We solved the blank canvas problem | Tom Occhino from Vercel

So I have to ask, right, as a, you know, we are a security company, I have to say that your AI SDK makes it just ridiculously easy, uh, for agents to call tools.

And so, you know, putting on kind of my security hat, and for the CISOs listening to this, right, how do you make sure that, you know, these agents don't get exploited, right? Or what guardrails are y'all thinking about kind of putting in place or out of the box?

Yeah, I mean, like, you know, under no circumstances are we, like, encouraging, uh, code execution on the client.

Um, of course, it happens during development.

You're doing some of this stuff, but, you know, the, the reason we created Vercel Sandbox is because we need that untrusted, uh, code execution environment that does not have access to production secrets, that does not have access to production configuration, et cetera.

Um, but there's a, there's a really rich question of the security of agents here, and, and we're doing a bunch of things.

Um, you know, one thing recently, hardening of markdown rendering to prevent, uh, data exfiltration.

We had a, a, an actually, a blog post about this called Building Secure AI Agents, which I encourage you to take a look at.

So ton of work going on there.

And then the other thing is, like, you know, we created the sandbox environment, which is great 'cause you can run untru- untrusted code without worrying about it accessing production secrets, et cetera.

But there's outgoing requests that come from that sandbox, and so we need to have this, um, you know, we need to be thinking about the way that agents do things from the sandbox.

Who are they allowed to talk to, in what capacity, et cetera.

So open area of, like, research and development for us, but obviously something that, that I think all of us need to take very, very seriously because especially as you open up access to these tools to so many more people who don't have the security fundamentals from their prior career, from the first, you know, 15, 20 years of their career, um, we need to be creating systems that are sort of like secure by default and safe by default.

Awesome.

Well, it's al- it's almost like you read my mind, because one thing, you know, I've been also promoting internally is you gotta make the paved path the easy path, right? Because if security gets really hard, then that's where it risks becoming an afterthought.

Exactly right.

Um, just thinking through it, is the goal for the SDK to become the OS for the, for the agentic world?

So we started building v0, and it's a front-end cloud app, but we, we needed more stuff.

We're like, "Okay, this is necessary but insufficient set of things.

What else do we need?" We needed the AI SDK because we were constantly swapping out the models in our app because new ones are released all the time, and we needed to stop changing our product code.

We needed the AI gateway because as more and more teams are using AI, they're all managing their own keys.

We have no visibility into what spend is going where.

It was crazy.

We needed things like sandboxes, like we ment- I mentioned earlier, for untrusted code execution.

We needed a primitive called Workflows because agents do this very, uh, you know, workflow-like, this very, uh, asynchronous kind of wait for something and do something.