Copperhelm explains how its security agent closes vulnerabilities without breaking production
In a Geektime article, Copperhelm, which develops a cloud security platform built on AI agents, describes how it builds an agent that takes action on its own in a live environment. Data collection, modeling and network exposure checks stay in deterministic infrastructure, and the agent only handles the part where the investigation has to adapt to the specific environment, after pre-filtering that saves model calls and load on live machines. The context for each task is pulled from a data layer called the Context Lake. Instead of one agent doing everything, several investigator agents get focused tasks: one checks exposure, a second checks what runs inside the machine and a third pulls information from other sources. In the validation step every claim needs evidence, such as command output or the result of a network request, and a Challenger agent checks whether the link between the pieces of evidence really holds. When evidence is insufficient, the company prefers more investigation or a human review. Before enforcing a WAF rule, for example, they check that it blocks the exploit request without blocking legitimate requests, and the rule can first run in Monitor mode against real traffic. The organization decides in advance which changes are allowed and under which conditions, and within those limits the agent acts without human approval for each rule. A change in the conditions the decision relied on, such as a new access path, reopens the investigation.
Otomatzia editorial · Published
Source published: · Geektime
