Titan Talks with Paul Rockwell - Agentic AI: When Bots Stop Being the Enemy

The core shift is this, for 20 years or so, trust and safety has been built around a binary. Is this a human or is this a bot? And bots are bad, and that distinction is about to become irrelevant for everybody. When a legitimate AI agent books a flight, negotiates a price or files a support ticket on behalf of a user, it looks exactly like automation. And it looks like the thing that we've spent most of our career trying to build systems to block.

So the playbook has to move from detect and block all non-human traffic to understand the intent and the authorization of this automated traffic. Who authorized the agent? What's its scope? Is it operating within the boundaries that the user set? That's a fundamentally different problem than we've been solving.

So your detection stack needs an identity layer for agents, not just users. And policies need to define what agents are allowed to do, not just what humans aren't allowed to do. And so the, volume and speed of those interactions is gonna go up by an order of magnitude, which breaks almost any system that still relies on human review as a backstop.

So teams that adapt the fastest are gonna be the ones that stop treating all automation as adversarial.

So I'm looking at three things that aren't really getting enough attention. First is agent-to-agent interaction. We're heading into a world where my AI agent is negotiating with your AI agent and there is no human in the loop. The abuse patterns there are completely uncharted and it's unclear like, what does fraud look like when both sides are machines?

We really don't have frameworks for that yet. Second, the collapse of the cost curve for sophisticated attacks. Things that used to require well-funded operations, crafting a convincing persona, generating realistic documents, running multi-step social engineering schemes are all now accessible to anybody with an API key.

That's not a huge problem. That's a problem that's happening now, and it democratizes the attacker side in a way that most defenses aren't priced to handle. Third is model poisoning and prompt injection as an attack surface for the tooling itself. Trust and safety tooling. If your detection systems are running LLMs, and let's be real, most of them are running LLMs, adversaries are gonna target those models.

So your defenses are becoming the attack surface, and that precursive risk is, I think, pretty deeply underappreciated.

Well, the misconception is that your defenses were built for a world where attacks are repetitive, right? So bots run the same script a million times from the same infra, and are utilizing behaviors that aren't common for most users. When you pattern match, you win. And that's, the model we've all spent the last 20 years building against.

And that game is no longer really gonna be relevant. Agentic AI breaks that model because each attack can now be unique. An agent can read your error messages and adapt in real time. It's gonna try different paths, try different ways of doing things, and do it all in a single session. So it's not a replay attack, it's a reasoning attack.

And those rules engines see that attack once and it's not enough to establish it as a pattern. And the other thing that changes is multi-step, multi-platform attacks become relatively trivial to orchestrate. An agent can create an account on one platform, build credibility over a period of days, extract data, and use it on a second platform - all autonomously. So no fraud tool is watching a single interaction in a single session on a single platform and going to be able to identify that that's a problem.

Build your agent identity framework now before you need it.

and here's a little bit more of the thinking behind it. Every organization I advise is generally in one of two modes. They're deploying agentic AI internally and asking like, how do we govern this? Or they're seeing agentic traffic hit their platform externally and asking how do we distinguish good from bad traffic?

And some are dealing with both simultaneously, but the connective tissue across all of it is identity. You need to know which agents are operating in your environment, who authorized them, what permissions they hold, what they've done. That's your audit trail. It's your abuse detection foundation and it's your liability framework all wrapped in one.

If you wait until agentic traffic is 20, 30, 50% of your interactions, and that's when you start trying to figure it out, you're way behind. So organizations that get this right in the next 12 months are gonna have a structural advantage over those that wait. It's not just in security, but also being able to really embrace the legitimate agentic use cases that their customers and partners are gonna start to demand from them. So don't just defend against agentic AI; build the infrastructure to trust it where trust is deserved.