Existing enterprise security tooling (identity, endpoint, API security) breaks down for autonomous agents because it can't see intent.
Traditional identity security limits what a system is permitted to do, but agents need broad permissions to be useful, so scoping doesn't work. Endpoint and API tools can see that an action happened (e.g., a database deletion) but not why the agent decided to do it, so they can't distinguish a legitimate action from a dangerous one performed mid-task.
agent-security
A proxy-and-policy-engine approach fails because the hard problem isn't visibility, it's judgment.
Maxim rejects the intuitive security answer of routing agent traffic through a policy proxy: many AI systems can't be proxied technically (they run on someone else's cloud or on the endpoint), and even where you can see the traffic, the real problem is deciding whether a given action by another AI system is correct - which requires understanding what a smarter model was thinking, not just observing what it did.
agent-security
Using a full capable agent to supervise every other agent is naively appealing but breaks on cost and latency.
Spawning a capable reviewer agent for every monitored agent would mean the security vendor costs more than the AI itself and adds unacceptable latency. Onyx's answer is to train small, narrow models whose only job is to flag when an action needs a smarter (and more expensive) reviewer to look closer - most decisions are cheap and fast, escalation is rare and targeted.
agent-security
The overseer-model approach is like blitz chess: intuition handles most moves, deep calculation is reserved for critical ones.
Maxim draws a direct analogy to top chess players, who make most moves from pattern-matched intuition and only stop to calculate deeply when they sense a high-risk position. Onyx's small models aim for that same efficient allocation of computation: cheap intuitive judgment by default, expensive deep review only when risk signals warrant it.
agent-security
Autonomous coding agents and assistants are now the largest and fastest-growing category of enterprise agent deployment, and they typically ship with the least control.
Maxim breaks enterprise agent adoption into three buckets: low-code SaaS automations (~45%), first-party built agents (~2%), and autonomous coding agents/assistants (50%+ and growing fastest, driven by tools like Claude Code and now Claude Cowork). That last category is the one with the fewest safeguards because it wasn't built with enterprise controls in mind.
enterprise-ai-adoption
Security vendors gain an edge over the model labs themselves because they're allowed access to historical agent-behavior data that enterprises won't give the labs.
Enterprises are wary of handing Anthropic or OpenAI historical data on how their agents behaved, fearing the labs will train on it. Independent security vendors like Onyx can access and use that data for oversight, giving them context the foundation labs structurally can't get, which Maxim argues is a durable advantage.
agent-security
Security buyers structurally prefer an independent party over the model vendor itself for governance, similar to not trusting a car dealer's own certification of the car.
Maxim argues this is buyer psychology, not just a technical gap: even if a lab could perfectly self-police its own model's actions, enterprises will still want an independent third party whose entire business is verifying safety, because the vendor has a conflict of interest in vouching for its own product.
agent-security
Agent mistakes split into two categories with very different long-term trajectories: 'jagged intelligence' errors that model vendors will fix, and independent/misaligned judgment calls that get harder as models get smarter.
Silly mistakes from jagged intelligence will diminish as models improve, and Maxim doesn't see that as Onyx's long-term job - the labs are incentivized to fix it. The harder, growing category is models forming their own semi-independent perspective on what should happen that doesn't match the user's intent; he frames this as getting worse, not better, as capability increases, and as the category Onyx is actually built to address.
ai-safety-and-alignment
Multi-vendor model landscapes make lab-level security solutions structurally insufficient.
Enterprises will keep using multiple model vendors (for cost, task fit, and avoiding lock-in to any one lab), including newer open-source entrants that haven't built out mature safety tooling yet. It's unrealistic to expect uniform security guarantees across all of them, which is why Maxim thinks the problem can't be solved purely by the foundation labs and needs a cross-vendor layer.
ai-safety-and-alignment
The plunging cost of automated vulnerability discovery from coding agents is a distinct, urgent threat that pragmatic security teams are already reacting to.
Maxim says automated vulnerability research looked like a 20-50 year-out problem a decade ago and 'is coming all at once' now. His recommended posture for security leaders: fast tactical mitigation of newly discovered vulnerabilities in the short term, paired with building the same foundational control layers (identity, firewall, endpoint-equivalent) for the AI attack surface long term.
enterprise-ai-adoption
Large, risk-averse enterprises are no longer holding out on agent adoption - they've shifted to more granular tool allowlisting instead of blanket bans.
Maxim says the wholesale 'ban everything until it's safe' posture he saw 18-24 months ago has mostly disappeared, even in the financial sector. Companies with more risk aversion now restrict which specific tools are allowed rather than blocking agentic adoption outright, because the pace of model and tool improvement makes over-committing to caution its own risk (citing OpenAI-to-Anthropic model-quality shifts as an example of why betting everything on one vendor is itself risky).
enterprise-ai-adoption
Onyx's early enterprise credibility came from inbound demand driven by acute pain, not from its team's prior track record.
Maxim frames it as improbable on paper for a two-year-old, under-100-person company to win Fortune 100 trust, but says the pain from unmanaged agent risk is severe enough that large security buyers reach out proactively, betting early on a promising vendor in a still-nascent category rather than waiting.
founder-strategy
Onyx's founding team's edge comes from Israeli intelligence-unit backgrounds that fused math/cyber expertise with deep familiarity with how security teams actually operate day to day.
Maxim credits much of Onyx's research and engineering talent to an Israeli intelligence unit focused on math and cyber, and separately argues that Israeli security-product builders' real advantage is understanding the daily workflows, incentives, and pain points of security teams closely enough to build products those teams genuinely want, not just technically sound tools.
israeli-tech-ecosystem
Media referenced
Auto-GPT - other - The autonomous-agent experiment from 2023 that Maxim says was the pivotal moment convincing him to bet on agent-action security; he compares it to Claude Code today.
Companies
Onyx Security - Maxim's Tel Aviv-based startup that trains small models and agents to oversee other AI agents' actions inside the enterprise.
Anthropic - Cited as an example of enterprise revenue coming from Claude Code replacing developer work, and as a foundation lab whose historical agent-behavior data enterprises won't hand over for training.
OpenAI - Referenced alongside Anthropic on model competition and the risk of over-betting on a single lab's models; also cited for the Glasswing/Daybreak phased-rollout frameworks.
Nvidia - Co-founder Gil's prior employer, where he worked on synthetic data before co-founding Onyx.
JP Morgan - Example of a large, risk-averse enterprise that is nonetheless adopting AI agents quickly.
Techniques and frameworks
Small overseer models (the 'should a smarter agent look at this' filter) - Onyx's core architecture: instead of running a full capable agent to review every other agent's action (too slow and expensive), they train small, narrow models whose only job is deciding when to escalate an action to a more capable reviewer.
Mechanistic interpretability - Onyx's longer-term research bet: understanding the internal weights and activations of models as part of controlling advanced AI, with the view that smarter models will help humans crack interpretability that is currently too hard for human-level intelligence alone.
Defense in depth / defensive debt - Maxim's framing for why agent-action security needs its own foundational control layer analogous to identity, endpoint, and network security, rather than being covered by existing tools.
Summary
Maxim Bar Kogan, co-founder and CEO of the Tel Aviv-based startup Onyx Security, joins Sarah Guo to explain why he bet on "agent action" security two years ago, well before enterprises had meaningfully adopted autonomous agents. He traces the founding insight to Auto-GPT in 2023, which convinced him that once models got capable enough, enterprises would hand agents real permissions and real consequences, from managing infrastructure to deleting production databases, and that no existing security tooling was built to understand or govern what an AI system was actually trying to do. He admits the timing was a gamble: Onyx risked running out of money before the market caught up, but autonomous coding agents (Claude Code, and now Claude Cowork) arrived fast enough to validate the bet, and today Maxim estimates that coding agents and assistants account for over half of agent activity in the average enterprise, growing faster than low-code automation platforms or first-party built agents.
The core of the conversation is architectural: why can't existing enterprise security (identity, endpoint, API, proxies) simply extend to cover agents? Maxim walks through why each fails. Identity-based permission scoping doesn't work because agents need broad permissions to be useful. Endpoint and API tools can observe an action but not the reasoning behind it, so they can't tell a legitimate database recreation from a dangerous one triggered mid-task. Proxy-and-policy approaches fail both technically (much of the AI runs on infrastructure you can't proxy) and conceptually (visibility isn't the hard problem, judgment is). His answer is a system of small, narrow models trained to make one decision extremely fast and cheaply: whether a given agent action needs escalation to a smarter, more expensive reviewer. He compares this to blitz chess, where top players make most moves from pattern-matched intuition and reserve deep calculation for the rare high-stakes position, arguing this is the only architecture that's viable on cost and latency given the sheer volume of agent actions.
Maxim distinguishes two categories of agent error with different implications for who should fix them. "Jagged intelligence" mistakes (silly errors) will shrink as frontier models improve, and he sees that as the labs' job, not Onyx's. The harder and growing category is agents developing an independent, sometimes misaligned perspective on what should happen, a problem he expects to get worse, not better, as models get smarter and more capable of independent judgment. He argues structurally that this category can never be fully solved by the labs themselves: enterprises won't hand foundation labs their historical agent-behavior data (fearing it will be used for training), giving independent vendors like Onyx access advantages the labs don't have, and buyers have a psychological preference for independent verification over self-certification, analogous to not trusting a car dealer's own inspection of the car it's selling. The proliferation of model vendors (cost-driven, task-driven, and open-source entrants without mature safety tooling) further makes a single-lab solution untenable.
On enterprise adoption dynamics, Maxim says wholesale "ban all agents until it's safe" postures have largely disappeared even among risk-averse sectors like finance, replaced by more granular tool allowlisting; he frames over-caution as its own risk given how fast model quality shifts between vendors. He also flags the plunging cost of AI-driven vulnerability discovery as a second acute threat security teams are grappling with in parallel to agent-action risk, something he says looked decades away a few years ago and is now materializing rapidly. On the Israeli tech ecosystem, he credits Onyx's edge to a team background split between elite intelligence-unit math/cyber training and deep firsthand familiarity with how security teams actually work day to day, which he argues is the harder, more durable advantage in building products security buyers actually want to use. He closes by squaring his stated "AGI-pilled" outlook with his belief that human security teams persist for now: he expects security functions themselves to eventually be run substantially by AI agents, but says Onyx's current job is building for the humans still doing that work today while designing the product to also serve agent "users" as that shift happens.
Notable Quotes
"Maybe the first thing a lot of our listeners might think is say, well, I'll just ask Cloud Code to do it... So that approach, it has, obviously, it's pretty naive." - Maxim Bar Kogan
"You need to have people in your ecosystem that have built products for them in the past that know them like they know their best friend." - Maxim Bar Kogan
"If you're a large company, your risk profile is and should be different... where you're a large, where you're JP Morgan, you have so much to lose." - Maxim Bar Kogan
"I think it's one of those things that should not be possible... in theory, like there's no reason why a Fortune 10 or 20 company would work with us because, you know, who are we?" - Maxim Bar Kogan