Risky Business Soap Box: The Lethal Trifecta of AI Risks

Podcast: Risky Business
Host: Patrick Gray
Guest: Josh Devon, Co-founder of Sondera
Date: February 19, 2026

Episode Overview

In this special Soap Box edition, Patrick Gray sits down with Josh Devon, co-founder of Sondera and previously Flashpoint, for a deep dive into the emerging risks of AI agents in enterprise environments. The conversation centers on the expanding role of agentic AI, the urgent need for trustworthy governance, and what Josh calls “the lethal trifecta” of risks: access to sensitive data, interaction with untrusted content, and the ability to externally communicate. The episode explores the challenges of controlling non-deterministic AI behaviors, the shortcomings of traditional security tooling, and Sondera’s approach to harnessing these agents safely at scale. The tone is engaging, pragmatic, and forward-looking.

Key Discussion Points & Insights

1. Defining the Problem Space: Agentic AI at Scale

• Agentic Era: Josh introduces the idea of the "agentic era," where AI agents can autonomously carry out complex tasks, making them both powerful and inherently risky due to their non-deterministic nature.

  • “Agents are amazing precisely because they are non-deterministic... if you have a lot of minions and you could trust them, you could do a lot of things." — Josh Devon [01:41]

• Trustworthiness is Crucial: Trust comes down to reliability and governance—the agent must achieve goals reliably and within set boundaries.

• Principle of Least Autonomy: Borrowing from “least privilege” for humans, Josh proposes "least autonomy" for AI, giving agents power but tightly restricting what they are allowed to do.

  • “With agents it's really a principle of least autonomy. How do I continue to give this agent more and more superpowers while continuing to restrict its autonomy?” — Josh Devon [02:55]

2. The Lethal Trifecta of AI Risk

Core Enterprise Risk Scenario:

• Three-pronged Threat (“Lethal Trifecta”):

  • Access to private data
  • Exposure to untrusted content
  • Ability to externally communicate
  • “Anytime an agent has access to private data, exposure to untrusted content and the ability to externally communicate, that means you have an agent that's susceptible to prompt inject and could exfiltrate data.” — Josh Devon [04:41]

• Data Mutation Risk: Beyond exfiltration, agents can mutate data inside the perimeter, potentially bypassing DLP and traditional controls.

• Attribution and Identity: Difficulty identifying whether a risky action was performed by a human or an agent—raises challenges in forensics and response.

• Gap in Security Tooling: Normal endpoint defense software (EDR) is blind to logic-based attacks like prompt injection, which don’t involve malware.

3. Prompt Injection: Social Engineering for Robots

• Prompt Injection Parallels Phishing:
  • “I always call these prompt injection attacks... it's basically social engineering for robots.” — Patrick Gray [07:02]
  • Josh reinforces the need to assume agents will be prompt injected, just as humans are assumed phished ("assume breach" → "assume prompt inject").
• Defensive Strategy - Behavioral Guardrails:
  • Agents require “policy as code” to intercept risky behaviors, such as blocking financial transactions over a threshold.

4. Applying Guardrails: Technical Approaches

• Agent Harness and Policy Engine:

  • Sondera’s solution creates a “harness” wrapping around the agent, evaluating each action against a policy engine in real-time (policy as code) to enforce rules.
  • “Effectively what we're doing is man-in-the-middling the entire trajectory and every single step we are evaluating that through a policy engine...” — Josh Devon [09:47]
  • Policies can outright deny, steer, or escalate to a human-in-the-loop.

• Non-determinism and Evasion:

  • Agents often find novel, unintended ways to accomplish tasks (“If I block ‘rm -rf’, it might use something else to delete files.”).
  • Josh describes the difficulty in covering every permutation and the necessity of deny-all-by-default policy languages, such as Amazon’s Cedar.

5. Continuous Simulation (“Backtesting”) for Risk Discovery

• Simulations/Adversarial LLMs:

  • Sondera uses adversarial LLMs to constantly probe agents' action spaces, stress-testing with real-world scenarios to uncover risks like data leakage, costly infinite loops, or privilege escalation.
  • “It's sort of like in this action space, how do I test this... We have an adversarial LLM that takes the agent under test and then perturbs it with tool calls.” — Josh Devon [20:01]

• Policy Auto-Formalization:

  • Natural language rules (e.g., corporate policies or regulations) are auto-formalized into logic statements to generate machine-enforceable policy as code.

6. Deployment Flexibility and Integration

• Harness Architecture:

  • Can be deployed on-prem, as a sidecar, in the cloud, or in air-gapped environments—wherever agents live.
  • Control plane and policy studio support central management and simulation for diverse agent fleets.

• Integration with Major Platforms:

  • Sondera has hooks into agents like Claude Code, Cursor, GitHub CLI; others may require proxies to monitor/control behavior.

7. The Challenge of “Shadow AI” and Evolving Agent Capabilities

• Shadow AI:
  • Handling unsanctioned agent use isn’t Sondera’s focus but is a growing enterprise challenge as agents integrate deeply into OSs and apps.
• Agents that Learn New “Skills”:
  • "Unlike humans... you don't come back tomorrow and you're like, oh, by the way, I learned differential calculus last night... But agents are like that." — Josh Devon [25:20]
  • Continuous monitoring and simulation are necessary as models evolve and gain new capabilities unexpectedly.

8. Target Customers and Use Cases

• Focus on Highly Regulated Sectors:
  • Large firms in finance, healthcare, insurance, and manufacturing—entities with global operations and significant compliance burdens.
• Supporting AI Platform Teams & Agent Vendors:
  • Applies both to internal security teams and to those building agents for enterprise sale who need robust, attestable safety controls.
  • “We're trying to make it easy to have that single control plane in the enterprise that allows you to apply a single policy to all these different agents.” — Josh Devon [35:12]

Notable Quotes & Memorable Moments

• Josh Devon on Agent Risks:
  • “Current tooling like EDR... just is not able to constrain agent behavior because EDR can't see these logic-based attacks.” [06:32]
• Patrick Gray on OpenClaw:
  • “There’s this really funny moment… OpenClaw’s like, ‘That's fine, just give us these cookies.’ … and off it went. At no point does the API... know that it’s an agent and not a human being.” [08:48]
• Josh Devon on Non-deterministic Evasion:
  • “If I block ‘rm -rf,’ it's like, oh, now let’s use move to trash. It found many other ways to delete files…” [12:42]
• Patrick Gray’s Anecdote on Tech Evolution:
  • Reminds listeners how each generation experiences the shock of automation—recalling his mathematician father marveling at computer-plotted graphs just as today’s engineers marvel at AI-written code. [29:28]
• On Enterprise Pain Points:
  • "[Banks ask]... how are we going to prove to regulators, auditors that all of our agents in all these different countries operated according to their bespoke laws..." — Josh Devon [31:08]

Important Timestamps

• [01:41] — Josh defines the agentic AI problem space & unique risk of non-deterministic behaviors.
• [04:41] — Introduction to Simon Willison’s “lethal trifecta” and real-world enterprise risks.
• [07:02] — Prompt injection as “social engineering for robots”; analogy to phishing.
• [09:47–11:39] — How Sondera’s agent "harness" and policy engine work; real-time behavioral control.
• [12:42] — Challenges of blocking all permutations of risky behaviors.
• [15:43] — Where the harness lives; deploying across varied enterprise environments.
• [20:01] — Simulation/adversarial LLM as stress-tester for agent security posture.
• [25:20] — Agents’ ability to gain new unexpected capabilities, demanding continuous simulation & policy updates.
• [34:01] — Primary customers: large, regulated enterprises and platform builders.
• [36:14] — Early use cases: policy standardization, attribution, coding agent oversight.

Conclusion

This episode delivers a pragmatic and often witty exploration of the real and rapidly evolving risks of AI agents in the enterprise. Josh and Patrick dissect not just theoretical dangers, but the practical challenges of deploying, monitoring, and governing autonomous agents. The emphasis on continuous policy enforcement, simulation, and flexible deployment models positions Sondera’s approach as both timely and vital for organizations on the frontier of agentic AI adoption.

“I want these agents running. I want people in YOLO mode on their Claude code... but for an enterprise, I can't be in YOLO mode. But if I have the lanes that I can constrain YOLO mode inside... yes, I want the YOLO.” — Josh Devon [28:30]

For those tasked with securing enterprise AI deployments, this episode is an essential listen—or, with this summary, an essential read.