Purely agentic systems can be unpredictable. A hybrid approach, like OpenAI's Deep Research forcing a clarifying question, inserts a deterministic workflow step (a "speed bump") before unleashing the agent. This mitigates risk, reduces errors, and ensures alignment before costly computation.

To ensure AI agents are trustworthy and can work together safely, Dreamer's architecture includes a central "Sidekick" that acts as a kernel. It manages permissions and communication between agents, preventing uncontrolled data access and ensuring actions align with user intent, much like a computer's operating system.

AI agents present a UX problem: either grant risky, sweeping permissions or suffer "approval fatigue" by confirming every action. Sandboxing creates a middle ground. The agent can operate autonomously within a secure environment, making it powerful without being dangerous to the host system.

Securing AI agents requires a three-pronged strategy: protecting the agent from external attacks, protecting the world by implementing guardrails to prevent agents from going rogue, and defending against adversaries who use their own agents for attacks. This necessitates machine-scale cyber defense, not just human-scale.

Instead of relying solely on human oversight, Bret Taylor advocates a layered "defense in depth" approach for AI safety. This involves using specialized "supervisor" AI models to monitor a primary agent's decisions in real-time, followed by more intensive AI analysis post-conversation to flag anomalies for efficient human review.

Current AI safety solutions primarily act as external filters, analyzing prompts and responses. This "black box" approach is ineffective against jailbreaks and adversarial attacks that manipulate the model's internal workings to generate malicious output from seemingly benign inputs, much like a building's gate security can't stop a resident from causing harm inside.

Rather than relying on a single AI, an agentic system should use multiple, different AI models (e.g., auditor, tester, coder). By forcing these independent agents to agree, the system can catch malicious or erroneous behavior from a single misaligned model.

The company's strategy for managing threats from malicious AI agents is to use AI for defense. They are building the capacity to scan everything happening on the platform in real-time, believing that monitoring AI can be just as powerful as generative AI.

A critical, non-obvious requirement for enterprise adoption of AI agents is the ability to contain their 'blast radius.' Platforms must offer sandboxed environments where agents can work without the risk of making catastrophic errors, such as deleting entire datasets—a problem that has reportedly already caused outages at Amazon.