Shu Fang Two Sigma Tethered agents

Shu Fang of Two Sigma showed how every employee at the firm now runs a cloud agent as themselves, in an AI Engineer talk introducing Shu Fang Two Sigma Tethered agents.

StartupHub data

Companies working on this

Profiles of the companies named in this story, with funding and a one-liner from our database.

Google

$9.1B

Global technology leader in search, advertising, cloud, AI, and consumer electronics.

The setup reuses Kubernetes namespaces, one per user per region, with a sidecar that injects the human identity into every container.

The risk is real: internal confusion and external leakage, the moment an agent carrying your identity also has open web access and the audit trail goes fuzzy.

How the attack actually works

Separate machine identities tied to users break down fast. Permission drift, dual licenses and Google Workspace caps get in the way. So Two Sigma runs agents exactly as the user, with no extra identity layer to manage.

Fang compared it to the film Us, where tethered doubles need a mark to tell them apart. His mark is a mandatory trace header.

Every agent attaches that header at the first RPC, then carries it through HTTP clients, MCP and skills, leaving a replayable chain behind.

Web access blocks the default search and fetch tools you'd find in Claude Code, and reroutes every call to a cached index that lives inside the VPC.

That index is Google Web Grounding for Enterprise, which gives search and fetch without any external egress. It lags by up to 24 hours, or six hours for sites that update more often.

Why it matters, and what still breaks

Builders can lean on the identity and network controls they already own instead of inventing new agent accounts. Fang said the team kept the value while cutting risk.

The header alone doesn't prove much. Anyone can write one, so trust still flows from the identity system underneath.

Cached grounding cuts prompt injection risk with Google's formatting and safety controls, though Fang flagged that those filters can fail.

Session data stays local to each user for privacy, and agents get tuned by real use. Promotion to the whole company still needs a production review.

The fleet is live for all staff through phone, Slack and browser, not just CLI. Self-hosted frontier models are still pricey and flaky.

The bet is simple: enterprise primitives beat new trust models. Two Sigma is hiring to keep testing it.