The squeeze every CISO is living through right now
The panel opened with a one-line summary from moderator Moriah Hara, who runs a community of more than 3,000 CISOs and has held the role three times at Fortune 500 companies: "The business wants AI agents everywhere, developers are already using them, sometimes without approval, oftentimes without security. CISOs are left in this uncomfortable middle where we're tolerating some tools, we're praying that nothing breaks, we're buying some time until we can get some governance beyond policy in place to have better visibility."
That framing set the tone. The conversation was not about whether to deploy agentic AI. It was about how to do it without creating a 13-hour outage or a supply chain compromise on the way to the first production win.
Where to run the agents, and why the laptop is the new prod
A surprising amount of the discussion turned on geography. Zach (Warp) argued for getting agents off developer laptops entirely and into a cloud control plane where every agent session is observable. Gavriel stressed runtime isolation on whatever device the agent runs on, with disciplined supply chain choices upstream. The Docker position, put forward by the host, was simpler: if you run an agent in a sandbox, it does not matter much where the box sits.
The reason the laptop came up at all is that it is, structurally, the most powerful node in the enterprise right now. Vibe coding has pushed serious workloads onto developer machines, and a new class of agents is already in production there. Treating those laptops as dev machines is a category error. They are production, and they need to be governed like production.
The supply chain now has a new actor in it
The most uncomfortable part of the conversation was the supply chain thread. Opportunistic groups like TeamPCP and ShinyHunters are exploiting transient dependencies and short-lived vulnerabilities in the open source ecosystem. That problem is bad enough when humans are pulling dependencies. It is worse when an agent is doing it autonomously, choosing libraries, building a base image, and assembling a project, all without a human in the loop.
The panel's answers were practical, not aspirational:
- Humans in the loop for choosing clean, blessed upstream libraries and base images.
- A minimum image age of seven days to give freshly published malicious packages time to surface in blocklists.
- A training-wheels period for agent rollouts that starts on unpermissioned data, so the team builds operational muscle before the agent gets near anything sensitive.
- Reduced privilege, fewer third-party integrations, and immutable image tags plus SBOMs to enable rapid detection of poisoned images.
The honest assessment was that the underlying supply chain is not going to get meaningfully better in the next six to twelve months. The strategy is therefore to limit blast radius, not to chase a perfect upstream.
MCP is the next control surface
The conversation also took up MCP, the Model Context Protocol that lets LLMs pull external data and call tools. The panel's consensus: the right way to expose MCP servers to agents is through a chokepoint, a single enforcement layer that authenticates, authorizes, and logs every call before it reaches the external system. Docker's own MCP Gateway is one example of this pattern. The chokepoint approach is also what keeps a "golden repository" of verified tools honest, because every call has to clear the same gate.
The two paths that diverge in the next six months
Moriah closed with a prediction worth quoting: "Six months from now, enterprises are all going to be running agents at scale. The one key success factor will be whether governance was present from day one or got bolted on after the first major incident."
That is the part the panel did not flinch from. The teams that get this right will not look back on 2026 as the year they survived their first agent incident. They will look back on it as the year they got the runtime story in place before the incident ever had a chance to happen. The teams that wait will be writing the postmortems.
For security leaders right now, the practical question is not whether to run agents. It is whether the runtime controls in your stack today can answer, in audit-friendly terms, what every agent in your organization did this week. If the answer is no, the next six months are the window.