Keep the Data Inside Your Perimeter, and the Agents Too
Episode Summary
Claudionor Coelho Jr has built AI at Google and at Zscaler, and his argument here is that the industry is worrying about the wrong layer. LLM security, he jokes, is the easy problem. The hard one is what happens when agents hand your data to entities outside your security perimeter, which you must then trust and authorize without knowing whether they hold your standards. His advice for anything that is not a toy application is blunt: keep the data inside and keep the agents inside. Above the model he wants a rule layer, because probabilistic guardrails can be talked past, and a self-driving car that avoids the wall 99.9 percent of the time is not what you want. The rest is about their limits. Finding a bug in a hardware or software description is in general an NP-complete problem, so he pairs formal proof engines with models, and he is firm that building these systems is a software engineering job.
Key takeaways
The shift he names is from bring your own data to bring your own agents. Under bring your own data, he says, people had to understand the data internally in corporations. With agentic flows encapsulating the data layers, you can ask for the agent instead: rather than give me the raw data of what your machine is doing, give me the points where you think there are anomalies and I will interpret those
His example of guardrails being talked past comes from the news, a week or two before recording. He says someone posted that at DEF CON, last week or the week before, they were able to infiltrate Microsoft Copilot using prompt injection and bypass its guardrails, and says that because these are probabilistic interpretations of text it is very easy to bypass those systems no matter how much you try to secure them
The perimeter is the part he thinks is under-discussed. He says that with MCP or distributed agents you are shipping confidential data to entities outside your security perimeter, authorizing them and trusting them with your most precious data, and that you do not know whether the company on the other side has the same level of security you do
His advice for anything that is not a toy application: keep the data inside and keep the agents inside. He calls that the most advisable solution right now for multi-agent systems, and describes the alternative as one of the open problems distributed multi-agent systems currently have
The first question he would have a board ask is whether the data is sanitized. With the advance of cloud techniques, he says, companies started dropping or saving everything, so instead of a data lake they created a data dump, and agents now scan data that was only ever meant to be temporary, some of it conflicting and some obsolete because data is temporal
The second board question is what risks you are willing to take. He is explicit that he is not saying do not use multi-agent systems or do not save the data, but that everything has a risk and a return, and that for a toy example on non-confidential data it is fine to assume the risk
He wants the AI strategy and the security strategy presented as one thing. Not the AI strategy for the company, he says, but the AI strategy together with the security strategy, because with security comes risks and the judgment has to be made per application
His example of the judgment going missing is financial auditing. Public companies usually run those audits in closed rooms where people sometimes cannot even bring a cell phone inside, he says, and he has now heard of people saying a multi-agent system can do the financial auditing for them
Sending that same audit outside the security perimeter is where he sees a contradiction. People are saying it is fine to send financial auditing out because the systems are safe, and he thinks there is a discrepancy on that which people need to analyze. The third question he would have a board ask follows immediately: what are the unknown applications that could generate the greatest profit using AI
Most workflows in corporations have never been documented, which is where he thinks the unknown applications hide. His example is an email from one person to another that carries importance because it is role-playing, where a reply that does not come in time can cost revenue or an opportunity, and he says interactions like that could be processed and automated
His analogy for what automation does to human attention is self-driving. He says that once you turn it on, even with your hands on the wheel, your attention span drops to 10 to 20 percent, and that the same thing happens when an AI takes over a decision-making role in a corporation
The problem he says agent teams actually spend their time on is not building. He joked on LinkedIn the day of recording that most of the problem with agents is not developing the agents or the infrastructure, it is explaining to upper management why hallucinations happen and trying to reduce them
Of his three board questions, the one he thinks reveals the biggest blind spot is the data. He says he wrote in 2022, before or around the time ChatGPT came out, that his next job would be to fix the data problem in corporations, and that people do not realize LLMs and agents cannot fix bad data because they rely on the data being correct
His illustration of conflicting data is an F-16 cockpit. Ask a multi-agent system to show you where the instruments are and you do not know whether you get the F-16A, which he thinks was released at the end of the 1970s and had analog instruments, or the latest version with digital ones. Depending on how you fine-tune the question, he says, you may get a different answer each time
The first thing he builds is an annotation layer over every piece of data going in. He says he creates an infrastructure to clean and analyze the data first, and describes needing an annotation at the meta level for every single piece of data ingested into a multi-agent system
Above the annotation layer he puts a rule layer, and the standard he holds it to is 100 percent. If a self-driving car faces a wall, he says, you do not want it to avoid the wall 99.9 percent of the time, you want 100 percent, which means a rule layer above what the machine learning is doing to make sure certain laws are observed for the business operation
Asked what frameworks exist for the rule layer, he says you mostly build them by hand. There are starting to appear, he says, but most of the time you need to create those by hand, and it goes beyond guardrails because it interacts with the business layer. Pressed, he adds knowledge graphs: rules and knowledge graphs on top of the agents or LLMs
His test for how to architect an agent system is what happens when you give it the wrong question. He contrasts deep research, where a swarm searches the web, writes code and runs it and a wrong result is tolerable because something else checks it, with AI workflows, which need more structure and where an algorithm may solve the problem better than an LLM
Finding a bug is NP-complete, which he says puts it out of reach of current LLMs. He ties his own PhD work and two companies he worked at to formal verification, and says finding a bug in a hardware or software description is in general an NP-complete problem requiring exponential time or space, so there is no way the current architecture of LLMs can solve it in general
What he does instead is pair a formal proof engine with a model, each doing what it knows best. For generating tests against a legacy codebase, hitting a given line of code is the NP-complete part, so the formal engine works out how to sensitize the code and passes that to the LLM. He says he tested GPT, Anthropic and all the public and private models, and as one function grows more complex they stop being able to solve it
He puts a number on where models give up: functions of 400 to 500 lines. For a three-line function it is easy, he says, but on a function of 400 or 500 lines he would say they never get past the first few lines of code
LLM security, he jokes, is the easy problem of the whole AI arena right now. The hard one, he says, is that once you send your data out you have to open the floodgates of hell to send it there, which is why he thinks people will need to worry about the security of multi-agent systems more and more
He does not think hallucination is always a defect. He describes telling a chief executive earlier that year that hallucination is not necessarily a bad thing, and gives naming a new product spanning two areas, with reasons why the name is good, as a case where you want the creativity
His staged advice for an executive early in the journey starts with talking to your data. Start by talking to your data and creating a few scenarios for it, he says, then move to AI workflows or deep research, then to multi-agent systems and integrating them. He notes that even an HR letter sent to a public model can create data privacy problems
He says he presented recently at MIT, where the framing is that the world is being prepared for a trillion agents rather than a billion. With billions of people, he says, a trillion agents means 1,000 agents working for each person, one of which could be a personal assistant, and he imagines his assistant negotiating calendars with Christina’s the next time they speak
His sharpest instruction is that this is not an LLM job. Building these systems, he told a research department recently, is a software engineering job, so do not disregard the algorithm-based pieces you need. His illustration is a RAG demo he was shown: asked why he should buy the competition instead, the system answered the question
He names two taboos he thinks the industry is keeping quiet. People are not talking enough about the risks and try to put them under the carpet, especially in multi-agent systems; and people claim LLMs and agents can do things that actually need formal proofs or neurosymbolic tools. He says a logical layer on top of agents is starting to be accepted more and more
About Claudionor Coelho Jr
Claudionor Coelho Jr was chief AI officer at Zscaler at the time of this conversation, and has spent his career building AI inside companies rather than around it. He took a PhD at Stanford in a technique now used to build AI acceleration, worked in formal verification at Jasper Design Automation, which Cadence Design Systems acquired, and then helped build Brazil’s first deep learning company, Kunumi. His own account is that he was assisting a colleague with that colleague’s company and told him deep learning was the coming wave. Kunumi was acquired in 2024 by Bradesco, the country’s second-largest bank. At Google he was on the Pixel team building AI acceleration for video codecs, and the quantization and model compression work he did there was used by CERN in its research on subatomic particles and made the cover of Nature Machine Intelligence in 2021. He has also been chief AI officer at Advantest and led AI Labs at Palo Alto Networks, and has advised global leaders through the World Economic Forum. He has since moved to Majestic Labs, the AI infrastructure startup that came out of stealth in November 2025.
In this episode
| 00:42 | Welcome |
| 01:00 | Who he is: chief AI officer at Zscaler, and deep learning research at Google |
| 01:15 | A Stanford PhD, neurosymbolic AI, and secure multi-agent systems |
| 01:48 | An early pioneer, and the first deep learning company in Brazil |
| 02:07 | Selling the company to Cadence, and building Kunumi |
| 03:36 | The Pixel team, video codecs, and CERN |
| 04:17 | The cover of Nature Machine Intelligence |
| 04:25 | From bring your own data to bring your own agents |
| 04:51 | What bring your own data actually meant |
| 05:26 | Agents that add an interpretation layer, not just the data |
| 05:55 | Securing agents, guardrails, and exfiltration |
| 06:12 | The DEF CON prompt injection against Microsoft Copilot |
| 06:27 | Why probabilistic analysis of text is easy to bypass |
| 06:46 | Shipping confidential data outside your security perimeter |
| 07:20 | Keep the data inside and keep the agents inside |
| 07:44 | Advising a board: the top three questions |
| 08:02 | Question one, is your data sanitized: the data dump |
| 08:44 | Question two, what risks are you willing to take |
| 09:23 | The AI strategy together with the security strategy |
| 09:32 | Financial auditing, closed rooms, and the discrepancy |
| 09:55 | Question three, the unknown applications that could generate the most profit |
| 10:25 | Workflows in corporations that were never documented |
| 11:16 | Leaders who will not raise their hand in front of the board |
| 12:14 | LLMs are a piece of technology, not the end goal |
| 12:33 | Self-driving, and attention span dropping to 10 to 20 percent |
| 12:57 | The real work is explaining hallucinations to management |
| 13:33 | Which board question reveals the biggest blind spot |
| 13:44 | The data, and the article he wrote in 2022 |
| 13:59 | LLMs and agents cannot fix bad data |
| 14:22 | Steve Jones on data as oil, and consumption at the wellhead |
| 15:09 | Rethinking how applications are built at all |
| 15:29 | The F-16 cockpit, and data that conflicts with itself |
| 16:45 | Concrete examples, and why his architecture mattered |
| 16:53 | An annotation at the meta level for every piece of data |
| 17:17 | A rule layer, and why 99.9 percent is not good enough |
| 17:57 | Frameworks for the rule layer, mostly built by hand |
| 18:15 | Rules and knowledge graphs on top of the agents |
| 18:31 | The coding agent that deleted a database and faked the record |
| 18:56 | Small agents, complex agents, or swarms |
| 19:40 | What happens if you give it the wrong question |
| 19:48 | Deep research, and when a wrong answer is tolerable |
| 20:18 | AI workflows, and where an algorithm beats an LLM |
| 20:40 | Finding a bug is an NP-complete problem |
| 21:08 | Formal proof and an LLM cooperating, in his GitHub |
| 21:28 | Tools and algorithms far more efficient than LLMs |
| 22:57 | LLMs changing the interface, first typing, then audio |
| 23:52 | Good at text, less good at numbers: strawberry and Burberry |
| 24:18 | Both worlds living together, algorithms and LLMs |
| 24:49 | Whether enterprises overestimate their security readiness |
| 24:58 | Security of agents as taboo, and vibe coding as a live manual |
| 25:21 | Save the directory, diff everything, edit it back |
| 26:06 | TkDiff, and undoing what was generated |
| 26:29 | Outsourcing your understanding of the code to an LLM |
| 26:48 | Where neurosymbolic AI fits as LLMs hit their limits |
| 27:34 | Generating tests for legacy code, and where GPT and Anthropic stop |
| 27:56 | Shallow functions that fit the token space, and pairing formal proof with the model |
| 28:20 | Neurosymbolic as a knowledge graph layer feeding the model |
| 29:03 | Functions of 400 and 500 lines |
| 29:24 | Amazon using neurosymbolic to validate generated code |
| 30:13 | Three years out, and the multi-agent system he jokes he built in 2016 |
| 30:58 | LLM security is the easy problem |
| 31:33 | Where hallucination is the feature, not the defect |
| 32:33 | What falling behind will cost, three years from now |
| 33:16 | Grounding, and what a fully AI-operationalized business does |
| 33:34 | Finding where the competition is opening stores |
| 34:27 | Guidance for executives early in the journey |
| 34:44 | Start by talking to your data |
| 35:06 | MIT, and preparing for a trillion agents rather than a billion |
| 35:53 | His personal assistant negotiating with yours |
| 36:18 | Two World Economic Forum reports he worked on |
| 37:05 | Section AI as a place to start |
| 37:46 | Andrew Ng’s courses, and the universities running programs |
| 38:02 | Not an LLM job, a software engineering job |
| 38:31 | The RAG demo that recommended the competition |
| 39:15 | His defining leadership edge |
| 39:41 | Be humble, because nobody leads in everything |
| 40:04 | Do not be afraid of it, but do it consciously |
| 40:29 | The two taboos, and the logical layer above the agents |
| 41:10 | Wrap-up |
In Claudionor’s words
“Keep the data inside and keep the agents inside. I think that’s the most advisable solution right now for multi-agent systems.”
— Claudionor Coelho (07:20)
“I joke saying LLM security is the easy problem of the whole AI arena right now. But the problem of multi-agent systems is that once you send your data out, you have to open the floodgates of hell to send your- ... data there.”
— Claudionor Coelho (30:58)
“We are basically shipping our confidential data to those entities that are outside our security perimeter, and we are authorizing them and trusting them with our most precious data.”
— Claudionor Coelho (06:46)
“So instead of being a data lake, we basically create a data dump.”
— Claudionor Coelho (08:02)
“LLMs and agents cannot fix bad data. They rely on the data to be correct.”
— Claudionor Coelho (13:59)
“You don’t want the full self-driving to not hit the wall with 99.9%. You want it to not hit the wall 100% of the time.”
— Claudionor Coelho (17:17)
“Most of the problems with agents is not developing the agents or the infrastructure, it is explaining to upper management why hallucinations happen all the time.”
— Claudionor Coelho (12:57)
“There is no way with the current architecture of LLMs that you can possibly believe that they can solve an NP-complete problem, okay, in general.”
— Claudionor Coelho (20:40)
“Building those systems, it’s not an LLM job. It’s a software engineering job.”
— Claudionor Coelho (38:02)
“People are not talking too much about the risks. They try to put under the carpet the risks, and especially in multi-agent systems.”
— Claudionor Coelho (40:29)
Resources
Claudionor Coelho Jr
Claudionor Coelho Jr on LinkedIn: His profile, and the one thing he offers by name when asked what listeners should follow. It carries the LinkedIn posts he refers to at 12:57 and 13:44, and at 26:06 he says he is going to write another one in the next few days
Zscaler: Where he was chief AI officer at the time of this conversation. Its announcement of his appointment is dated 6 November 2023
The two World Economic Forum reports he worked on
Navigating the AI Frontier: A Primer on the Evolution and Impact of AI Agents: The report on AI agents he points to at 36:18, published 16 December 2024
Artificial Intelligence and Cybersecurity: Balancing Risks and Rewards: The AI and cybersecurity report, part of the Industries in the Intelligent Age white paper series. He describes both reports as released the year before this conversation and says he participated in them
Ideas and terms discussed
Bring your own agents: His reframing of the cloud-era bring your own data, and the shift he opens with. Under bring your own data, corporations still had to understand the data internally. Once agentic flows encapsulate the data layers, the ask changes: instead of the raw machine data, you request the points the other side thinks are anomalous and interpret only those. The agent carries an interpretation layer, not just the data
The security perimeter problem: The center of his argument. With MCP or distributed agents you are sending confidential data to entities outside your own perimeter, authorizing them and trusting them with your most precious data, without knowing whether they hold your security standard. He calls this one of the open problems distributed multi-agent systems currently have, and his working answer is to keep both the data and the agents inside for anything that is not a toy application
The logical layer: What he wants above the model, and the thing he says is starting to be accepted. Probabilistic interpretation of text can be talked past, which is why guardrails alone fail, so he adds a rule layer that encodes what must be true for the business operation, plus knowledge graphs. His standard for it is absolute rather than statistical: a self-driving car should not hit the wall 100 percent of the time, not 99.9 percent. He says frameworks for this are starting to appear but that most of the time you build them by hand
The data dump: His name for what the advance of cloud techniques produced. Once companies started dropping or saving everything, what was meant to be a data lake became a dump: conflicting records, and records that have gone obsolete because data is temporal. Agents now scan all of it. This is why, of his three board questions, he thinks the data one reveals the biggest blind spot
The three questions for a board: Is your data sanitized. What risks are you willing to take, given that everything has a risk and a return and a toy application on non-confidential data may be worth it. And what are the unknown applications that could generate the greatest profit, on the grounds that most corporate workflows have never been documented
NP-complete, and why it bounds LLMs: The technical spine of his argument about what to build and what not to. Finding a bug in a hardware or software description is in general an NP-complete problem, needing exponential time or space, and he says there is no way the current architecture of LLMs solves that in general. He ties his PhD work and two acquired companies he worked at to formal verification, so this is the ground he knows best
Formal proof engines paired with models: His alternative to asking a model to do the impossible. For generating tests over a legacy codebase, working out how to hit a given line is the NP-complete part, so a formal proof engine does that and hands the result to the LLM. He says he tried GPT, Anthropic and all the public and private models and they fail as a single function grows, and he would say they never get past the first few lines of a 400 or 500 line function
Deep research versus AI workflows: The distinction he uses to decide how much structure an agent system needs. Deep research is a swarm that searches, writes code and runs it, and is fine where a wrong answer is tolerable because something downstream checks it. An AI workflow needs more structure, and inside that structure an existing algorithm may beat an LLM, which matters most where you cannot afford hallucination
Hallucination as a feature: His counter to the assumption that hallucination is always a defect. When a model is asked to name a new product spanning two areas and to give reasons the name is good, the creativity is the point. He describes making this argument to a chief executive earlier the same year
The two taboos: What he says the industry keeps quiet. People are not talking enough about the risks and try to put them under the carpet, particularly for multi-agent systems. And people claim LLMs and agents can do work that actually needs formal proofs or neurosymbolic tools
Named on air
Advantest: The company he means at 13:44, where he says he was chief AI officer and dates the LinkedIn article he wrote about the data problem to 2022. The name in the audio is garbled; Advantest comes from Zscaler’s announcement of his appointment
Kunumi and Bradesco: The Brazilian deep learning company he helped build, which he says was acquired in 2024, the year before this conversation, by Bradesco, the second-largest bank in the country. He describes himself as assisting a colleague with that colleague’s company rather than founding it
Jasper Design Automation and Cadence Design Systems: The formal verification company he worked at and the company that acquired it, where he was already using AI to fine-tune NP-complete heuristics
CERN and Nature Machine Intelligence: The quantization and model compression work from his time on Google’s Pixel team was used in CERN’s research on subatomic particles, and he says it was the cover of Nature Machine Intelligence when the paper was published in 2021. STMicroelectronics, he says, built a product from it
Synopsys: Where he jokes that he built his first multi-agent system in 2016, to translate users’ questions into scans of device logs on a complex hardware system
DEF CON: The conference where, he says, someone was able to infiltrate Microsoft Copilot by prompt injection and bypass its guardrails, last week or the week before. He is relaying a news post he read rather than a demonstration he saw
Amazon: He says he thinks Amazon recently posted a blog or a paper on using neurosymbolic methods to validate generated code, on the grounds that only a formal proof engine can say whether code is correct
Andrew Ng’s deep learning courses: The learning resource he recommends for people starting out, at 37:46, and he thinks it carries a course aimed at executives
Section AI: Christina’s recommendation rather than his, given at 37:05: three free classes a month and a program you can bring inside an enterprise. He is asked for something similar and answers with Andrew Ng’s courses instead
Steve Jones at Capgemini: Christina’s reference at 14:22, on data being like oil because it has to be refined, and on AI moving consumption of the data to the wellhead. Steve Jones is the guest on episode 11
VentureBeat: An article he says made the same point he does about finding bugs in code. He does not give a title or a date
Frequently Asked Questions
-
The biggest security risk in a multi-agent system is that your confidential data leaves your own security perimeter and is trusted to somebody else. Claudionor Coelho Jr, then chief AI officer at Zscaler, puts it above model-level risk: LLM security, he jokes, is the easy problem of the whole AI arena, while the problem with multi-agent systems is that once you send your data out you have to open the floodgates of hell to send it there. With MCP or distributed agents you are shipping confidential data to entities outside your perimeter, authorizing them and trusting them with your most precious data, and you do not know whether the company on the other side holds the same security standard you do.
-
You keep the data and the agents inside your own perimeter, and you put a rule layer above the model rather than relying on guardrails. For anything that is not a toy application, Claudionor Coelho says, keep the data inside and keep the agents inside, and he calls that the most advisable solution right now for multi-agent systems. Guardrails alone are not enough because these systems work on probabilistic interpretation of text, which is very easy to bypass no matter how much you try to secure it. His example is a report he read of Microsoft Copilot being infiltrated at DEF CON by prompt injection, a week or two before this conversation. Above the model he wants a logical layer of rules, and knowledge graphs, that encodes what must be true for the business operation.
-
A board should ask three things: whether the data is sanitized, what risks the company is willing to take, and which unknown applications could generate the greatest profit. Claudionor Coelho gives those as his top three, and adds that they should be put as one strategy rather than two, because the AI strategy and the security strategy belong together and the judgment has to be made per application. On the data question he notes that with the advance of cloud techniques companies started saving everything, so the data lake became a data dump, full of conflicting and obsolete records that agents now scan. On risk he is explicit that he is not saying avoid multi-agent systems, only that everything carries a risk and a return.
-
No. AI cannot fix bad data: LLMs and agents rely on the data being correct. Claudionor Coelho says this is the question that reveals the biggest blind spot of the three he would put to a board, and that he was writing about it in 2022, before or around the time ChatGPT came out, arguing his next job would be to fix the data problem in corporations. If the data is bad, he says, anything you feed into the pipeline later will come back with a bad response. His illustration of the specific failure is an F-16 cockpit: ask a multi-agent system to show you where the instruments are and you do not know whether you get the analog cockpit of the F-16A or the digital one of the latest version.
-
Guardrails are not enough because they work on probabilistic interpretation of text, and probabilistic systems can be talked past. Claudionor Coelho points to a report he read of Microsoft Copilot being infiltrated at DEF CON by prompt injection to bypass its guardrails, a week or two before this conversation, and says that no matter how much you try to secure such systems it is very easy to bypass them, so you need another logical layer on top to secure them at all. The standard he holds that layer to is not statistical: if a self-driving car is facing a wall, you do not want it to avoid the wall 99.9 percent of the time, you want 100 percent, which is what a rule layer above the machine learning is for.
-
You should use an algorithm especially where you cannot afford a hallucination, and Claudionor Coelho’s worked example is finding bugs in code. When the framing is put to him as the more the correct answer is required the more you go to algorithms, he corrects it: both are generative AI. Finding a bug in a hardware or software description is in general an NP-complete problem, needing exponential time or space, and he says there is no way the current architecture of LLMs solves that in general. He tested GPT, Anthropic and all the public and private models on generating tests for legacy code: they manage shallow functions that fit in the token space, and on a function of 400 or 500 lines he would say they never get past the first few lines. What he does instead is pair a formal proof engine with the model, the engine working out how to hit a line of code and handing that to the LLM.
-
Neurosymbolic AI supplies the logical layer that a probabilistic model cannot, and it is already being used to check what models produce. Claudionor Coelho describes pairing a formal proof engine with an LLM so each does what it knows best, and says some people characterize neurosymbolic work as a knowledge graph layer sitting on top and feeding information in. He says he thinks Amazon recently posted a blog or a paper on using neurosymbolic methods to validate generated code, because only a formal proof engine can give insight into whether code is correct. He also says a logical layer on top of the agents is starting to be accepted more and more as the way to secure the interaction.
-
An executive early in the AI journey should start by talking to their data, then add workflows, then move to multi-agent systems. That is the staged order Claudionor Coelho gives, and he pairs it with the advice that a risk-averse executive should look for business opportunities where they can have more control. The first level is talking to the data and building a few scenarios around it, without sending it outside, because even an HR letter sent to a public model for evaluation can create data privacy problems. The next step is AI workflows or deep research, and only then multi-agent systems and the work of integrating them. His broader caution is that building these systems is a software engineering job rather than an LLM job.
-
[00:42] Christina Ellwood: Welcome to AI Realized, the podcast for enterprise executives leading AI deployments. From tackling security, data, and operational challenges to navigating organizational transformation, AI deployment offers a unique opportunity to redesign our organizations from the inside out. I'm Christina Ellwood, your host for today's episode, and today we're talking with Claudionor Coelho Jr, and he has been leading AI in several companies, including CAIO of Zscaler, and he was a deep learning researcher at Google. He's one of the most influential voices in AI innovation and security. A Stanford-trained PhD, he's led pioneering work in deep learning, neurosymbolic AI, and secure multi-agent systems. He founded Brazil's first deep learning company, and he has advised global leaders through the World Economic Forum. In today's conversation, we'll explore the opportunities and risks shaping the next era of enterprise AI. Claudionor, welcome to AI Realized.
[01:44] Claudionor Coelho: Hi, Christina. It's a pleasure to be here today.
[01:48] Christina Ellwood: You've been an early pioneer in AI for a long time. Maybe you'd give us a little short story about that and how it led to the first deep learning company in Brazil.
[01:58] Claudionor Coelho: Oh, yes. Sure. Actually, I did my PhD in Stanford in one of the techniques people use to build AI acceleration right now. And after we sold the, the company, I was living in Brazil, we sold the company to Cadence Design Systems, and I was assisting another colleague of mine with his company, and I told him, "There is a new wave coming in, and this wave is deep learning. Let's build this company and focus on deep learning in this company." And actually, this company is called Kunumi, and it was acquired by Bradesco last year, which is the second-largest bank in Brazil.
[02:34] Christina Ellwood: Congratulations. When did you realize that AI was really gonna reshape enterprise strategy?
[02:42] Claudionor Coelho: That's a very good question. So what happened is that when, uh, even when I was at Jasper Design Automation, which got acquired by Cadence Design System, I was already using AI to fine-tuning algorithms. So there's a class of algorithms called NP-complete algorithms that are very hard to execute because they require exponential time to execute. And I was basically using AI back then to fine-tune those heuristics so that we could accelerate or speed up execution. And at that time I saw that we could do a lot of AI, and then when I started reading more and more papers in deep learning, I said, "Okay, there's a new wave coming in, and I will basically jump into this new wave."
[03:25] Christina Ellwood: Gotcha. You did research on-- during your PhD days, but you also did research at Google. How did your, uh, your research work influence your industry approach?
[03:36] Claudionor Coelho: Yes. At Google, actually I was in the Pixel team, and we were building AI acceleration for video codecs, for video encryption and decryption, video compression. And actually the stuff that I did Google also was used by CERN in the research that they did with subatomic particles like boson of Higgs. Mm-hmm. We were even the cover page of Nature magazine, and SMT micro- STMicroelectronics also create a product out of it that encapsulate on it because we could quantize and, uh, reduce the model size at the same time to more than 100X in the size of the model and getting, like, uh, the same accuracy. So that, people were very happy with that back in 2021 when we published the paper. It was the cover page of Nature Machine Intelligence.
[04:25] Christina Ellwood: Good for you. I'm a scientist by education myself, so I always enjoy following the trajectory of AI in both the enterprise and in science. It's my guilty pleasure. So you made a, what I thought was a really fun claim, which is that we're moving from bring your own data to bring your own agents. So for the executives listening, what does that shift really mean in practice, and how soon can we expect it to happen?
[04:51] Claudionor Coelho: Yes. So bring your own data, or BYOD, actually means that a lot of people, when cloud came, basically they said, "You bring your own data, and then we are going to incorporate the data into our analysis mesh and figure out what the data's about." But in reality, what it means is that people had to understand the data internally in corporations. So with agentic flows being able to encapsulate the data layers, we're entering a phase in society where we can basically tell people, instead of, "Give me your data," I can basically tell them, "Your own agents." Because agents, they adds the data, but they add also an interpretation of the layer, which is like adds intelligence to the layer. And this brings another layer of a hyper-connected devices, where instead of basically say, "Give me the raw data of what your machine is doing right now," I could just say something like this, "Give me the points where you think there are anomaly detections on your data, and then I will basically interpret just those points from now on." Imagine this.
[05:55] Christina Ellwood: I think it's a very exciting innovation to be using agents in this way, but they have some challenges, too. Securing them, providing guardrails, and we've seen some really interesting cases lately with exfiltration. What are your thoughts about that?
[06:12] Claudionor Coelho: I don't know if you read on the news, but last week someone basically posted that in DEF CON, last week or the week before, they were able to infiltrate Copilot from Microsoft by using prompt injection and bypass guardrails. And this is really a challenge because remember, we are talking about probabilistic interpretation, probabilistic analysis of text, and it's not enough in probabilistic... It, it's very easy to bypass those systems. No matter how much you try to secure, you need another logical layer on top of that in order to be able to secure those systems. And even you talk about MCP or HY or even distributed agents, there's another problem that we see that we are basically shipping our confidential data to those entities that are outside our security perimeter, and we are authorizing them and trusting them with our most precious data. And that's really a problem because, uh, we don't know if that company on the other side has the same level of security that you have a- and you're trusting them with that.
[07:16] Christina Ellwood: Do you have thoughts about how to address that shortfall?
[07:20] Claudionor Coelho: So that's basically one of the open problems right now that we have with distributed multi-agent systems. Because what I have been telling companies is that if you have secure data, if it's not a toy application, don't send the data outside your security perimeter. Keep the data inside and keep the agents inside. I think that's the most advisable solution right now for multi-agent systems.
[07:44] Christina Ellwood: Yeah, I think that's the only solution right at the moment, but we do need some innovation in that area for sure. And many leaders are worried about getting business value from AI without creating new risks. If you were advising a board, what are the top three questions you would advise them to ask their teams right now?
[08:02] Claudionor Coelho: So, first question is if your data is sanitized or not. People don't understand that the data has... With the advance of cloud techniques, we started dropping or saving everything. So instead of being a data lake, we basically create a data dump. That's we basically drop everything into the cloud because we say later on we are going to figure out if we ever need that data or not, or we are going to use. Guess what? Now with agents that scans your data, we are basically feeding agents with that data that we said it was temporary, and we could have data that is basically conflicting data, and even data that has become obsolete because data is temporal. The second question I would ask the board is, what risks are you willing to take? Okay, because remember, it's not that I'm saying that don't use multi-agent systems, don't save the data at all, but you have to understand everything has a risk, a return, and maybe if you're just doing something that it's a toy example, it's basically talk to your data internally and the data is not confidential, i- it's okay to assume the risk. Okay?
[09:13] Christina Ellwood: So the board should be asking the executive team how they are-- How would they ask that question? Are they, "How are you protecting us from risk?"
[09:23] Claudionor Coelho: Question is that what you need to do instead of basically saying just this is like the AI strategy for the company, this is the AI strategy together with the security strategy. Because with the security comes risks. Okay? And for each application you wanna do... I'll give you an example. Suppose, uh, remember public companies when they have, like, financial auditing, they h- usually have those closed rooms that people can sometimes cannot even bring cell phones inside. And now I've heard of people doing, "Oh, we have a multi-agent system that does the financial auditing for you." So when you had that in person, you basically did not even allow people to bring cell phone to that room where they're doing financial auditing. And now people are saying it's okay to send the financial auditing outside your security perimeter because they are safe. I think there's a discrepancy on that, and people need to analyze And the third question that I would ask is, what are the unknown applications that could generate the greatest profit for us using AI? You have to understand that most of the workflows in corporations, they have never been documented. I- imagine this, you have this email you send person A to person B, and this carries an importance because it's role-playing, but it's-- people basically carry over with sending to person A from person B. But right now, if that email is not answered timely, that may result in loss of revenue per- or cost revenue or loss of opportunity for the company. So those types of interactions, they could be easily processed and automated using AI workflows, and even have AI workflows working towards our favor. So people need to understand, what are the new opportunities people are willing to take? Uh-
[11:13] Christina Ellwood: That's a great question, isn't it? Because that starts the right discussion. I also often hear from people advising boards, and then the leadership teams of those same boards, that there is a hesitance on the part of the leaders to raise their hand to s- make a recommendation about how to use it, either because they are unclear what that will do to the, the way they're perceived, or because they aren't sure what impact that would have on the business and the business strategy, and they don't know that they're prepared to be the person in that hot seat, if you will. And so they're not raising their hand. But behind closed doors with just their peers, they're willing to talk about that and very openly talk about it. Now, I don't really think that's a, a trust issue between the leadership and the board. I think it's a lack of transparency about the appetite that the board has for there being new suggestions for strategies for the company going forward with this technology. So they're really doing it all with efficiency-related things, with everybody can agree that saving money is a good thing
[12:14] Claudionor Coelho: Yeah, a- and you have to understand, everything is based on a piece of technology that is called LLMs, but LLMs is not the end goal of everything. We live in a world with rules, and my wife has a Tesla with self-driving, and I turn on the self-driving all the time. But you have to understand that self-driving has risks, and even the Department of Transportation have not realized that once you turn on the self-driving, even though you may have your hands on the wheel, your attention span has dropped to 10 to 20%. That's a reality. Okay? And now if you transpose that to LLMs and to agents making decisions in corporations, the same thing happens. Once you have an AI taking over that role, you have to understand that attention span of people will drop. Afraid to put systems that rely on probabilistic reasoning, for lack of a better word, but they make those systems making decisions, those decisions are prone to errors. So I just joked today to someone on LinkedIn saying most of the problems with agents is not developing the agents or the infrastructure, it is explaining to upper management why hallucinations happen all the time and trying to reduce hallucinations in those systems. And I think this is the real issue that we have.
[13:33] Christina Ellwood: Of the three questions that you recommend the board ask of the leadership team, which one of those do you think will reveal the biggest blind spot?
[13:44] Claudionor Coelho: I think the data. I always say it's very funny because when I was the chief AI officer at Advantest, I pushed like a LinkedIn article saying, "My next job is going to fix the data problem in corporations because people don't understand that with bad data..." This was, like, in 2022. It was even before or early 2023, so this is even before or at the time ChatGPT was out. So people don't realize that if the data is bad, anything that you feed to the pipeline later on will come with bad response. LLMs and agents cannot fix bad data. They rely on the data to be correct.
[14:22] Christina Ellwood: You mentioned the problem of this pooling of all this data that we really didn't do anything to prepare, we just shoved it in the data lake or whatever for later gator. One of the things that Steve Jones over at Capgemini has made a point of is that the reason the analogy that data is like oil is that like oil, data needs to be refined and processed. And he likes to say that with AI, we are moving the consumption of the data to the wellhead completely unprocessed in any way, shape, or form. And of course, we didn't build the applications to generate the data we need for the AI. It's exhaust from the use of the application. The application wasn't designed to generate the data that we need. So we have to rethink how we build applications, and perhaps agents will solve that because we'll replace a lot of them with agents. But the issue of having data that comes out of whatever system generates it in good form, in normalized form, et cetera, so that it can be used by the systems, is a whole 'nother way of thinking about data.
[15:29] Claudionor Coelho: And we are going to multi-modal now. The example that I like to mention is this. Suppose that you put all information about F-F-16 airplanes into a multi-agent system that can talk about how to, or learn how to fly an F-16, and you say, "Show me the cockpit and where the instruments are located." So F-16A, which was basically released in, I think, end of the '70s, all the instruments were analog. The latest version of F-16, all the instruments are digital. And if you say, "I need to learn how to fly F-16," you don't know which picture you're going to get, whether it's the picture of the F-16A or whether it's the picture of the latest F-16. And this shows you how data can be conflicting, and depending on how you fine-tune the question that you want to ask, that may give a different answer each time
[16:22] Christina Ellwood: Yeah. So true. And if you take and you couple it with multi-agent, now you have many more degrees of variability, don't you? It's at least to the power of N, if not greater than to the power of N. So you've worked on advanced multi-agent systems, and they were able to achieve results a single model agent couldn't achieve. What are some concrete examples of those systems, and why the architecture that you came up with mattered?
[16:53] Claudionor Coelho: So the first thing that I always did is basically to create an infrastructure that is going to clean up and analyze the data that are going to feed to those multi-agent systems. Okay? If you don't have a system that monitors, protects the data, I'm basically saying you need like an annotation at the meta level layer of every single piece of data that you're going to ingest into a multi-agent system. The second thing that you have to understand, I put a logical layer on top of that. As I mentioned to you, if you're driving like a Tesla car, and there is a wall, and the full self-driving is turned on, you don't want the full self-driving to not hit the wall with 99.9%. You want it to not hit the wall 100% of the time. Which means that you need a rule layer that basically goes above what the machine learning or AI is doing to make sure that for the business operation, we know certain laws must be observed.
[17:53] Christina Ellwood: Are there frameworks for that rules layer that you favor?
[17:57] Claudionor Coelho: There are starting to appear, but most of the time you need to create those by hand. And that goes beyond just guardrails because interacting with the business layer of the company that using that
[18:09] Christina Ellwood: I see. So it's like a rules-based infrastructure layer for feeding the data to the agent.
[18:15] Claudionor Coelho: And knowledge graphs. So it's rules and knowledge graphs on top of what we have as agent or LLMs. And people are starting to understand that we need something beyond just agents that is an LLM pushing code and executing code, because they're going to hallucinate a lot. There are several cases, one of the cases I've seen recently is someone was using, like, one of the coding agents, like Vibe Coding, and they basically decided to delete the database of users, and then they create a fake database when the person said, "Did you delete?" So the Vibe Coding created, like, a fake data saying, "Okay, I didn't delete anything," but it was fake data because the database had been deleted.
[18:56] Christina Ellwood: Wow. Okay. So what are the use cases that determ- let me put it a different way. One way to go about building an agent solution is to have lots of very small, single-purpose agents that you put together into an orchestrated system. Another way is to build an agent that's got complex steps that it can perform, and there are also cases where you build something in between, where the agents have medium level of complexity, but together they can do many things differently, so you can ar- architect them to operate in different types of swarm configurations. How do you make the decision about which of those approaches is best suited to a particular use case?
[19:40] Claudionor Coelho: That's a very good question. So usually the first question that I ask is this: What will happen if I give it the wrong a- question?
[19:47] Christina Ellwood: Okay.
[19:48] Claudionor Coelho: What people call the swarm that basically asks the internet, generates code, uses the code and stuff like that, they call this, like, deep research. Some people call deep research because they search the web, they write codes to do certain things, and they execute the code. And as long as you don't care too much if the result is wrong, because you're going to have some other systems to check the results, or maybe it will not influence, but they will just generate support information, it's okay. There's another class of applications that I call AI workflows. That you need a little bit more structure, and in that structure there may be algorithms that may solve the problem better than LLMs. I usually basically say, finding bugs in a code, there is an article in VentureBeat that said the same thing recently, but kept saying that. I did my PhD in two of the companies that I participated that were sold before, they were on formal verification. Finding a bug in a hardware or software description in general is an, an NP-complete problem. So it, it requires exponential space or exponential time to solve. There is no way with the current architecture of LLMs that you can possibly believe that they can solve an NP-complete problem, okay, in general. And that's one of the examples that there are formal proof solutions, and in my GitHub, I basically have one example that we did when we had formal proof together with LLM cooperating together. It generated good results. Uh, and sometimes there are algorithms that are already good to execute some problems. So the idea in those cases is basically we have tool, a set of tools, and those tools may involve algorithms that have been created in the past, and they are very efficient, m- much more efficient than LLMs to do the job. Yeah. And sometimes those workflows, they need to be integrated, and there is a space for that, too, especially if you cannot afford to have hallucination in the system.
[21:53] Christina Ellwood: Mm-hmm. So the more the correct answer is required, the more you go to the algorithm end of things with machine learning or predictive analytics- Mm-hmm ... or other types of algorithm base. And the more you are tolerant of variability, the more you can lean on a heavier generative AI type of approach.
[22:11] Claudionor Coelho: Both are generative AI. I participate in an event with, uh, VCs in the Bay Area a few months ago, and people are saying in user interface, as we know, in the next few years they're going to change a lot. So remember, it took me, like, 20 years to fully understand how to use Excel spreadsheets and how to fully use the full power, and I still don't consider myself to be an advanced user. But right now, that means the 20 years, it basically means repeating and interacting, pointing, clicking different places of the user interface. Right now with LLMs, it's much easier if I can just ask the LLM what I want to do, and it detects the intent for me, and then it may switch to an algorithm that it's going to execute. This gives an example that LLMs are changing the way we interact with the systems, first in typing, then later on with audio in, audio out. But they provide a very good, even in AI workflows, they provide a very good interface to the users. Okay? But they still need a little bit, if you care about the result and if there are financial loss, then you still need to have a more organized flow in the agent to be able to execute, which people call AI
[23:28] Christina Ellwood: workflows. Okay. That seems to make sense that that's a core value for an enterprise to be able to have AI workflows. So we have LLMs for apps for your language-intensive work, and then AI workflows for your process areas of work. Any other areas that you think there are natural fits between traditional AI and generative AI?
[23:52] Claudionor Coelho: You have to understand that large language models are very good to summarize and analyze text. Less to do numbers. Okay? For example, someone posted recently that although right now LLMs could, uh, that GPT-5 could count, I didn't test it, but it was on LinkedIn last week, that although it could count correctly the number of Rs in strawberry, it could not determine the number of Bs in Burberry. Okay? And that basically shows that there are limitations on the technology that people need to be aware, especially when they're going to start outsourcing a lot of those tasks to LLM or agents alone. You want-- And I think in the world that we are going to see later on is that we're going to have the both worlds are going to be living together, like algorithms on the one side and then LLMs on the other side, maybe the LLMs doing the interaction with the user for you.
[24:49] Christina Ellwood: Do you feel that enterprises are overestimating their security readiness for using AI in so many different use cases in, in the business?
[24:58] Claudionor Coelho: What I usually see is that people tend to not mention it. It's sort of taboo to basically talk about the security of agents, and also things like vibe coding. There is a benefit if you consider vibe coding, for example, as a live manual on how to interact with software, but more than that, they can start writing quickly and very rapidly. That's my experience. And usually, even when I use vibe coding, just one example, the first thing that I do, I save my directory, do the vibe coding, and then I do a diff on everything that it generated, and I start editing and eliminating those because later on, after three, four interactions, 30%, 40% of what they generated, basically garbage. People will not agree with that, but the reality of the game is because they cannot solve NP-complete problems like how to hit a line of code for complex codes.
[25:54] Christina Ellwood: So you, you don't trust any of the code that is generated and basically don't use it for vibe coding?
[26:01] Claudionor Coelho: I do generate the code, but I always in between interactions, I save. The-- It's actually, I usually-- I say that the-- Uh, uh, and I'm going to write, like, a blog on this, like, on LinkedIn in the next few days. I said the most useful tool for me is TkDiff, which basically shows the previous version, the current version that vibe coding generated, and then you could see what it generated, and then you can undo some of the stuff.
[26:25] Christina Ellwood: Okay. I see. So you, you do an iterative review.
[26:29] Claudionor Coelho: And one of the problem with vibe coding is that before the user used to have full control, so he would have full knowledge of the thing, and we are basically outsourcing the knowledge and understanding of the code to an LLM. And remember, LLMs are good for text summarization. They're not good for logic ana-analysis
[26:48] Christina Ellwood: Okay. Let's shift gears a little bit and talk a bit about LLMs. They're-- We're starting to hit some upper limits on the, on LLMs. What... And you've done some work in neurosymbolic AI. Tell me a bit about where you think neurosymbolic AI will fit into the picture as we hit those upper limits on LLMs.
[27:10] Claudionor Coelho: Okay. So of course, one of the problems that I can mention to you that I solved recently, no, it's one of the solutions available. Suppose that you want to test your legacy software. I can send you the GitHub link to the package that I created. So if you want to generate tests for a legacy software codebase, basically figuring out how to hit certain lines of code. This is an NP-complete problem, so we need to outsource that to a formal proof engine that can hit that line. I did some experiments with GPT, Anthropic, all the public and private models. Usually, as the code complexity increases in one function- They end up not being able to solve that problem for more complex functions. They usually can solve for very shallow functions, which basically means that it fits in the token space. But that's one of the examples where we have formal proof engines together with LLMs, each one doing what it knows best. So once the formal engine knows how to sensitize the code, how to hit a line of the code, it passes that information to LLM, and the d- LLM can... This shows you how we have to interact both models, like formal proof models or even some people argue that neuro-symbolic, it's actually a knowledge graph layer on top of, and that provide information to a-
[28:33] Christina Ellwood: So that's the, the, the combination that you would use for doing that legacy code review because the legacy code is so long and complex, and it doesn't all fit in the memory. So you would put the whole thing in the neuro-symbolic, find the right lines of code, extract that code, and give that to the LLM. Is that the process that you're describing? Yes.
[28:51] Claudionor Coelho: That's exactly what I have, and I'll send you the link later on. But it basically finds how to sensitize the code. One of the basic problems of generating tests, you want to have line coverage of your entire code base. And as we reach towards the end of a function, you're going to see that it's very rare that an LLM can generate a sensitization condition for complex functions. For easy functions, three lines, then it's very easy. But if you have a function with 400 lines and 500 lines, I, I would basically say they never get past the first few lines of the code. So that's why we need another model that basically does a formal proof, and this is one of the examples. I think Amazon recently posted a blog or a paper saying that they're using neuro-symbolic also to validate the results whenever they have to generate code. 'Cause they can execute a formal proof, and that formal proof can actually give insights if the code is correct or not, because only a formal proof engine can do that for you.
[29:50] Christina Ellwood: I think our listeners would be very interested in those links and being able to pursue this on their own, so if you could share those, we'll put those in the show notes. Talking a little bit about more where things are going, three years from now, what will separate enterprises that are leading in responsible AI adoption from those that are falling behind?
[30:13] Claudionor Coelho: So there's no doubt that the world is going to multi-agent systems, and I, myself, have, uh, created several multi-agent systems in my past life. A- actually, I joke saying my first multi-agent system was created in 2016 when I was working for Synopsys to understand a very complex hardware system that we had. I had to understand users' questions and translate to scanning logs of several devices. I basically create a system to do that back then. This is, like, almost 10 years ago. But there's no doubt that corporations will have to go to multi-agent systems. They will have to start more and more to worry about security of those systems, because it's not only about LLM security. I joke saying LLM security is the easy problem of the whole AI arena right now. But the problem of multi-agent systems is that once you send your data out, you have to open the floodgates of hell to send your- ... data there. So people will need more and more to worry about security. Okay? And of course, we are going to start seeing a lot of new opportunities that are going to be created with agents. Remember, LLMs are very good to correlate a large number of text entries, okay? And, and that's one of the things they excel into. They hallucinate, and there are applications which is, like, uh, where a hallucination is good. I usually joke, I was talking to a CEO of a company earlier this year, and he told me what he could use and why hallucination was a bad thing. I said, "Not necessarily hallucination is a bad thing." I was basically telling him, suppose that you want to create a product, a new product in two different areas, and you could basically tell an LLM, "Generate for me a new product name for those, that involves those two areas in this scenario, and give me the reason why those products are good, the name is good." And that's one of the applications that you want the creativity in people.
[32:15] Christina Ellwood: Yes, that, I've heard that story too, that if you want more creativity, you want more hallucination. Well, so that's what's happening, that's what you're projecting is happening for companies that are adopting responsible AI. What about the companies that are falling behind? What do you project is going to be true for them three years from now?
[32:33] Claudionor Coelho: It's going to be harder and harder to compete the market. So one of the reasons I've been talking to CEOs and board members, they invite me to talk to them, is because they need to understand how they have to structure the organization, how they have to structure the AI plan so that they can move to the next phase. One thing is to play with ChatGPT. The other thing is to build systems that are reliable, that you can control hallucination, and then you can extract results out of them.
[33:04] Christina Ellwood: Where do you see AI transforming the enterprise in the coming years? What's a fully AI operationalized business gonna look like compared to what it is today? What does that transformation look like?
[33:16] Claudionor Coelho: The way that I see it is that a lot of repetitive work can be outsourced to LLMs, especially if you start realizing that you need a way to ground the system, and by grounding, to verify if the LLM is hallucination or not. Some systems are easier to ground than other systems. If you want to analyze a very large number of text data points, then LLM is going to transform the business. Imagine this case, that you want to know where you're going to open a new store for your business, and by doing that, you want to check where the competition is opening stores, and you can see that because there are public records everywhere, in cities and newspapers. And suppose that basically gives an idea in terms of competitive landscape, where people are going. And by basically being able to search that, it can give you spots that you can open new store for your business. This is just a very simple example on how businesses can transform. And if you do not use AI, you are going to be in disadvantage
[34:19] Christina Ellwood: Gotcha. Okay, so for-- what kind of guidance do you have for executives who are early in their AI adoption journey?
[34:27] Claudionor Coelho: They have to start looking into how they can use AI in their journey. They probably need to start looking at which bu-business opportunities. If they are averse to risk, they should be looking at the business opportunities where they can have more control, okay? And sometimes, I usually tell companies, "Start with just talking to your data." If you don't want to send your data outside, because remember, even an HR letter sent to ChatGPT for evaluation, they can be, basically be-- You may have problems with data privacy and stuff like that. So, you have to understand the risks and how to do that. So the first level is just talking to the data and creating a few scenarios where you could talk to the data. Next scenarios is using some AI workflows or deep research, and then start going to auto multi-agent systems and integrating those multi-agent systems. I did a presentation recently at MIT, where they are saying that we are starting to prepare the world for trillion agents running, not billion agents. We have billions of people, and for each-- So if you're talking about trillion agents, we are going to s- we are saying that for each person, we are going to have 1,000 agents working for that person. One of them could be, for example, personal assistant for every person in the world. Imagine that next time we talk, my personal assistant talks to your personal assistant. It has access to my calendar, it has access to-- Your assistant has access to your calendar, and they start negotiating and doing role-playing in that mode. This is where we are going.
[36:04] Christina Ellwood: Okay, and so what resources do you recommend to listeners who want to learn more about you and about your work and about their moving forward on their AI journey?
[36:18] Claudionor Coelho: I think there are several reports. I will send you my LinkedIn connection there, and there are several reports from several people talking about the future. World Economic Forum, we have two reports that we released last year that I participated on them. One of them is on AI agents, the other one is AI and cybersecurity. And I think those are good start points, but you have to understand that even for me, the technology is advancing very rapidly. And I usually say, if someone tells you that he or she knows everything about AI right now, th- I don't know. So I know that I don't know, and I have to constantly read a lot to be able to barely been able to keep at the pace that things are happening right now.
[37:05] Christina Ellwood: Yeah, I think once people get moving on their journey, they certainly do not lack for things to add to their knowledge. But getting started seems to be one of the more challenging phases of the technology journey that they're on. So I find that the Section AI training is a good place to turn to for people to get started. You can take three free classes a month. It's not expensive to buy, and it's a great program to bring inside your enterprise if you're looking to train your employees. So it also gives you a chance to use whatever it is that you might be using for your employees. So I think that can be a good tool for folks. Do you have anything else like that for early on in people's journey?
[37:46] Claudionor Coelho: I, I think one of the things that I always like to recommend to people, there's like this resource, deeplearning.ai from Andrew Ng. It's a very good resource and it has, I think it has one of the courses, AI for Executives, something like that there. And several universities, they're having those programs right now. And the one thing that you have to understand, I gave a presentation recently for a research department of a big company, and I basically told them, "Building those systems, it's not an LLM job. It's a software engineering job." So do not disregard that you need several key aspects that are algorithm-based in order to put those systems. For example, I saw a demo recently on a, a RAG-based system. RAG is basically when you connect the LLM to the data and trying to index the data. And they said, "Look," someone told me, "We want to put this in production." And the first question that I ask the system is this: "Tell me why I should buy the competition and not you?" And the LLM basically gave me the answer. That shows you a very good I- you have to be careful, and you have to build systems, and it's not just LLM connecting to your data. You need guardrails. You need a lot more to make those systems work
[39:08] Christina Ellwood: You have been doing this work for a long time, and you have worked with many executives in different capacities. You've worked with boards, you've worked with peers, you've worked with clients, you've worked with students. You've had many different types of executives and leaders that you've worked with who have different levels of knowledge and understanding. In this whole evolution of AI, what's your defining leadership edge in guiding other AI leaders?
[39:41] Claudionor Coelho: First of all, to be humble that the things are moving at a much faster rate than we can possibly imagine. So each small group, they probably have leadership and dominance in a certain area, but it's very rare to have the same organization to have leadership, even if you talk about OpenAI, Google, and maybe Google has because Google can afford having, like, a very large team, and Microsoft. But most of the organizations cannot afford that. And another thing is that don't be afraid of the technology. You have to do it consciously, but without being afraid, because it's not that we're discussing if the technology is going to be adopted, we're discussing when it's becoming widespread use, and it's basically becoming widespread use right now. And you have to understand, as I mentioned to you, there are two taboos that you have to be aware of. People are not talking too much about the risks. They try to put under the carpet the risks, and especially in multi-agent systems. People tend to claim that LLMs and agents can do stuff when in fact you need some other tools like formal proofs or neuro-symbolic tools to be able to solve the problem. So I think people are starting to realize that the neuro-symbolic, I've seen several reports of people saying that we need a logical layer on top of the agents to be able to secure the interaction, and this is starting to happen more and more right now.
[41:10] Christina Ellwood: Great. Thank you so much. And Claudionor, thank you for taking the time to talk with us today. It's been a pleasure to talk with you. I look forward to sharing the links that you are providing for us with the show notes so people listening can follow up on, on the conversation. So thank you very much for joining me today on AI Realized.
[41:31] Claudionor Coelho: It was my pleasure. Thank you very much.