AI Agents: The Key to Their Reliability Lies in Their Oversight

The Crucial Importance of Framing AI Agents

The performance of an artificial intelligence (AI) agent does not solely depend on the language model it uses, but rather on the framework that surrounds it, often referred to as the "harness." Indeed, a generic large language model (LLM), without a specific grounding, can be prone to "hallucinations," meaning it may produce incorrect answers with great confidence. This phenomenon is particularly problematic in critical areas like network security, where accuracy is paramount.

AI providers tout agents capable of autonomously handling complex tasks without continuous human intervention. This promise is enticing, but it raises a fundamental question: how can we ensure that these agents are reliable enough to effectively protect a network? The answer does not lie in the language model itself, but in the operating system that frames it.

LLMs and Their Limitations

AI agents derive their reasoning capabilities from large language models (LLMs). These models are impressive in their ability to understand context, solve complex problems, and plan actions for a variety of tasks. However, as generalist systems, they possess superficial knowledge on a multitude of topics and often lack specificity for a given environment. Without real data to anchor them, they risk producing erroneous responses, a minor issue for a simple chatbot, but unacceptable for network security.

What distinguishes a high-performing AI agent from a truly reliable one is how it is structured and framed. Three key elements define this framework: skills, tools, and context. If these elements are well mastered, the agent gains in precision and reliability. Conversely, errors in any of these areas can lead to hallucinations, even if the path to that outcome is more complex.

The Challenges of Generative AI in a Poorly Suited Framework

When a versatile agent is applied to network security, it uses an architecture designed for generalist uses, where precision is crucial. Generic models are built to handle generic cases and are not prepared to manage edge cases specific to mature environments. These environments may include legacy rules that few people still know, or complex dependencies between vendors that cause unexpected failures. The models rely on static training data, without a true understanding of what constitutes optimal operation at scale. This leads to successful demonstrations but failures during large-scale deployments.

The Components of an Effective Harness

The reliability of an agent does not depend on the size of the model, but on the design of the three components of its framing device: skills, tools, and context.

• Skills: It is crucial to develop skills based on real-world experience. These skills should reflect expertise gained in production environments, not theoretical knowledge derived from generic training data. The most valuable skills are those that include managing complex cases and edge situations specific to mature environments. This depth allows the agent to understand what constitutes a "good" execution.

• Tools: The tools must be designed to serve the agent. The LLM cannot handle everything; tools are necessary to retrieve data, synthesize it, and prepare it for the model. These tools can range from simple API calls to sophisticated solutions integrating complex machine learning algorithms. Expertise must be embedded in these tools to provide the agent with domain-specific capabilities.

• Context: Providing the agent with a real-time view of the environment is essential. The accuracy of an agent directly depends on the fidelity of the image it relies on. Static snapshots or outdated exports lose their relevance as soon as they are generated. The tools must read the environment as it exists at the moment—topology, dependencies, policies, traffic—and act accordingly.

By mastering these three elements, it is the framing device that will ensure the reliability of the agent, not the underlying model.