Session Overview
Discover how streaming data engines enable real-time detection and security guardrails against autonomous AI agent threats.
In this talk, Ting Wang (Co-founder and CEO of Timeplus) examines why traditional SIEMs, scheduled queries, and stateless telemetry pipelines fail to stop prompt injection cascades, tool abuse, and multi-agent coordination occurring in seconds. Learn how streaming architectures use event normalization, continuous materialized views, session windows, and mutable streams to deliver in-stream governance and machine-speed defense.
What You'll Learn
- The emerging attack surface: Autonomous agent loops, bash execution, and rapid tool calls
- Why batch SIEMs and stateless filters miss cascading prompt injections
- Core architectural requirements: Sub-second latency, multi-turn state, and protocol-aware monitoring
- Timeplus Agent Guard reference architecture: Ingesting OpenTelemetry traces and agent hook events
- Normalizing multi-runtime telemetry into a Common Information Model (CIM)
- Stateful correlation using session windows and hopping token aggregations
- Leveraging continuous materialized views and mutable streams for active governance
Chapters
- 00:00 — Introduction & the autonomous AI agent attack surface
- 04:30 — Real-world agent threats & prompt injection cascading
- 08:24 — Why traditional SIEM & batch detection fall short
- 12:20 — Agent Guard architecture & real-time dashboard demo
- 16:35 — Pipeline lineage: OpenTelemetry traces & hook events
- 18:31 — Event normalization with a Common Information Model
- 21:40 — Stateful correlation: Session windows & token budgets
- 24:14 — Mutable streams & streaming runtime governance
- 26:24 — Key takeaways & conclusion
