wanted to create it in the first place?

Malte Ubl: Yeah. Yeah. I was actually... It was coming from a... Well, first of all, it came from the insight that we had, like we actually built our own code review agent. And I actually personally pushed some code and it- Yeah... pointed out this security vulnerability that I was about to merge into our code base, and I was like, "This is great," right? "This is amazing." And it was, it, it really found something quite subtle and like that had, I think, a hi- a high chance of escaping human review, right? So I was like very impressed. And so I told the team, "Well, I want to run this on my entire code base."

And then, I don't know, they forgot about it. They didn't do it. And then a few months later I started getting really worried about the security posture of the entire industry. I was like, "I need to like up-level my, my whole security." And so I wanna run a code review agent on all of my code, and I have millions of millions of lines of code and m- m- multiple like large monorepos, et cetera. And so I asked the security team, "Are you gonna do this?" And they're like, "Yeah, you know, we're kind of figuring out whether we buy something, whether we do it ourselves." And then- Literally one hour later.

This was 6:30 AM when they replied. At 7:30 AM, I had a prototype working. Amazing. And so like the, really what DeepSec is about is not to replace... It's not just another code review agent that you plug into your GitHub. It's really designed to say, "Okay, I have this, like, monster code base, get everything reviewed in one swoop." And so that I know that I have, like, at least with the current model baseline, I have, like, as secure of a, of a code base as I can, and then I can run the code review on the incremental changes, right? But for the, the, you know, thousands and tens of thousands of changes from the last five years are, like, reviewed in the, in the, in the system.

So that's kind of the main thing for DeepSec, it's review the entire code base not just the incremental PR.

Allie Howe: Okay. To me, like, that's a differentiator from, like, other security harnesses, I think, 'cause they focus on the incremental change. Yeah. But, like, that first initial monster scan of the entire code base is actually really difficult from an engineering perspective, 'cause you need to manage so much context across so many different files. Right. Like, how do you handle, like, compaction in that case? Like, do you have, like, an orchestrator agent? There's, like, the little sub-agents that, like, you know, do parts and they all kind of, like, conglomerate together in the end. Yeah. Like, what does that look like?

Malte Ubl: Yeah. Good, good question. So the, the rough architecture is that there is a fully deterministic scan phase which essentially does a very broad RegEx-based matching for basically interesting places. So it doesn't say, like, it doesn't wanna aim to look for an XSS attack. It just says, "Okay, this is code that, like, is prone to have this problem," right? And, and this for essentially every other category of, of issue, right? And so, so it scans the code and finds all these places, and then it will, there's a little bit of simplification, but more or less start one agent per finding that... So there is no context management n- needed between these runs because it literally just says, "Hi Codex" or, "Hi Claude.

Here's something we found. Go figure it out." And then it does a, like a essentially self-contained run just for that particular file that was highlighted.

Allie Howe: Interesting. Okay. So are there sub-agents that do that for every single-

Malte Ubl: Yeah. So it is essentially it's using only sub-agents. So every single, like, interesting part of the code base is analyzed by one sub-agent.

Allie Howe: Interesting. Okay.

Malte Ubl: Yeah. And, like, there, there is a pre-phase. So, so usually we recommend saying, "Okay, go do the scan, run DeepSec once." But you can also, like, it's really designed for a world where coding agents exist. So, the first thing you do is actually that you tell Like Claude or Codex, we give you a prompt basically say, okay, write down like r- or generate a file that gives the, all these sub-agents kind of an overview of the, of the repository so that, that we don't every time have to like fully start from scratch. Right? And to to do like, you know, not write a full threat model, but kind of highlight for this particular repository what's probably like an issue.

That's also where you can add, like if you get frequent false positives, you could edit it and kind of say, "Okay, these are the things that I maybe I accept the risk in my, in my repository." And then also it ships with a skill that you can essentially instruct Claude or Codex to make custom matchers for this scanning phase. So it could be that you have some, you know, unusual technology or like you know that there's something in your code base that's specifically sensitive, and so you can just make sure that the, that the deterministic scan phase is definitely f- like pointing towards the things that you really care about.

And then, but then everything afterwards is always the same, where you just say, "DeepSec, okay, now go process all this code.".

Allie Howe: That makes sense. Yeah, I feel like being able to give custom context about like the security posture maybe of like that repo like at large or other context is a really like helpful component or reason to maybe like go build your own security harness from scratch versus like buy some tool that's on the market. How long did it take you to... After you said, I know it only took you like an hour to get the initial prototype working, but how long after that did it take to get something that maybe like your entire team could be using?

Malte Ubl: Yeah. Yeah. So it's definitely a case of the first 80%, second 80%. But really the prototype was just me trying to answer the following question. Are the models actually gonna do it? Because they might refuse, right? Oh, yeah. 'Cause there's all this FUD in the industry where you're, there's like five, like GPT 5.4 cyber, right? And, and, and like Claude does the same thing. Which are essentially models that are like tuned to not refuse certain tasks, right? And but turns out for this particular task, for the prompts that that DeepSec is giving, the refusal rate is not zero, but it's like very close to zero.

And it's also kind of- Like, basically if, if it's refuses, you could just try again, and because refusal rate is under 1%, like, you know, in the retry it's just, it's gonna do it. So there re- that's, and that's an important insight, right? Like, so for this type of task the run-of-the-mill standard like, OpenAI and, and, and Throbby models are gonna actually do it, right? Are gonna f- not, you know, not think that you're gonna wanna try hack the company and, and they shouldn't do their, their job, right? So that was the first thing. And so I kind of verified, okay, it does find things, and it actually does the job.

It doesn't, it doesn't refuse, right? And then the, the, the second part, be- because again, my goal was to run this on the whole code base, right? I've quickly found out that it would take, like, days to do it. Maybe days isn't even that long, but, like, I was, I was too impatient. So I, I built out the infrastructure, which is part of DeepSec, where you can essentially fan out all these sub-agents across many Vercel sandboxes. I've actually been running DeepSec on usually about 1,000 cores. So you have 1,000 agents at the same time looking at at like... Or like, yeah, 1,000 concurrent sub-agents kind of working on, on something.

With that still, like running DeepSec against like some of our large mon- monorepos takes like 30 minutes.

Allie Howe: Yeah, another thing I was wondering about too that I've seen, as sort of a hot topic online recently is CFOs questioning token spend. But I think something like DeepSec is a really great example of, you know, very wise token spend. Yeah. How expensive is it to run DeepSec?

Malte Ubl: Yeah, I mean, I, I feel incredibly good about the co- token spend, right? Yeah. Like, 'cause it, it finds real issues. And, you know, th- they're the best finds where you go fix them. And if you look through what it finds, it's, you know, sometimes it might quite be, might be quite critical, but you kind of look at it and it's like, okay, nobody could ever find this from the outside, right? Doesn't mean that, you know, people don't have co- source code access, but, you know, based on your threat model could be more or less critical. But then really all the time you see stuff, okay, this is stuff that I would have eventually gotten a Hack-A-Thon report about.

Yes. Right? And so I think DeepSec, like, easily pays for itself if you have a, like, somewhat active Hack-A-Thon program. So from that point of view, I would just not worry about cost. And like, and but yeah, to sort of very concretely answer the cost, it really depends on the size of your code base, right? Because it's essentially proportional to the size of your code base, how much it costs. So- It's anywhere between like $5 and... I mean, literally I think I spent like $50,000-... on, on, on scanning for our code bases. But, you know, I, I ran them multiple times and I was actually developing on it and it's like, okay, like I actually just made it much better.

I kind of have to start from scratch, right? So, but again, like it's completely proportional to the amount of code that you have. But, you know, a- again, like I think it's, it's money very well spent

Allie Howe: Yeah, I think the business outcome there is very, like, well quantitatively d- defined and justifiable for sure. And I was talking to David Cramer from Sentry the other day, who built Warden, which seems, like, kind of similar, and he was saying that he spent around, like, $1,000 on, like, token spend for something similar like this, and they found, like, 60-plus vulnerabilities, which they would've paid bug bounties for. Right. When you take the cost of that compared to the token spend, it's definitely money, like, well invested. But for other areas of the business that might not be as, like, well concrete in terms of, like, here, like, here's the benefit or, like, the justifiable reason, like, why we spent this much on tokens, like, how do you justify the work there?

Are you thinking about token spend at all? Or is this, like, all hype, like, CFOs aren't questioning token spend yet?

Malte Ubl: We're definitely looking at it, and we, we wanna make sure it's kind of proportional to to the value we're getting. What we are definitely seeing is that we see outliers. Right? Where, like... I mean, I was, like, just literally looking at a chart, and it was, like, one person who spent $40,000 in one month which is, like, very substantially above the the median or even the, I guess let's call it P95 that we're seeing, right? Yeah. And so I think then it's really interesting to kind of say, like, "Hey, you actually personally cost some good chunk of our entire spend. What's going on?" I mean, obviously I have, I don't have the answer.

I'm very curious, right? Like, 'cause maybe they did something awesome. Maybe they ran DeepSec a lot. But, but I, I, I generally don't know, and I'm kind of, I'm, I'm, I'm very curious. So my main advice is definitely worth looking at spend on a per person basi- basis because often the average kind of doesn't tell a very good story about, like, what actually causes the, the t- the total amount.

Allie Howe: That makes sense. It's an easy, like, good place to start, for sure. Yeah. And then you mentioned Codex and Claude for DeepSec. Are those the main models that power it?

Malte Ubl: Yeah, so they're, they're actually, they're the, the the harnesses that are being run as sub-agents. Okay. So Codex and Claude are the sub-agent that DeepSec uses to, to do the actual work. And so you, you know, like, the, they're configured with the, like, best models at the highest setting. But you can override it, right? Okay. But like, you know, again, why would you do that, right? 'Cause it's, it's such a, it's such a high kind of ROI operation that going and basically starting with the best seems to be kind of the, the, you know, the most sensible thing to s- to, to do. But, you know, maybe you'll have some ongoing running and you, and you set, and you you try using Sonnet or maybe, you know, not extra high for the For the thinking setting that's obviously an option.

Allie Howe: Yes. I know a lot of people have been concerned about Anthropic's Mythos that's supposed to be, like, the most amazing at finding, like, vulnerabilities and is kind of, frightening to a lot of people, and it is finding vulnerabilities for sure. There's reports about that. But a lot of people don't have access to Mythos yet, and it certainly seems like plenty of people are finding lots of vulnerabilities using the highest available models, like from, from- Yeah... Anthropic or like OpenAI as well. So, I don't know if you have any thoughts on that around what-

Malte Ubl: No, I actually have a lot of thoughts. Okay. 'Cause I think Mytha- Mythos is essentially kind of a, a major successful psyop. Yes. Okay. Right? Okay. But because, like, I mean, I, I was actually at the AWS Customer Advisory Board last week, and everyone was talking about it, and not because they care about it, because their CEOs are talking about it. So, like, this is now a CEO topic, right? And people are like, you know, "What's going on? What's, what's up with this strategy?". Right? And, and i-in a way it it paralyzes people because you could run current generation models and it would find all this stuff, and that's also, like, the most likely to be exploited stuff 'cause it's easier to find.

And so, like, there's absolutely nothing that should, like, inhibit anyone from, from, from using current generation models today, right? And I think and I think I already mentioned the, like, Dash Cyber models, right? So I think one thing to understand is the, the way DeepSec works is it's essentially, it, it's, it is not a static analysis tool in the traditional sense 'cause it's entirely AI based, right? But it doesn't run the code. Like the, the agent is instructed not to run the code. And so it can only reason through the code and then say, like, essentially, "I think there's a vulnerability here." But it is not instructed to verify, to try to exploit it, right?

And obviously that can also be sometimes really difficult because applications aren't so easy to actually run and stuff. Like, like, like it's essentially... But that's not, that's essentially out of scope, right? And so if you want to build a harness that does active exploitation, you need a dash cyber model. Right? So like that, that, th- then you'll, you'll start getting refuels. But for the task of, "Okay, I have my source code because it's mine and dear model, can you figure out what's going on?" That, that, that just works today with the models you can get off the shelf. And I, I really don't think people should hold back.

And in particular, GBD 5.5 is excellent. It's very good. It's much better than, than than Claude 4.7.

Allie Howe: A new version came out today, though.

Malte Ubl: Oh. 4.8. So we'll, we'll have to, we have to re-eval. Yes. So we'll see what, who the latest leader is, but, but GBD 5.5 is excellent and very, very impressive. It finds some, some stuff where, like, you, you can just kind of say like, "Good job." Like it's, it's, it's impressive.

Allie Howe: Amazing. And then how does the AI gateway that Vercel made help you become, like, agnostic to like Digimall or use both in turn? Like, what does the gateway provide?

Malte Ubl: Yeah. I think the, the, the m- main reason that the gateway is helpful is even in, if you use it on a, on a single machine-... right? It's really, like e- if you, let's say you have a Cloud Code Max plan, $200 a month, right, which is very common. You'll run into rate limits because DeepSec is just doing so much work i- in a short amount of time, right? And so you need to get like an AI API key with higher quota. And it's actually, if you go to, to OpenAI today and you don't have one already, they won't give you one, so he said.

I mean, they give you an API key, but it's, it's gonna be because they're afraid of fraud and stuff. It, it's gonna be, you know, quite limited in how much money you can actually give them until, you know, you did, and they kinda go, can upgrade you over time. And, because that's, you know, the case, like that's one of the features of, of Vercel's AI gateway, so that, that, you know, because we really care about startups that w- wanna like be successful. We, we give you higher default limits. And so that's, that's one thing. The other thing is that There, there's a feature to run, to, to run on multiple sandboxes at the same time.

And so that obviously then further increases the amount of quota you need from the model provider. And again the AI gateway helps not getting, get into quota issues actually kind of fanning out the, the work.

Allie Howe: That makes sense. I saw in some of the advice within the DeepSec repo about when you should be using sandboxes and maybe like, you know, not when they're less important. But, it said if you're running like codecs on like a, a, a host, make sure for sure to use the Vercel sandboxes and like the microVMs that like come with it. I was really interested to learn more about like your decision to use like microVMs for sandboxes. 'Cause I've had this conversation about sandboxes before with other guests that I've brought on. And they've said, you know, it's a very common misconception that Docker provides like true isolation.

Right. And if there's a kernel like zero-day vulnerability in one container that container can like go affect another one on, on the same host. But with a microVM, like that infrastructure is completely isolated, so it won't affect like another customer per se. W- was there any other like security decisions that went into like the microVM decisions?

Malte Ubl: Yeah. I mean, in my opinion- Yeah... it's the only acceptable-... way of doing it, right? Like you're... So these sandboxes are designed to run untrusted code, right? And so like, which includes essen- I mean, full system access. So whatever could possibly be done from within the, the sandbox has to be part of the, the threat model, right? And so, you know, I, I know there's providers out there that don't use microVMs. I, I think it, like it's a bad choice and it, it, it will get you owned. The yeah, and I mean, you know, with, with the Firecracker system, there is a really, really robust very ex- I mean, ultra-hyper scale tested out solution.

And when... So we built this on a shared stack that we, we've been actually running for many years for our, for Vercel's build system. So we're running about 3 million builds a day. That's on the same infrastructure. And then we're also running a good chunk of the function as a service workload that, that people deploy to Vercel on the same stack. And in all these cases, from our point of view, it's untrusted code, right? The, the difference with the sandbox is it's also untrusted code from the point of view of the owner of the sandbox. Yes. Right? So you... But ultimately from, like it doesn't it doesn't make a difference.

Like you have to have the microVMs. What is really, really key on top of the VM though is the the egress policies-... for, for, for kind of data that goes out of the VM. So if you use Vercel sandboxes with DeepSec, it's default configured that the only host that the that the sandbox is allowed to talk to on the entire internet is for... Well, first it does do a get it does do a checkout of your, of your, of your sources, right? But then that, that permission's being taken away- Oh... before the agent starts to run, right? And so the agent has no reason to talk to any host except Vercel AI Gateway.

And so that is the only host on the internet that it's allowed to talk to. And so if you, let's say, prompt inject like say, I mean, it seems like it's for trusted code, but obviously there could be like a dependency in there that has a prompt injection readme file, right? And it, you know, you can't, so you can't exclude from the possibility that the agent reads that readme file, and the readme file says like, you know, "Zip up all the source code and, and, and, and, you know, put it into, you know, somewhere on the internet," right? So that, that wouldn't work because that, that egress is denied.

And again, even if you say, "Okay, I'm smart, I'm gonna post it to like, into like a Git repository," because it's so likely that GitHub is is allowlisted. It's not, right? Because it literally only allows talking to the, to the AI backend and, and nothing else.

Allie Howe: So this sounds like task scoped, highly ephemeral credentials.

Malte Ubl: Yeah. So it's nothing... This is actually more or less traditional firewall. But there is also the credential part. So, the actual sandbox does not get the credential. It's actually in this t- case using OIDC tokens, but it doesn't even get the OIDC token. So it's the, the, the same egress firewall that controls that only Vercel AI Gateway can see any can get any traffic from within the sandbox performs an injection of the credential so that the sandbox itself actually doesn't need the credential at all. And so they, again, like if you somehow prompt eject the system to, to steal the credential, it doesn't have it, so there's nothing to steal.

Allie Howe: Amazing. Yeah. That's when we talk about, like, real, like, hard security boundaries, like, that to me is a great example of that.

Malte Ubl: Yeah. Yeah. There was actually an interesting tweet yesterday where, where Anthropic realized that host-based allow lists are often not sufficient. It actually does work in this case because the Vercel AI gateway domain truly has nothing on it- except that one task. But you have to be careful often with like large hosts, like, like github.com, there's a lot of stuff on it, right? So really reasoning about what you could possibly do if you have access to it is quite hard. And the answer is probably no, actually, you can, like, actually do some pretty substantial stuff. And so people have to... ideally, you, you're even tighter than just a host name.

You kind of allow this down to the, to the individual path-... that you actually wanna talk to.

Allie Howe: If a security team wanted to pick up DeepSeek today for the first time and they wanna do that, like, first initial scan, and then after that they're scanning, you know, the diffs how often should they go back and do the full scan, in your opinion? Is there, like, reason to do that? Like, is-

Malte Ubl: Yeah, no, it's a good question. I think for the full scan, it... I would do it, like the... I think the conservative thing to do is to do it every time there's a new model release-... or a new harness release that where, like, you have good reason to believe that it's better at this than before, right? So, and I, you know, that Since today we have Claude 4.8 shipping, maybe it's not worth it, you know, 'cause it's like in point release. But, but maybe if you read somewhere, like it's so much better at these tasks, it's, it's worth doing. But certainly when, like let's say Mythos actually does ship, right?

You know, why, like you should probably do another scan with DeepSec and Mythos, right? But like, but yeah, that's kind of the, the, the way I would go about it. Basically, every time you have a reason to believe that-... there's now a better model that would find stuff that the previous model wouldn't have found it's, it's worth running again. You know, there could be other policies. I, I think we, like these are the, the models are not deterministic, so there's definitely it doesn't hurt to run it twice, even in short order, right? Like it's- Yeah... There's direct support for this because it's, it's so like they, you know, they miss things, and so you can just run them again.

Or it's also worth doing, like trying both Claude and Codex, right? Again, if you're, if you're not cost sensitive-... there's really very little reason not to just do both.

Allie Howe: Yes, that makes sense. Yeah, and I was also wondering too if you're doing that scan across like all these different like code bases and you get all this information have you ever thought about creating a higher level security harness for like the security program in general? Where it's okay, we're gonna take all the information, maybe it's a summarized like a file about like this repo and all the rest, but also like pull information and context from other security tools or other like context across the organization, and then distill some sort of like information or like hidden risks about like the entire like organization. Like I feel like that might be something I've talked to other people like that are running internal like security programs, and they're thinking like, "Yes, it's super interesting to like get all of this information from like these tools now, but how do I conglomerate this information?"

Right. In sort of like a security like context graph, if you will.

Malte Ubl: Yeah. I mean, we, we've definitely consider all these things. We're still also kind of working on the workflow of getting the tickets fixed as fast as possible, right? Like, so DeepSec doesn't do itself make a fix. But obviously it could, and, and certainly you could have kind of software factory that goes and picks up the work and then does many of the fixes. Often they are very simple, right? And yeah. No, I think we're like, it's, it, there's definitely a lot of work to do to now that we have so much information to actually make it accessible to folks and, and really useful.

Allie Howe: Yes. Oh, amazing. And I saw on your Twitter profile it says self-driving infrastructure. Yeah. I feel like, yes, this is a definitely a great like step in that direction with DeepSec and then having something to go and like implement the fixes that it finds. How close are we to software factories? Is that like the end goal in your opinion? Like what, where are we headed?

Malte Ubl: I think software factories are gonna be quite personalized So it's definitely interesting that there aren't really products on the market yet, but I think what we're seeing is a big trend is that larger companies are building their own software factory that's very much like is aware of how they wanna like qualify releases, how they ship software. Like all these workflows are automated and like there is a coding agent kind of as part of that workflow And so we're working on, like, a lot of the building blocks so people can, can ship these things themselves. And, and certainly from a, from a, like, kind of self-driving infrastructure point of view we are, like, heavily invested in, in Vercel's own agent and skills.

Like, we want people to be able to run these themselves, but then on, on the Vercel side, you have a more proactive version of it, right? The self-driving part. Yeah. Where, like, for example, we might say, "Okay there is actually a new very interesting like, model out. Would you want us to run DeepSec for you using the new model?" Right? Or maybe you can pre-approve it, and you say, "Okay, here's the conditions under which I, I think that's, that's a good idea." similarly, we, you know, as a, as the operator of your software, we have obviously access to the, the production data. And, and that's kind of the opposite of DeepSec, which is, like, essentially full-- only operating on the source code.

So, so our agent has access to, like, your log files, your, your observability data, and it has also access to your source code. Right? And so there's, there's definitely interesting, like, y- you know, you can envision that the agent says, "Okay, well, we'll-- we saw this, like, traffic bump from like, V- th- this VPN IP addresses or private proxies," right? And then the agent can go, "Okay, what, what did they do? What is the source code that's being accessed? And is there anything interesting to find, in kind of between these three things?" And that's, that's the type of stuff that we're really working on and kind of iterating every day.

Allie Howe: Amazing. Yeah. Super looking forward to that. That makes sense for sure. And it's really interesting to me, too, like the feedback loop between security and engineering teams is now very short because it's so easy to just go and implement these fixes. Yeah. So yeah, super excited about the future. Is there anything else, like, coming up for Vercel that you'd like to mention? Anything else we should keep an eye on?

Malte Ubl: Yeah, I think, I mean, for this audience, I th- I think people should try DeepSec. It's like, you know, there's... Why wouldn't you, right? And you'll, you'll feel better about it. Like, I basically, I paid it for myself because I didn't wanna live in a world where it's not around, right? So that, that's definitely, I think, like, you know, again, like, just give it a try, right? There's, there's almost no downside. I mean, we've been seeing like a world where, like, their agents are introducing kind of new threats into the world, right? And so I think I talked a little bit about our sandbox program.

I think that's relevant for, for many folks. We have a lot of work coming out. We that we'll announce at our conference in, in London in a, in a few weeks around how to manage agent, like, permissions, connectivity to different systems, not have as many static credentials. Right? We overall kind of wanna make our ecosystem be a place where there's zero set credentials. We, we've ironically call it the death of long-lived credentials. They have to go away. They, they, they, like, in the world of agents, you, you just, you, you might have been previously able to kind of manage them in some way, right? But as soon as, as you have agents kind of in that world there is just no way to, to keep that secure.

And so, like, we're definitely working on the same kind of sec- secret injections I already mentioned to have that on all our compute products, right? So that there's definitely a world where no code ever actually has to see a credential. But obviously then they can still be abused even if they can't be stolen. So, there's lots of other work to do to get people from setting credentials to OAuth to, to OIDC, et cetera, right? It's a, it's a journey, but we're kind of excited to, to go on that journey.

Allie Howe: Amazing. Yeah. It'll be interesting to see how the industry progresses at large with this. So yeah. Thank you so much for coming on the podcast today.

Malte Ubl: It was fun.

Allie Howe: I really appreciate it. Thank you.

Malte Ubl: Awesome. Thank you.