- AWS network exec Rob Kennedy said agent and inference traffic is exposing the limits of permissive, human-era designs
- He argued Layer 3 and 4 protections aren’t enough
- Funneling traffic through a consolidated data plane lets identity be checked before an agent reaches an app
AI agents are relentless when it comes to getting a job done. And that’s exactly what worries AWS VP of Network Services Rob Kennedy.
"You give agents a task, they'll basically go try to figure out how to do it and try to get around whatever restrictions might be in place," Kennedy said. Marry that with current network designs that were built for more permissive human access and you have a big problem.
Indeed, F5's Jimmy White previously warned that AI agents' spontaneity makes them a fundamentally different security problem than generative AI.
So, where do networks factor in? Well, Kennedy explained that today's networks, whether on-prem or in the cloud, are typically built with protections at the network and transport layers (Layer 3 and Layer 4). That provides broad connectivity into a network rather than limiting agent access to specific applications and means that an agent could theoretically get connectivity to an application and then try to work out the username and password, or borrow the user's own credentials.
Kennedy argued in order to lock-down the network and head off wayward agents, protections actually need to be brought up to the application layer (Layer 7).
Put simply, agentic AI security decisions need to move away from network layer decisions and be based on much more specific application layer information so agents can be blocked before they get access to applications.
When traffic flows through a consolidated Layer 7 data plane, Kennedy said, "you're actually able to go, ‘Well, I know who you are, I know what you're trying to do, I know what you're trying to get to,’" and then allow or block an agent based on policy.
In the model Kennedy described, "the agent can never get to the application to even try that username password” if it shouldn’t be there, he said. “I think that's where things need to evolve from a networking perspective when we think about AI traffic.”
AWS isn't alone in chasing agent controls. IBM recently extended HashiCorp Vault to give agents short-lived credentials and a kill switch, and also uses network telemetry to spot agents. SASE vendors including Versa, Cisco and Palo Alto are likewise racing to adapt zero trust to non-human users, which Versa's Kevin Sheu said could outnumber humans 80 to 1.