Charles Guillemet

EP 65 You Can't Secure an AI Agent with Software | Charles Guillemet, Ledger

• Charles Guillemet’s core claim is that securing an agent with software alone is not possible: “Securing an agent is not something possible” in software alone — people who say otherwise “are either a little bit too optimistic or maybe they don’t understand what we are talking about.” The only way to get very strong security guarantees is dedicated hardware, “and when it comes to your money, the incentives for the attacker are very high. So hardware will be part of the equation.” Episode takeaways
• AI has erased the asymmetry that security depends on. His definition: “a system is secure if you achieve to create an asymmetry between attack and defense” — breaking it must cost more than it yields. Before AI, finding vulnerabilities was extremely difficult; now “finding vulnerability is trending towards zero,” and the result is “the very beginning of a big security Armageddon.” Extracting an e-commerce database used to take a talented researcher months for a $5,000 darknet payout, so nobody bothered; now it costs near zero, and the daily data leaks show it. Worse, the rebuttal that defenders have LLMs too is no comfort: “the attacker has only to find one vulnerability while the defense needs to be like 100% secure.” Episode takeaways
• Never hand an agent your credentials — delegate rights instead. Giving an agent API keys or your 24-word seed fails on two fronts: alignment (natural language is ambiguous and agents are non-deterministic, so what executes may not be what you meant) and simple secrecy — prompt injection is not hypothetical: he cites an account on X that lost money after being prompt-injected “just by tweeting to the account.” His model: formalize intents and policies, run the policy engine with execution-integrity guarantees (a secure enclave, or a zero-knowledge proof of correct execution), and keep keys in a secure enclave that signs only policy-approved intents. Episode takeaways