Sign InOpen Brain
AI EngineerVideoSource Linked

Tethered: Our Agents Are Us — Shu Fang, Two Sigma

Two Sigma runs remote agents under each employee’s real identity, adding trace propagation and controlled web access to preserve attribution and limit egress risk.

AI Engineer · Sep 3, 2026
Open Source Open MarkdownOpen JSON
Source Summary

At Two Sigma, **every employee** has provisioned cloud-agent infrastructure, and agents run with the employee’s identity rather than a separate service account. A propagated trace ID distinguishes agent activity and preserves the action chain while permissions remain tied to the user.

Practical Implication

Builders deploying agents inside companies should reuse identity, namespaces, network controls, and tracing already present in the platform. Two Sigma routes search and fetch through **Web Grounding for Enterprise** inside its network boundary instead of giving agents unrestricted outbound access.

Agent-Ready Context
At Two Sigma, **every employee** has provisioned cloud-agent infrastructure, and agents run with the employee’s identity rather than a separate service account. A propagated trace ID distinguishes agent activity and preserves the action chain while permissions remain tied to the user.

Builders deploying agents inside companies should reuse identity, namespaces, network controls, and tracing already present in the platform. Two Sigma routes search and fetch through **Web Grounding for Enterprise** inside its network boundary instead of giving agents unrestricted outbound access.

That index trades freshness for control: the talk reports data within **24 hours**, or **6 hours** for frequently updated sites. Curated retrieval reduces exposure but cannot eliminate prompt injection, and shared identity still requires reliable attribution and policy enforcement.
Connected Context · Feed7 Judgment

This confirms that enterprise cloud agents can inherit existing identity, network, namespace, and tracing controls instead of forming a separate security plane. User-tethered authority plus propagated trace IDs improves attribution, while curated in-network retrieval limits outbound exposure. The freshness trade-off and residual prompt-injection risk show that containment does not guarantee current or trustworthy context.

Cursor Cloud Agents can now run in Vercel SandboxCursor on Vercel complements user-tethered identity with per-request execution isolation and explicit control over credentials, retries, and worker lifecycle.Agent Runs now available in the Vercel MCP and CLIAgent Runs provides the adjacent observability capability: agents can inspect production traces containing reasoning, tool calls, and token use.Cloud agents start 3x faster with buildsCursor’s prepared snapshots expose a parallel control-versus-freshness trade-off: reproducible environments start faster but may remain on the last valid image after refresh failure.From fork() to Fleet: Designing an Agent Sandbox Cloud — Abhishek Bhardwaj, OpenAIOpenAI’s sandbox-cloud design extends the infrastructure pattern with microVM isolation and snapshots for recovery, branching, and placement of long-running agents.
Context Map
infracodingsecurity#cloud-agents#observability#sandboxing
Uncertainty
That index trades freshness for control: the talk reports data within **24 hours**, or **6 hours** for frequently updated sites. Curated retrieval reduces exposure but cannot eliminate prompt injection, and shared identity still requires reliable attribution and policy enforcement.