Amir Haghighat (
@amiruci), co-founder and CTO of Baseten, joins us for a practical look at securing AI agents in production—especially when those agents can run code inside isolated computers and retain working state between interactions.
The central distinction is between protecting the sandbox and controlling the agent. VM or micro-VM boundaries can keep one user’s malicious code from reading another customer’s data, but they cannot guarantee what the agent does inside.
We also confront a less comfortable limit: Baseten’s zero-data-retention approach means it does not inspect the inference calls an agent makes. Some responsibility for that behavior therefore remains with the customer.
The stakes get broader when we discuss open-source Chinese models, possible backdoors, and whether the guardrails and monitoring from frontier companies are enough for companies deploying agents.
That is why this conversation is worth our time: it shows how Baseten is bringing inference, post-training, sandboxes, and agent runtimes into one cohesive experience instead of treating them as three different areas.
We learned a ton. Enjoy!
TIMESTAMPS
0:00 Can it talk its way out?
0:26 AI agents have new options.
0:47 Amir Haghighat and Baseten
1:28 Sandbox security boundaries
3:41 Chinese models and backdoors
7:16 Inference to agent runtimes
7:41 Customer assurance process