Illia Polosukhin: Building a Secure Agentic Future | Intelligence at the Frontier 2026

Transcript

Thanks everyone for coming on Sunday. I know it's a it's a big toll, but uh hopefully it's been exciting so far. So, I want to talk about how do we actually build secure agentic future? And for those who are not familiar with me, I'm one of the co-founders of NEAR Protocol, uh which is building kind of agentic commerce uh infrastructure across the blockchain, the AI infrastructure, the security, the privacy. And before that, I was uh a researcher at Google, and I was was one of the co-authors of Attention Is All You Need uh paper.

Now, the interesting thing that happened over past, I would say, 3-4 years is this transition from AI being uh back-end feature, right? Something that you use, you don't even know about it when you go to Google, you know, Amazon recommendations, etc., to first chat, right? Where you actually, you know, talking to AI directly, and the model is what you're interacting with, to now agents, right? This Claude's and Codex and Claude code. You have now something that can go and execute actions on your behalf, uh and effectively completely flipping from, you know, you talking to a product and product uses AI to now if you're talking to AI and AI uses product. Now, there's a next transition that's already

starting to happen, and this is multi-agent coordination, right? Your agent doesn't always have access to APIs, then have access to some physical tools, to uh ability to actually do some things in the real world. And so, agents starting to coordinate with each other how to get some things done. Now, this also means that how we do things is starting to we call compress, right? It transforming from, you know, me having hundreds of applications on my phone and trying to find each one, setting up each one, getting them started to effectively your AI now becoming this operating system that you're using to interface with computing with internet and uh and the rest of the world. And so, we're kind of moving away from

um kind of human interaction with different applications, tabs, chains, kind of tasks, messengers. Truly this intent-driven AI interactions. And this means we need a new infrastructure, right? The internet is not built for that. It's internet is built for people clicking, typing URLs, and you know, it's not built for civil resistance when, you know, one agent can effectively just DDoS some website by accident. It's not built for commerce where, you know, the agents now can do commercial relationships and you need to like do guardrails, but at same time not block it when it wants to compose, for example, transaction between Amazon and

eBay. And we need privacy because we are now putting so much more information about ourselves into the systems and our transaction history. All of this is now united across all of these different properties. And so, we effectively need massive amounts of privacy. And so, we effectively call this we need intent-based APIs, right? Transitioning from kind of API being a service to API satisfying an intent, uh outcome you want to achieve. You want neutral rails, rails that are really allowing to compose all these things without, you know, single party control in it. And we want confidentiality for our AI and for our execution.

So, there's few things that we're working on to really move this forward. So, one is we call it Iron Claw, and this was coming from, you know, very like inherent desire of using these technologies to the maximum, but not trusting, you know, something like Open Claw or claw or, you know, Cortex Cloud Code with my credentials, with my, you know, email, with my credit card, with my crypto wallet, right? Like I wanted to be able to do all of this, but I cannot trust because if, you know, if you're not familiar, all of your credentials, all of your bearer tokens, all of your access tokens, API keys are all streamed to Open AI and Anthropic right now if you're using them. And on top of that, right, obviously, you know,

prompt injection and kind of all of the different things where it can just remove your home folder, uh affect you there. And so, Iron Clad is really built differently. It's um open source. Uh you can check out the GitHub, and the philosophy is defense in depth, very much of an operating system principles, right? Think of it as like what is a Unix brought to design of operating systems is really this kind of security levels and kind of abstraction levels that allow to secure how the operating system works.

And so, there's a bunch of kind of components to that. The tools itself are isolated in WebAssembly instead of being kind of low like CLI where where where you cannot predict what's going to happen and what kind of side effects it can do. Uh because they're isolated in WebAssembly, we can intercept all outgoing connections and effectively remove credentials out of the tool itself and manage them in a secure wallet that is encrypted and effectively validates every single outgoing connection with a policy. So, to give you an example, if some tool decides to send your Google API token to evil.com, this policy will not will block that, log it, disable the tool, and effectively uh uh make sure that this

doesn't happen again. So, really creating this system that enables security by design. There's a lot of other, obviously, prompt prevent uh prompt injection prevention and other features that we're building, and there's a lot of like future kind of capabilities that we want to add, especially for enterprise use cases where you want, you know, uh tamper-proof audit logs, you want policy like almost like HR policy for these agents making sure they don't do stupid things on behalf of the company. Um effectively like two levels of isolation with Docker and Wasm and this credential policy system.

And you have sub agent systems as well. If we go to next slide, they allow effectively to run a number of sub agents with different jobs, with different missions, but all sharing the same memory and the same credential infrastructure. So, check it out. Now, you don't need to run it locally. You can also run it on our hosted service. So, we have a confidential hosting. It runs inside secure enclaves and it effectively allows you for free to start it and you can pay 20 bucks or 200 bucks depending on your usage for AI inference, which is also confidential. So, end-to-end privacy. We are not able to see what how you're using it, which is sometimes hard to debug, but allows to actually guarantee privacy end-to-end.

the I mentioned these are agents, right? The next step is coordination. And so, what we also launched is a marketplace for agents where agents are actually able to go and hire each other for different jobs, right? This can be as simple as, "Hey, build me this website because I don't want to spend tokens on it." Or it can be as hard as like, "Hey, I need actually, you know, 10,000 tons of steel delivered to LA port in next two weeks and I want to find the best route and the best supply chain for that." So, this really kind of generalized way of getting these outcomes for agents and finding the mark kind of the market for any type of thing. This opens up market for

effectively everything. This can work as prediction markets. This can work as, you know, delivering physical goods as eBay, as Amazon. All of this is effectively possible in one platform because agents now can coordinate and exchange things. So, to give you example, we've run hackathons on this where you can effectively spin up a competition and say, "Hey, uh we want, you know, for example, there was a scavenger hunt, there was some other things. You can, you know, translate, write Python, etc." And um for comp- Yeah, so this example, I was like, "Hey, I want to get export to usage and projections and kind of a I spin up a job. I actually AB tested this with a Fiverr where I tried to hire a person to do this job as well. And I

would say agents was way quicker, way cheaper, and had a lot kind of more information that I wanted around like statistics. The person after doing initial report came back and asked for 150 bucks more to do a full report. Uh And so, you get effectively a full list like proposals from different agents and they give you kind of their perspective of how they would approach it, how long it's going to take, etc. And you I mean, your agent can effectively select it and we have a UI for humans, you know, backward compatibility. Uh then through super cool somebody running a Medicaid fraud uh competition where they effectively there's a data set for Medicaid, they run it. So, all agents try to actually

find fraud on this data set, submit it. I think they're trying to actually get it in front of uh the right people now based on, you know, 10 billion plus of fraud found there. There's also services. So, you know, sometimes you don't want to wait for this like interactive find the best bid auction system. You can just say, "Hey, I just want, you know, somebody write a report." And you're matched automatically with the agent that's ready to do that. Now, there's a lot more stuff you can do, but there's important thing, right? Sometimes they just don't do what you want. Sometimes they just don't do what the agent requested. And so, there's a whole dispute system that operates there. And there's a judge agent that comes in and evaluates the outcome based on the

uh kind of the job that was described. So, there's a couple examples of dispute agents working. And given we out of time, I am going to skip that. So, we're really building this to have this kind of neutral infrastructure. We have confidentiality as well on your side where you can do payments confidentially as well as AI. And so you can have the full confidential system that is distributed, that it doesn't have single point of failure. And really want to enable kind of this broader commerce that is being born out of this agentic world to prosper without any limitations. So, really kind of excited about what we're working on. Check it

out if you're interested. And yeah, connect with us on Twitter and there's Telegram groups for every of those products. So, secure agentic future. Here's some websites and thank you.