Your AI Isn’t the Problem. Your Infrastructure Is. — Jiachen Jiang, Coder
Source
youtube.com
Author
AI Engineer
Date
Why it matters
A written code freeze does not stop an agent holding destructive credentials. Enforce limits with isolation, short-lived tokens, and logs the agent cannot edit.
Key takeaways · AI-distilled
Jiang maps three incidents to controls: the public Replit database deletion (isolation, independent logs), a secondhand, anonymized banking story about a compromised Copilot session (identity alignmentThe work of making AI systems actually pursue what their builders and users intend, rather than something subtly or dangerously different.Full definition →), and the Nx supply chain attack (sandboxAn isolated environment where AI-generated code or agent actions run without being able to touch anything real.Full definition →).
Identity-aligned controls keep an assistant within the permissions of the person using it, and model proxies plus filesystem and network restrictions add further layers. He stresses no single layer is a complete defense and authorization does not prove an action is correct.
His closing exercise: have teams locate persistent tokenThe chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.Full definition →, routes to production and unsandboxed execution, then rehearse an AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → incident as a premortem before it happens.
Terms in this piece · Glossary
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
alignment — The work of making AI systems actually pursue what their builders and users intend, rather than something subtly or dangerously different.
videoPaving the Road to Production: Governed Enterprise AI Agents — Harish Gaggar, Credit Karma
videoHow to Actually Tokenmaxx and Save Millions — Alvin Pane, OutRival
videoRebuilding CI for AI-Scale Commit Volume — Gautam Korlam, SonarSource
videoI Spent Two Years Building the Median — Hariprasad Sudharshan
