--- schema: 1 type: video title: 'Tethered: Our Agents Are Us — Shu Fang, Two Sigma' description: >- Every employee at Two Sigma has a remote cloud agent, and it runs as them. Not a service account but their own identity, at a 25 year old quant fund in one of the most regulated industries there is. Shu Fang grew a mustache so the audience could tell him apart from his. His framing comes from the horror film Us, where the doubles are called the tethered and turn dangerous once they slip loose. The conventional design, where Shu has a Shu agent, collapsed fast. Permissions drift out of sync, licensing doubles, some systems refuse to let two identities touch the same data, and you inherit a boundary nobody wants to maintain. Running the agent as the user erases all of it, and the infrastructure already existed: a Kubernetes namespace per person in every region, built for automated jobs, with a sidecar mounting the identity into the pod. That leaves two real dangers. If the agent is you, nobody can tell what you did from what it did, so they propagate a header the way you would a trace ID, recovering not just the actor but the replayable chain behind a result. The larger fear is web access, since a model needs the open internet, which opens exfiltration, prompt injection and licensing exposure at once. Their answer is Google's web grounding for enterprise, a search index reachable inside their own network boundary, paired with denying the native search and fetch tools so nothing routes around it. The cost is freshness, roughly 24 hours. Fang argues the risk fell much further than the value did. Timestamps: 0:00 - Why the fund is called Two Sigma 1:20 - Every employee gets an agent that runs as them 1:49 - The tethered, and what happens when they slip loose 2:48 - Why a separate agent identity collapses 4:09 - The namespace infrastructure that already existed 5:17 - Danger one, telling the human from the agent 5:58 - Danger two, what open web access exposes 7:07 - Risk and return, read as a hedge fund would 8:04 - A trace header, and provenance for the whole chain 9:56 - Web grounding inside the network boundary 11:21 - Denying the native search and fetch tools 12:28 - What it cost, and what it bought 15:26 - Questions on local models, spoofing and audit --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/wCIYViPd4SU-youtube-8acee04c409cbd23da4e Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- canonical: >- https://liquidgold.cc/channel/aidotengineer/explore/video/tethered-our-agents-are-us-shu-fang-two-sigma-7af3e7f165f1 markdown: >- https://liquidgold.cc/channel/aidotengineer/video/tethered-our-agents-are-us-shu-fang-two-sigma-7af3e7f165f1.md llms: null parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-24T04:05:58.907Z' language: null children: [] videoId: wCIYViPd4SU durationSeconds: 1270 publishedAt: '2026-09-03T14:30:21.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 83 endSeconds: 95 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=83' heldReason: rights - ordinal: 1 text: null startSeconds: 130 endSeconds: 175 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=130' heldReason: rights - ordinal: 2 text: null startSeconds: 187 endSeconds: 255 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=187' heldReason: rights - ordinal: 3 text: null startSeconds: 255 endSeconds: 266 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=255' heldReason: rights - ordinal: 4 text: null startSeconds: 322 endSeconds: 334 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=322' heldReason: rights - ordinal: 5 text: null startSeconds: 358 endSeconds: 369 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=358' heldReason: rights - ordinal: 6 text: null startSeconds: 446 endSeconds: 493 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=446' heldReason: rights - ordinal: 7 text: null startSeconds: 504 endSeconds: 596 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=504' heldReason: rights - ordinal: 8 text: null startSeconds: 607 endSeconds: 684 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=607' heldReason: rights - ordinal: 9 text: null startSeconds: 696 endSeconds: 752 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=696' heldReason: rights - ordinal: 10 text: null startSeconds: 765 endSeconds: 926 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=765' heldReason: rights - ordinal: 11 text: null startSeconds: 938 endSeconds: 1046 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=938' heldReason: rights - ordinal: 12 text: null startSeconds: 1057 endSeconds: 1166 watch: 'https://liquidgold.cc/watch/wCIYViPd4SU?t=1057' heldReason: rights --- # Tethered: Our Agents Are Us — Shu Fang, Two Sigma Every employee at Two Sigma has a remote cloud agent, and it runs as them. Not a service account but their own identity, at a 25 year old quant fund in one of the most regulated industries there is. Shu Fang grew a mustache so the audience could tell him apart from his. His framing comes from the horror film Us, where the doubles are called the tethered and turn dangerous once they slip loose. The conventional design, where Shu has a Shu agent, collapsed fast. Permissions drift out of sync, licensing doubles, some systems refuse to let two identities touch the same data, and you inherit a boundary nobody wants to maintain. Running the agent as the user erases all of it, and the infrastructure already existed: a Kubernetes namespace per person in every region, built for automated jobs, with a sidecar mounting the identity into the pod. That leaves two real dangers. If the agent is you, nobody can tell what you did from what it did, so they propagate a header the way you would a trace ID, recovering not just the actor but the replayable chain behind a result. The larger fear is web access, since a model needs the open internet, which opens exfiltration, prompt injection and licensing exposure at once. Their answer is Google's web grounding for enterprise, a search index reachable inside their own network boundary, paired with denying the native search and fetch tools so nothing routes around it. The cost is freshness, roughly 24 hours. Fang argues the risk fell much further than the value did. Timestamps: 0:00 - Why the fund is called Two Sigma 1:20 - Every employee gets an agent that runs as them 1:49 - The tethered, and what happens when they slip loose 2:48 - Why a separate agent identity collapses 4:09 - The namespace infrastructure that already existed 5:17 - Danger one, telling the human from the agent 5:58 - Danger two, what open web access exposes 7:07 - Risk and return, read as a hedge fund would 8:04 - A trace header, and provenance for the whole chain 9:56 - Web grounding inside the network boundary 11:21 - Denying the native search and fetch tools 12:28 - What it cost, and what it bought 15:26 - Questions on local models, spoofing and audit --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/wCIYViPd4SU-youtube-8acee04c409cbd23da4e Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- Canonical: https://liquidgold.cc/channel/aidotengineer/explore/video/tethered-our-agents-are-us-shu-fang-two-sigma-7af3e7f165f1 · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.