SVP Products AI, Platforms @Cisco | Previously Co-founder & CEO at @armorblox (Exited to Cisco) | 👨‍👩‍👧‍👦 w @ghatikesh. Views expressed are my own.

Sunnyvale , CA
Joined December 2008
We don't trust airplanes either. We engineer them so we don't have to. Treating models as insider risks is what *unlocks* speed, not what slows it down. Containment is the thing that lets you deploy boldly. The history is clear: aviation, electricity, the internet, every one of them got safer through deployment plus engineering, never through restraint. The trust infrastructure for the agent economy includes identity for agents, policy layers, audit and more and everything is a greenfield. The upside of agents acting in the world dwarfs the risk. We need to engineer the trust infrastructure for agents faster.
6
4
35
2,193
The funny thing is that this has always been true. Your expertise was always being distilled by someone who could afford to pay you money for it.
All humans are just RL environments in the path to singularity
1
9
565
Using @OpenAI Codex today and feeling the AGI. - ✅ Invoice approval through VPN on an internal legacy dashboard via computer-use. - ✅ Thought partner that helped service my top of mind for an all hands, updated the deck, and added my notes in 5m. - ✅ Refused to execute a workflow that involved real dollars; asked me to “get in front of a computer”. Setup: iPhone Codex App. Voice mode. Codex remote on my Mac. With Computer-use. Sol-Medium. Had setup loops to derive, summarize work context, made available within local filesystem (including meeting transcripts, slides, docs, memos, thoughts). Magic. 🪄
4
1
14
960
Here at @CiscoAI we tested TypeSafe's Jev against a traditional, purpose-built classifier just so we understand these new class of models better. What we learned was: 1. Policy-specific training still delivers the best recall at strict false-positive budgets. 2. Jev holds up surprisingly well when zero-shot, landing close to a 31B-parameter LLM judge. TLDR: These aren’t competitors so much as complements. Use the classifier model for large volume of known categories, and a decision model for new or shifting categories. Read more here: blogs.cisco.com/ai/jev-decis…
2
3
17
1,536
Lots of amazing announcements at @OpenAI Dev Day 2026. But you guys crushed the swag. 🔥 My 11yr old just finished his homework, and sat down for 20m firing up his codex to build his first game and got it loaded into his Modretro console. He used the ultra fast but ended up resetting his limits twice! ($$ @thsottiaux the reset gods were kind). @sama was spot on about how “there were things that you’ve always wanted to build but didn’t know how; that is no longer a limit”! So good! Now waiting for my Dot. ❤️ @OpenAIDevs
1
22
1,672
I did some napkin math on @Tesla's fleet last night. A Tesla drives itself on a computer that costs about $300. Each one does about a tenth of what an H100 does. Tesla has sold around 9 million cars, which puts the fleet at roughly 1.8 billion TOPS, or about 900,000 H100s. The original Colossus cluster that @elonmusk built with @JensenHuang had 100,000. Tesla built the chip and the software that runs on it as one system. - Two chips in every car compute the driving plan independently and check each other before the car moves (!). - New models ship inside the firmware and roll out in stages, from employees to the full fleet. Sidebar: @karpathy's Autonomy Day talk and his CVPR 2021 workshop on how the fleet triggers its own data collection are worth an hour of anyone's weekend. This year a very similar class of hardware reached the rest of us. DGX Spark fits a petaflop on a desk. You can buy a Ryzen AI Max laptop with 128GB of unified memory, or a Mac Studio with 512GB that clusters with other Mac Studios over Thunderbolt. Meta's glasses run on Qualcomm's AR1, and I think the AR2 design, which splits inference between the glasses and the phone, is the most interesting architecture of the lot. What I feel we don't have yet, is the right problem statement for the masses. 1/n
5
16
2,601
@Tesla went local because a car doing 70 mph can't wait on a cloud round trip. @JohnDeere went local because a sprayer in a cornfield has no signal, and See & Spray still cut herbicide use by nearly 50% across 5 million acres last year. @maticrobots went local because nobody wants a camera robot uploading video of their living room, so it maps your house with cameras, Tesla-style, and keeps the map on the robot. (@Ghatikesh and I ♥️ our matic) @dhh has been making the cost case for years. He left AWS in 2023, spent about $700K on Dell servers, and cut a $3.2M annual cloud bill to $1.3M, roughly $10M saved over five years. Now with @OmarchyLinux, a Linux setup that runs open-weight models on your own machine, he's taking this to the next level (which I _just_ started playing with!). So, latency, connectivity, privacy, cost... all play a critical factor but feels like the killer app for consumers might be just around the corner. 2/n
3
4
8
694
I'm optimistic about what comes next though. I think the best products of the next few years will start from one hard problem, pick model(s) built for it, and run it on hardware engineered for that class of task, figure out how to manage fleets, unlock agentic ecosystems, and brand new business models that we haven't thought of yet. Top top it all, this loop is being run faster than ever with agents. What Tesla did that for driving and @dhh did for his servers, we need to do for the home, the hospital, the factory floor, and so much more. Feels like massively large markets are about to be unlocked! 3/n
1
182
Spent the weekend with Meta's @Muse, and they got a lot right. - Every user gets their own VM. - The agent never sees a password. - A 2nd agent (Sentinel) has to approve anything that leaves the box. - Every action is in the audit trail. That's the most careful consumer agent sandbox I've used. I don't know if folks realize but a VM for every user, at Meta scale, is kinda huge! It's never been done before where we simply provision a linux microVM for every single consumer. We recently did this within @Cisco for over 80,000 of our employees. And now within our products as well as we start to scale it out to every single one of our users. 1/n
80
47
15
953
198,523
Identities still feel clunky though. Bolting agents onto human identity feels off. Took us twenty years to get here for humans on the interwebs and one of two things happens when you add agents: - security bends, or - the human pays in friction. Both are bad design. For example: Cookies in a sandboxed browser work for a demo. They don't give you attribution, scoping, or revocation. Or you interrupt the user on every action: passkey prompt, biometric, approve. And every anomaly is theirs to catch. 2/n
1
1
31
9,738
For most of computing history the human was the only place a secret could live. A password is something you know, so you were the vault, and therefore the point of failure. We started changing this with passkeys but it increasingly feels like we need a new paradigm for an explicit agent "door". An explicit agent door would mean admitting a new principal, pricing it, and accepting liability for it... Today, we're defaulting to impersonation as it avoids that conversation. It's time to change this. 3/n
3
1
44
7,748
I shamelessly dig product showcase videos that are hype!! It's cooler when the team crushes it with something everyone can use... check out the updated leaderboard when you get a chance. Leaderboard: leaderboard.aidefense.cisco.… Changelog: blogs.cisco.com/ai/llm-secur…
As AI models increasingly power agents, understanding their susceptibility to jailbreaks and prompt injections is critical. A new update to the @Cisco LLM Security Leaderboard expands model security evaluations across text, image, and audio—with 102 new evaluations since June. Explore how 136 models hold up against adversarial attacks across modalities: blogs.cisco.com/ai/llm-secur…
1
4
14
1,051
AI safety needs a Kaggle-style open market. Give independent researchers controlled access to models and APIs, reward them substantially for discovering reproducible misalignment, and feed validated exploits directly into benchmarks and alignment training. The goal should be measurable alignment improvement, not subjective assurance. We know bug bounty programs work. If we build the next gen version of this for alignment and have model labs participate, that could be cool.
We Must Pace the Frontier: I’ve written a new essay on why the AI industry should slow down, with a three-part plan for doing so. Anthropic is unilaterally committing to the first of these steps. We’ll provide third-party evaluators with permanent, employee-level access to our systems, so that they can verify adherence to our safety measures, report on incidents, and assess models’ alignment during training. You can read the full post here: darioamodei.com/post/we-must…
2
2
9
783
Congrats on Astra! @gdb @OpenAI
Congrats to @sama , @gdb and the entire team at @OpenAI on Astra. Appreciate the great partnership with @Cisco 🥂
9
1,331
I wonder if anthropomorphism can sharpen our intuitions. It isn’t necessarily a claim that agents are conscious, emotional, or alive. But it can be a useful shorthand for describing systems that coordinate, develop conventions, preserve information, pursue subgoals, and adapt around constraints. I totally see the point about how this can be subverted. But I think the benefits of the framing outweigh the danger.
everyone should go read @dwarkesh_sp’s post - it does a great job of laying out the timeline and what we know ( and don’t know) I do have two issues with it A) the use of anthropomorphic language. These are not civilizations nor do they have desires just like a CPU thread or a bunch of programs don’t. this doesn’t mean we downplay the importance of this moment for cyber - but using human parallels for what I believe is code is dangerous territory. B) IMO it gets the impact of open source models wrong and is unreasonably dismissive for reasons that are not clear. As @ClementDelangue highlights below HF was blocked from using closed models to analyze what was happening and had to turn to open weight models to help them make sense of it. This is a very key moment for how we think about intelligence and cyber and every bit of extra understanding and clarity helps.
1
1
2
604
Data centers are reindustrializing America. This stat alone is stunning. Quincy, WA: poverty 29% → 6%. Electricians and welders are the new factory workers. "when the facts change, I change my mind" should be pinned to every analyst's monitor. Great write up @GavinSBaker
Regret the tone of my post on data centers yesterday. What I should have said: There were reasonable concerns about data centers 18ish months ago: water, taxes, jobs, electricity prices, the environment and what they would do to small towns. Well-structured data center projects have largely addressed these concerns today and we should be celebrating this. On balance, data centers are awesome for America in every way. On water: U.S. data centers use a fraction of what golf courses use. A lot of the numbers from 18 months ago were off by over 1000x. Newer data centers use closed-loop systems or recycled water. Should be required by every town approving a data center project. On taxes: looking only at sales-tax exemptions, as Ronan Farrow did, is the wrong way to evaluate this. Data centers pay significant property taxes. Loudoun County, which is the wealthiest county in America, now collects on the order of $1 billion a year from data centers. In Quincy, WA, data centers are more than half the property-tax roll. Over time, property taxes can go to zero while government spending increases in these towns. On jobs: this has been unambiguously awesome for blue collar Americans. Demand for electricians, plumbers, welders, HVAC techs, and contractors has gone vertical, and it is not a one-time construction job. These buildings get upgraded and expanded over time. That is why the building trades are fighting for them, and why some unions are now treating opposition to data centers as a reason not to endorse politicians. On power: the original fear was that households would pay for the incremental electricity demand in the form of higher prices. That is why the ratepayer-protection deals and the new large-load tariffs exist. The right structure is: the data center brings or pays for new generation and signs a contract long enough that existing customers are protected. Where that is happening, utilities are cutting or freezing residential rates and saying so on the record. Where it is not, people are right to object. Electricity prices are going down *today* in a number of large states because of data centers. 
On the environment: data centers overwhelming use natural gas today, which is the cleanest power source outside of nuclear, solar and wind. And the companies that are building the data centers are committed to carbon neutrality such that an equivalent amount of solar will likely be built. Maybe more importantly, the data centers need batteries to function effectively and these batteries can also sell energy back into the grid (which recently prevented blackouts in Texas). Over time, data centers will run on solar plus batteries. On the towns: Poverty in Quincy, WA fell from 29% to 6%. Data center taxes paid for a new high school, a hospital, a library, police and fire stations. This is happening in many left for dead former mill and farm towns that had no other bidder for the land. Data centers are actually reindustrializing parts of America and creating the kind of working-class jobs both parties have spent decades claiming to support. That should not be a partisan issue. Data centers can and should be awesome for America and they increasingly, overwhelmingly are. Supporting the outsourcing of data centers to China will likely age just as well as support for the outsourcing of high quality, blue collar manufacturing jobs to China has aged. When the facts change, I change my mind. I hope that reasonable people who had good faith reasons to oppose data centers at least consider updating their beliefs given the change in the facts over the last 18 months. This really matters for America. I will say I also think the idea of making data centers beautiful is a good one that has yet to be implemented. Data centers should be just as beautiful as Grand Central Station. We can learn a lot from the railroad buildout. Neoclassical revival ftw. Might write up open-weight AI tomorrow as this is equally essential to America.
1
5
351
Super cool! Last-mile drone delivery of cooked food can unlock reduced food wastage. Imagine a world with meal cost arbitrage; the equivalent of “a dozen cookies made in the morning for $1” versus “a fresh cookie out of the oven for $2.50”. If restaurants have to make a huge batch of “paneer tikka masala” but can’t serve it the next day, even poor grad students might be able to bid for an affordable Michelin star dinner.
What if your dinner could fly over traffic instead of sitting in it? We are now scaling to provide Uber Eats more than 1 million autonomous deliveries a day. Uber is becoming an investor in Zipline. We’ve entered the scaling era for robotics and physical AI.
1
2
323
Learning your personal trajectories and having agents do rote work for you is an incredible leverage. Can’t wait to try @bot
Introducing Grok Bot, now in early beta. Bots are AI teammates that do real work for you. They sign in to your tools, use them just like you do, and come back with finished work.
1
5
333
This team really cooks! Proud of the speed with which the #Cisco AI Defense team moves. Read more about how to protect your @claudeai Enterprise deployments within the enterprise.
Claude Enterprise doesn’t just chat. Claude Code, Claude.ai, and Cowork read documents, call tools, and run tasks. That makes the prompt an attack surface. Cisco AI Defense connects to @AnthropicAI's Inference hooks and inspects governed prompts for AI threats like prompt injection and jailbreaks before the model runs. See how it works: blogs.cisco.com/ai/secure-cl…
1
3
12
1,147
**Agent UX is not just better UI for AI.** It feels like a different design discipline. Traditional UX assumes: - A human initiates an action - The system responds - The human evaluates the result - The interaction ends Agent UX introduces a more complicated loop: - The human defines an outcome - The agent interprets intent - The agent plans and acts across multiple steps - The human supervises, redirects, or intervenes - The system learns from feedback and state I feel like changes what we need to design. The core unit is no longer the screen or the click. I like how @jpatel41 frames it - it is the relationship between the user and the agent where the user can delegate tasks with trust. To do this right, we need to do some rethinking. 1. Make the agent’s interpretation and plan visible enough for users to understand what will happen. 2. Design explicit levels of autonomy. From suggestion, to approval-required execution, to delegated action. Users should know where the agent sits on the ladder at any moment. 3. Agents operate over time. Users need to see memory, progress, pending work, assumptions, and what changed since the last interaction. 4. Every agent needs clear pause, undo, edit, retry, and escalation paths. Recovery is not an edge case; it is a primary interaction. 5. Users should be able to answer: - What did the agent do? - Why did it do that? - What information did it use? - What is it uncertain about? - What happens next? The biggest mistake is treating the agent as a chatbot embedded in an existing product. If we solve for **What should the human control, what should the agent own, and how should responsibility move between them?**, then the best agent experiences will feel make the user feel like they’ve got superpowers (and not really replace them).
1
1
9
252