Tethered: Our Agents Are Us — Shu Fang, Two Sigma

Every employee at Two Sigma has a remote cloud agent, and it runs as them. Not a service account but their own identity, at a 25 year old quant fund in one of the most regulated industries there is. Shu Fang grew a mustache so the audience could tell him apart from his. His framing comes from the horror film Us, where the doubles are called the tethered and turn dangerous once they slip loose. The conventional design, where Shu has a Shu agent, collapsed fast. Permissions drift out of sync, licensing doubles, some systems refuse to let two identities touch the same data, and you inherit a boundary nobody wants to maintain. Running the agent as the user erases all of it, and the infrastructure already existed: a Kubernetes namespace per person in every region, built for automated jobs, with a sidecar mounting the identity into the pod. That leaves two real dangers. If the agent is you, nobody can tell what you did from what it did, so they propagate a header the way you would a trace ID, recovering not just the actor but the replayable chain behind a result. The larger fear is web access, since a model needs the open internet, which opens exfiltration, prompt injection and licensing exposure at once. Their answer is Google's web grounding for enterprise, a search index reachable inside their own network boundary, paired with denying the native search and fetch tools so nothing routes around it. The cost is freshness, roughly 24 hours. Fang argues the risk fell much further than the value did. Timestamps: 0:00 - Why the fund is called Two Sigma 1:20 - Every employee gets an agent that runs as them 1:49 - The tethered, and what happens when they slip loose 2:48 - Why a separate agent identity collapses 4:09 - The namespace infrastructure that already existed 5:17 - Danger one, telling the human from the agent 5:58 - Danger two, what open web access exposes 7:07 - Risk and return, read as a hedge fund would 8:04 - A trace header, and provenance for the whole chain 9:56 - Web grounding inside the network boundary 11:21 - Denying the native search and fetch tools 12:28 - What it cost, and what it bought 15:26 - Questions on local models, spoofing and audit