Two Sigma's Cloud Agents: Risk, Identity, and Control

Two Sigma is a quantitative hedge fund that has been operating for 25 years. The firm's name, Two Sigma, is derived from the concepts of 'volatility sigma' (small sigma) and 'large sigma sum.' By combining these metrics, the company aims to effectively hedge risk and achieve differentiated alpha in its financial strategies.

Despite being a 25-year-old, heavily regulated company, Two Sigma has successfully implemented an ecosystem where every employee utilizes a cloud agent. A key aspect of this implementation is that these agents operate under the individual user's own identity, ensuring a streamlined and personalized experience within the company's stringent regulatory framework.

Initially, agent adoption at Two Sigma was constrained by reliance on local machines and a command-line interface (CLI). The firm aimed to evolve beyond this, seeking a solution that would allow employees to use agents remotely from various platforms, including Slack, mobile devices, and browsers. This shift was motivated by the fact that many employees found the CLI-only environment to be either uncomfortable or less efficient for their workflows.

Assigning separate machine identities to users created significant challenges, particularly in keeping permissions synchronized across systems. Managing software licensing became more complex, requiring the handling of two separate licenses for each user. Furthermore, certain systems, such as Google Workspace, struggled to support multiple identities interacting with the same underlying data, leading to operational inefficiencies.

The firm's solution involved running remote agents under the user's exact same primary identity. This approach effectively eliminated previous access constraints and significantly simplified management processes. Two Sigma leverages existing Kubernetes namespaces assigned to users across various regions, ensuring seamless operation and access for these integrated agents.

Sharing identities between humans and agents introduces internal risks, particularly in accurately differentiating who or what took action. Attribution is crucial for auditing purposes and for determining whether an action should be blocked. The firm requires clear traces to identify if an action originated from a human operating purely through human actions or from an agent acting on behalf of the user.

Large Language Models (LLMs) often require external web access to remain functional with current data, but this connectivity introduces significant security vulnerabilities. One major concern is exfiltration risk, where sensitive intellectual property or other confidential information could potentially be lost or exposed. This is a deep concern for Two Sigma, which handles sensitive financial data.

Beyond data loss, the inflow of untrusted content presents additional risks. This includes the possibility of prompt injection, where malicious inputs could manipulate agent behavior, as well as the introduction of malware and other vulnerabilities. These threats pose substantial challenges to maintaining the integrity and security of the company's systems.

Prompt injection, specifically, is a risk where adversaries could craft inputs designed to bypass security measures or extract sensitive information. Malware can compromise systems, leading to data breaches or operational disruptions.

Overall, enabling external web access for LLMs, while beneficial for functionality, necessitates robust security protocols to mitigate these diverse and significant exfiltration and injection risks.

Two Sigma has successfully deployed a comprehensive framework that enables cloud agents to run under individual user identities. This framework incorporates various safety guardrails and multiple interface vectors to ensure secure and efficient operation. As a result, the firm now provides a fully managed fleet of agents accessible to all employees, streamlining their interaction with AI tools.

This deployment marks a significant step in integrating AI into the company's daily operations while maintaining stringent security standards. The guardrails prevent unauthorized actions and data breaches, while the diverse interface options cater to different user preferences and workflows.

The managed fleet simplifies maintenance and updates, ensuring that all agents are consistently performing at optimal levels and adhere to the latest security protocols. This centralized management also facilitates easier scaling and deployment of new agent functionalities across the organization.

Two Sigma is strategically moving towards self-managed local Large Language Models (LLMs) for a significant portion of its token usage and inference needs. This shift is primarily driven by concerns over cost volatility, the deprecation of external models, and a desire to reduce dependency on frontier labs.

By managing models internally, the company aims to mitigate unpredictable expenses and ensure greater control over the longevity and stability of its AI infrastructure. This also positions Two Sigma to leverage advancing open-weight model capabilities, fostering innovation while maintaining a robust and cost-effective operational framework.

Despite potential modifications to headers, the firm ensures that identity verification remains secure and un-mimickable during Remote Procedure Calls (RPCs). The identity itself cannot be intercepted, providing a robust layer of security. Systems maintain context downstream by using trace IDs, ensuring that both the originating identity and the entire identity ecosystem are preserved and verifiable throughout the communication process.

In highly regulated industries, Two Sigma leverages a cached index to significantly reduce the risk of prompt injection. By maintaining all data within internal boundaries and limiting exposure compared to external models, the firm ensures a more secure environment. This internal curation strategy allows for tighter control over content and reduces vulnerabilities associated with external data sources.

Behavioral and session data are powerful tools for personalizing agent configurations at Two Sigma. This data allows the firm to configure agents based on individual usage patterns, ensuring that they are tailored to each user's specific needs while protecting sensitive work-related information. This approach moves beyond traditional hierarchical personas, enabling a more dynamic and responsive agent experience.

Two Sigma has ensured that every single user at the firm has all the necessary infrastructure in place for agent development. This eliminates concerns about setup, allowing employees to build and deploy agents into their personal namespaces, running under their individual identities. The company-wide scaling of these agents follows standard production support processes, ensuring consistent and reliable deployment across the organization.