Episode 100 of The Security Podcast of Silicon Valley aired on July 29, 2026, with Jon McLachlan and Sasha Sinkevich hosting. The guest was Xia Hua, co-founder and CEO of Traceforce, on her second visit to the show (Podbean, LinkedIn). Her first was episode 72, released July 1, 2025, about four months after she started the company. The episode is called “Why Your Employees’ Favorite AI Tool Might Be Leaking Your Data.” The video went up on YouTube the evening before as “Watch One Sentence Break One of the Most Popular MCPs” (YouTube).
Near the end, Xia named the thing almost every customer struggles with. Everybody wants an allow list and a deny list, she said.
“but they actually don’t know what to allow, what to deny.”
Xia Hua, at 33:47
Xia’s LinkedIn has her path. She spent nine years at Oracle on in-memory databases, then five at Clumio, where she rose to director of engineering. She has been Traceforce’s co-founder and CEO since February 2025 (LinkedIn). Y Combinator’s page for the company, from its Summer 2026 batch, lists two founders: Xia, with a PhD in applied math from MIT, and Varun Wadhwa as CTO (Y Combinator). Glenn Mulvaney, her co-founder on episode 72, lists himself on LinkedIn as a co-founder since January 2025 (LinkedIn). The episode 72 page covers the founding and the year in between in detail. This page sticks to what she said on this tape and what happened after it.
The show notes set up the demo. They say every employee probably has ChatGPT, Claude and Gemini installed and nobody tracks what data goes where, and that the prompt injection flaw Xia showed “can be triggered with a single sentence” (YouTube). On the tape, Xia calls Anthropic’s November 2025 report “last November,” so the conversation took place in 2026.
This page follows the conversation in order: a section for each part of it with the sources beside it, eighteen figures, twenty-three clips from the tape, the full transcript, and five tools: a quiz, a scorecard for how ready you are to write an allow list, a calculator for what overlapping AI tools cost, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote those words.
A year, and some customers
Jon welcomes Xia back. She says she had a blast on the show the year before, and that Traceforce had just celebrated its anniversary. Jon says it felt like yesterday.
“Quit my job a year ago, you know, to start this company.”
Xia Hua, at 1:55
She says she didn’t know what to expect. She had a big dream, a belief that the AI wave opened a chance to build something different and useful for security professionals.
“Now, a year later, we actually have some customers and definitely learned a lot along the way.”
Xia Hua, at 2:13
A year earlier, on episode 72, the company had its first customer after about two dozen design partners (episode 72).
The market caught fire
Sasha asks how the market has changed. A year ago Xia saw a clear signal and quit her day job. Has the signal changed?
Her answer is speed. Recently the news was all about OpenClaw, she says, because it caught fire. A year ago there was no OpenClaw, and MCP was just starting. AI adoption was nowhere near where it is now. The one major difference, she says, is that AI moves faster by the day.
Wikipedia describes OpenClaw as a free and open-source AI agent that carries out tasks through LLMs, using messaging platforms as its main interface. Peter Steinberger first published it in November 2025 as Warelay. It became Moltbot on January 27, 2026, and OpenClaw three days later (Wikipedia). Anthropic introduced the Model Context Protocol in November 2024 as an open standard for how AI systems connect to outside tools and data (Wikipedia).
Xia also says a Claude launch a couple of months earlier took 30% off the combined market value of software-as-a-service companies. That figure is hers. Wikipedia’s account of the sell-off says SaaS companies lost US$300 billion in value on February 3, 2026, in what was coined the “SaaSpocalypse,” and doesn’t give a percentage (Wikipedia).
The demand has changed too, she says. Security for AI is no longer boardroom talk. People are shopping for it.
“All of them are shopping for a security solution for AI.”
Xia Hua, at 3:43
That morning she had been at a startup pitch with four guests on the panel. Jon asks if they were all CISOs, the people responsible for securing their organizations. Yes, yes, yes, Xia says. Jon bets they all felt run over by the AI train, and Xia agrees. Companies don’t want to fall behind their competitors, and they know how much productivity they can get from employees who learn the AI-native tools. Then they install Traceforce and get a surprise.
“whenever they install our software, they’re like, I didn’t know that they’re doing that.”
Xia Hua, at 4:18
Two lines of product
Jon asks her to remind listeners what Traceforce does. Xia says it is not one of the sexiest tools out there, like OpenClaw. Traceforce has two lines of product. The not-so-sexy one, the commercial line, is a device-based solution.
“Our agent gets deployed on the devices.”
Xia Hua, at 4:47
The agent collects telemetry on how people use AI: which tools, and which MCPs are connected to which tools. That gives a full connectivity graph of AI use, and Traceforce places guardrails on it to fit each enterprise. The other line is the open-source scanner she demos later.
The long-run vision goes past security. Because Traceforce sees which data moves where and how employees use it, Xia wants a graph database other enterprise workflows can query, to answer questions about productivity and return on the AI budget.
“Like, should we purchase Claude or should we purchase ChatGPT?”
Xia Hua, at 5:43
Traceforce’s site now says the product runs on the device and covers browser AI, desktop apps and CLI agents (Traceforce). The graph shipped as TraceGraph in September, covered in What happened after the tape.
The CISO hat
Jon puts on his CISO hat. Depending on the size of the organization, that could be 100 people, 200, 1,000 or 50,000. They all show up for work, want to do a good job, and want the latest technology to help them, which means AI. Data is flying around.
“If I get a little bit of visibility into like what in the world is going on, my God, thank you so much.”
Jon McLachlan, at 6:19
Visibility is step one, he says. The return on investment Xia mentioned is something he could take to the boardroom. Xia says that is the whole point: a system with enough intelligence to answer whatever an organization wants to know about its own AI use.
“Think of it as like a mini, you know, your ChatGPT for your enterprise AI usage”
Xia Hua, at 6:41
AI tool fatigue
Sasha raises AI tool fatigue. Over the last couple of years a lot of AI products hit the market and a lot of purchases were made. Some came through business-to-business deals, and some employees bought for themselves.
“There could be three or four different tools doing the same thing.”
Sasha Sinkevich, at 7:28
How does Traceforce show an organization the duplication, so it can cut the cost? Xia says most organizations have more than one AI coding assistant. She names three running at once: Cursor, Claude Code and Augment Code. One disclosure here: YSecurity ran Augment’s SOC 2 Type 2 and ISO 42001 programs, and people from Augment have told its story on this show three times, on episode 43, episode 74 and episode 77. The examples were Xia’s, not ours.
“And it is a hard decision for them to make to block folks from using the other tools because those tools are their favorite, right?”
Xia Hua, at 8:01
An enterprise is typically willing to buy one of these vendors. Traceforce is still working out its answer with its design partners. The plan is to measure the work that goes through each coding assistant: the token usage, how many tokens burn every day, how heavy and how irreplaceable the workload is. She says she doesn’t know yet where the governance decisions will land. The calculator below puts a price on the overlap.
The Kleenex of AI
Jon asks about trends. Leaving out the coding agents, what is the most popular thing that shows up? ChatGPT, Xia says, by far.
“It’s almost like it became the Kleenex of the AI world, right?”
Jon McLachlan, at 9:21
Kleenex is a Kimberly-Clark brand of facial tissue, and Wikipedia notes the name is often used informally as a genericized trademark for facial tissue (Wikipedia).
Guardrails inline
Sasha asks about policy. Some organizations have explicit rules that keep data, or certain types of data, out of third-party AI tools. How do you guarantee the policy is enforced?
Traceforce hooks up with AI-native tools such as Augment, Cursor and ChatGPT, she says.
“We can hook up inline to actually impose these guardrails.”
Xia Hua, at 10:01
Her example is secrets, AWS tokens, stopped before they upload. The point is to keep sensitive data from leaving the employee’s device. Traceforce’s pricing page now lists sensitive data leakage detection in Claude, ChatGPT and Copilot in its free trial (Traceforce).
Free tools skip procurement
Jon has seen the gap from the other side. A company can have a program that catches the procurement process and requires a security audit before anything is bought. Free tools go around it.
“You just install, you just download them, you do a free trial, freemiumware, and then boom, all of a sudden, like private keys are flying around up into random clouds.”
Jon McLachlan, at 10:36
Who knows if they have SOC 2, he asks. He describes the people involved as excited folks, ready to use new technology to put their best foot forward and not get left behind. The push comes from the top down, from boardrooms, and chief executives repeat it because they answer to the board: let’s use AI, we have to use AI.
A CISO has to think that through, he says: how to get visibility, and how to run a security program while the wave rolls through the organization. On episode 73, Michael Moore of Glean explained why a free AI tool is usually paid for with your data. Our post on shadow AI governance has an AI-use policy that lets a team use AI safely without a ban.
An open-source scanner
Xia says Traceforce is doubling down this year on being a thought leader: articles and blog posts that help organizations adopt AI as fast as they can without giving up security. The other part of the effort is the open-source scanner.
“We have a vulnerability database for MCPs, for example.”
Xia Hua, at 12:21
The goal is a ready answer to the question of what employees are using and whether any of it has known vulnerabilities. The scanner’s README says scan results can go to Traceforce Atlas, which “has over 600 MCPs in its registry” (GitHub).
One sentence, live
Jon asks for an example.
“Like, what is a vulnerability in an MCP service?”
Jon McLachlan, at 12:41
Xia asks if she can share her screen, and Sasha says sure. The scanner is completely open source, she says, and anyone can download it. Traceforce used it to pen test a few well-known MCPs, two of them on screen so far.
“For example, Playwright is hands down one of the most popular ones.”
Xia Hua, at 13:04
The finding she reads out is a prompt injection. Someone could manipulate Playwright’s MCP server into returning text that tells the model to ignore its previous instructions, followed by a line about its system prompt and any API keys it has access to. The decodes of the tape disagree on two words of that text, so the transcript brackets them and this page doesn’t quote it. The video shows the screen.
That could be used to exfiltrate a company’s IP, she says. Jon adds the rest.
“There goes all the secrets that you have on your machine.”
Jon McLachlan, at 13:36
Playwright is an open-source library for browser testing and web scraping that Microsoft launched on January 31, 2020 (Wikipedia). Wikipedia defines prompt injection as an attack that exploits a model’s “inability to distinguish between developer-defined prompts and user inputs.” It traces the problem to May 2022, when Preamble reported it to OpenAI, and says Simon Willison popularized the term that September (Wikipedia).
The scanner’s public examples include a verified pen test of Playwright’s MCP server dated February 2, 2026. It lists seven results. Two are errors: a script tag injected to capture keystrokes and form inputs, and a fake login overlay to phish credentials. Five are warnings: a tight loop of 100,000 iterations, a memory allocation of up to 10 MB, a large string, excessive page navigation, and access to localhost services on common ports. Each one reads “Expected error but got success” (GitHub). The prompt injection from the demo isn’t in those public files.
Ten seconds to compile
Traceforce built a framework for the security dimensions people should look at, Xia says, and the pen test follows it. The team is writing articles and publications, and collecting feedback on what people want to see.
“So the goal here is to make it as accessible to the community as possible.”
Xia Hua, at 14:10
Jon thanks her for open sourcing it and says it should make proofs of value easy. People who are ready to go can just use the service.
“It takes 10 seconds to compile on your laptop or in your CI/CD pipeline.”
Xia Hua, at 14:35
The scanner is MCP X-Ray, written mostly in Go. Its README calls it “a unified open-source security scanning and penetration testing solution” for MCP servers and says it writes SARIF reports for security tools and CI/CD pipelines. It has three modes: a configuration scan for secrets and risky tool descriptions, a pen test that makes real tool calls, and a repository scan. The latest release, 1.0.3, came out on January 13, 2026 (GitHub).
The director of IT’s balance
Sasha takes the other side. Every business wants to move as fast as it can, and that usually means adopting AI tools. A large organization also has to strike a balance.
“And often, that balance is driven by the directors of IT.”
Sasha Sinkevich, at 14:59
Certain safeguards have to be in place before anyone uses the tools. Sasha asks what Xia hears from customers and design partners. What is their biggest pain point?
Two fears on the enterprise side
Xia splits the answer. It depends on whether AI is in your enterprise workload or your production workload. On the enterprise side there are two big fears.
“One is I don’t know if internal bad actor is a good way of putting it”
Xia Hua, at 15:34
Sometimes people just don’t pay enough attention, she says. Her example is an employee who uploads a CSV full of customer emails to a personal ChatGPT account. That is data leakage, an IP leak.
The second fear is bigger. Xia says Anthropic published a report last November about a Chinese espionage group that used Claude and MCPs against more than 30 large organizations.
“So, what we realized is: you know, if one malicious MCP gets landed on an employee’s laptop, this can really happen.”
Xia Hua, at 16:29
The MCP can issue a prompt like the one in the demo and exfiltrate data, she says. Nobody has published an accident like that yet, but she thinks it is bound to happen. The malicious piece could be an MCP, a connector, or something done to an OpenClaw install, any AI agent running on the device.
Thirty organizations
Anthropic published “Disrupting the first reported AI-orchestrated cyber espionage campaign” on November 13, 2025. It says it detected the activity in mid-September 2025 and assessed with high confidence that a Chinese state-sponsored group ran it. The group manipulated Claude Code into trying to break into roughly thirty global targets, and succeeded in a small number of cases. The targets included large tech companies, financial institutions, chemical manufacturers and government agencies (Anthropic).
Anthropic calls it the “first documented case of a large-scale cyberattack executed without substantial human intervention.” By its account, AI did 80 to 90 percent of the work, and people stepped in at perhaps four to six decision points per campaign. At the peak the AI made thousands of requests, often several per second. The attackers reached their tools often through MCP, and they got past Claude’s guardrails by splitting the attack into small tasks that looked innocent and telling Claude it worked for a legitimate cybersecurity firm. Claude sometimes hallucinated credentials. Anthropic banned the accounts, notified the affected organizations and coordinated with authorities over about ten days (Anthropic).
Xia’s figure of more than 30 is close to the report’s roughly thirty targets, and the report says a small number were breached.
The crown jewel
On the production side, the biggest worry is IP leakage through the same connectors. If you hook up an MCP without scanning it, Xia says,
“one single prompt can steal your company’s system prompt”
Xia Hua, at 17:33
“Which is typically the crown jewel of your entire production system.”
Xia Hua, at 17:37
Data leakage and exfiltration are the top concern, she says.
The JavaScript parallel
Jon takes the MCP problem from the top. LLMs are amazing, but without the right context they aren’t much help, and they start hallucinating. People want to give them context, and that is where MCP came from. Now data flows up to the cloud and to inference providers.
What scares him is the agent in the middle. When data comes in through an MCP service, an agent interprets it and runs it. Jon sees a parallel in browsers and JavaScript, with the clock rewound 20 years or so. Browsers download random code from computers on the internet and run it, he says, and the industry isolated it.
“They contain it to the browser, but not just the browser, they contain it to that tab or that one page.”
Jon McLachlan, at 19:30
The rules are mature now, he says, and there are still exploits today. Agents download things from all over the place, “MCP this and MCP that,” and put the data together.
Netscape Navigator 2.02 introduced the same-origin policy in 1995, shortly after JavaScript arrived in Netscape 2.0 (Wikipedia). The policy lets a script read data from another page only if both pages share an origin: the same scheme, host and port. Google launched Chrome in September 2008, and its V8 JavaScript engine shipped with it (Wikipedia). Chrome sandboxes each tab in its own process, with least privilege, so a tab can’t touch critical memory functions or other tabs (Wikipedia).
Free-form HTTP
Xia agrees and takes it a step further. The way she looks at it, MCP is just free-form HTTP.
Most MCP servers are remote now, she says, and moving further that way. A handful run locally, like Playwright. Underneath it is an HTTP protocol.
“However, what really makes things very challenging is the instruction and the data themselves are mingled.”
Xia Hua, at 20:11
That is why prompt injection happens, she says. The agent can’t tell the data that comes back apart from a hidden instruction embedded in it. She expects a ton of progress in the next couple of years, the way the industry built containers around JavaScript.
Wikipedia’s article on MCP describes one version of this. In April 2025, Invariant Labs described “tool poisoning attacks,” instructions hidden in tool descriptions that the model reads and the user doesn’t see. “Tool poisoning is a form of prompt injection,” the article says (Wikipedia).
Skills, the next surface
Sasha asks if security is playing catch-up on AI tools, with MCP just one tool in the toolbox.
“Security is lagging behind months and years.”
Xia Hua, at 21:00
She says Claude introduced skills in November of the year before, so Claude Code now has skills on top of MCPs, and skills can carry persistently embedded malicious prompts. She hadn’t heard any security vendor talk about guardrails for agent skills. It never ends, because people are curious and want to build. Security is a little reactive, she says, and it catches up.
SiliconANGLE dates the launch of Anthropic’s skills to October 16, 2025: folders of instructions, scripts and resources that Claude loads when a task calls for them, in Claude.ai, Claude Code, the Agent SDK and the API (SiliconANGLE). Traceforce later built a scanner for them, covered in What happened after the tape.
Not everything crosses the network
Sasha asks how to build something that catches all the traffic leaving a machine, and maybe coming in. Xia says that is one of Traceforce’s goals, and the team is pretty close. The first step is knowing where the telemetry comes from.
“Not all of them will leave a footprint in the network.”
Xia Hua, at 22:02
That is why the network-based tools of the older CASB generation feel inadequate, she says, and why a traditional DLP deployment leaves gaps. A lot of what an agent does never goes out as traffic. It pulls up local files, launches local browsers, does a few things, and that’s it.
Wikipedia describes a cloud access security broker as software that sits between cloud users and cloud applications, monitoring activity and enforcing security policies (Wikipedia). It describes data loss prevention as the tools and practices that stop sensitive data from being sent or disclosed without authorization, whether in motion, at rest or in use on endpoints (Wikipedia).
So the team has to understand each agent deeply. Traceforce’s lab has a handful of computers with many OpenClaws and other agents installed, to learn their attack vectors and attack them.
“So yeah, the red teaming we do is part of our intelligence, the brain behind the detection, right?”
Xia Hua, at 23:17
Agents adopting agents
Jon says he is grateful for the people working through these problems, so the flywheel keeps going. AI isn’t going anywhere.
He wouldn’t be surprised by a future where
“agents are adopting other agents.”
Jon McLachlan, at 23:49
Who put this here? Who manages these agents? Another agent, he says, and there is a recursive feel to it. Within reason, and following the security protocols and policies, it can be hard.
Telemetry at agent scale
Xia says the challenge is scale.
“Agents move so much faster.”
Xia Hua, at 24:11
She says people produce a hundred times more source code than two years ago because coding assistants generate so much more, and agents move faster still. The telemetry Traceforce collects is orders of magnitude more than a traditional endpoint tool’s. Endpoint tools like CrowdStrike solved hard problems 10 years ago, she says, and keep innovating. The hundred times is her estimate.
CrowdStrike was co-founded in 2011 by George Kurtz, Dmitri Alperovitch and Gregg Marston and sells endpoint security, threat intelligence and incident response (Wikipedia).
Agent lineage
The data itself is the other half. In earlier generations an HTTP payload was structured JSON. In the LLM world it is free-form text, and the output of one agent changes a little when it passes to the next.
“the semantic footprint, the entire lineage is one of the problems we’re trying to solve.”
Xia Hua, at 25:20
Jon says she put it elegantly: data and instructions are now commingled. The natural language that comes out of an LLM gets fed into an agent, and the agent acts on it.
“it’s not really data lineage, it’s the agent lineage.”
Sasha Sinkevich, at 26:03
“Chain of thought, right?”
Xia Hua, at 26:07
On episode 70, Abhi Sharma of Relyance AI explained why column-level lineage between databases misses how data travels through microservices, pipelines and third-party APIs. With agents, Xia says, the text itself changes at each hop.
Horses, cars, Waymo
Jon says it is important to use these tools, or organizations get left behind. Xia goes further: agents are unstoppable.
Horses became cars, cars became electric cars, and now Waymo runs everywhere, she says. People are scared when something new comes out, and then they get used to it.
A $3,000 check
Jon asks for her proudest moment since the last visit.
“I think when we got a first check of $3,000 from the first customer.”
Xia Hua, at 27:03
Sasha and Jon congratulate her.
Invalidated
Xia says the year taught her a lot. When she was on the show the year before, Traceforce had a vision, wanted to build something, and planned to validate it with customers.
“What I realized is this path is extremely unlikely to work very well.”
Xia Hua, at 27:22
Customers invalidated the first product. They understood the problem and said they couldn’t use it now. Jon asks if they weren’t far enough along in their own AI adoption to get value from it.
The first product was in agent security, she says: a proxy and security layer for agents, mainly for production workloads. Many large enterprises weren’t seeing enough return from the agentic workloads they built themselves.
“So security is usually the last milestone, right.”
Xia Hua, at 28:15
When there’s business value, Jon says, security shows up to secure it. There has to be value first, or what are we protecting?
On episode 72, Xia had described the plan as a parallel security agent that stops a product agent at its permission boundaries (episode 72).
Start with the customers
LLMs turn out to be hard to program with, Xia says, because they are unpredictable, and many enterprises that aren’t AI-native need workloads that are 100% predictable. Outside the chat box on the front page, they struggle to find a product use case.
She expects security startups that try to secure production workloads to keep facing an uphill battle when they sell to enterprises.
Her customers, companies of up to 3,000 or 5,000 employees, needed something else: visibility into how employees use AI. They want people to use more AI, with guardrails, and at least to know what people are doing, so that when something goes wrong they can figure out what. Traceforce started with the customers and derived the product. The vision came after.
“Reverse engineer that market.”
Jon McLachlan, at 30:00
Jon puts the mood in one line: everyone says adopt AI, then, wait, not that. Security leaders need the visibility, even just to know.
When, not if
Sasha sees it from the organization’s side.
“It’s not a question of if, it’s the question of when.”
Sasha Sinkevich, at 30:22
Every organization has a burning question: if we don’t do it now and fall behind the competition, what does that mean for the business? Then there is the balance. We aren’t convinced the technology is ready, because we don’t trust it. For a lot of companies in 2026, Sasha sees one of the biggest opportunities in accelerating the trust between one organization and another. That, in Sasha’s view, is what Traceforce does.
Xia calls it a trust layer, so enterprises feel more confident. In her words, enterprise is an anti-AI beast, to be honest. AI is about freedom to do whatever it can, and large organizations want rules that people can follow however different they are. On episode 70, Abhi Sharma defined trust as transparency times security times business value, so a zero in any one makes it zero.
Rules for a reason
Sasha adds the other half of the rules.
“And often there are good reasons behind the rules because things have gone wrong in the past, and certain rules were put in place in order to prevent the same mistake from happening again.”
Sasha Sinkevich, at 31:35
The question, in Sasha’s words, is how to help enterprises build trust in new technology and put them in a position to cut the toil they carry. They have a lot of data, a lot of inefficiency and a lot of room to improve.
“It’s here to save us all from the toil of daily grind, and enterprises have a lot of that.”
Sasha Sinkevich, at 32:06
The trust has to reach the director of IT, Sasha says. How do you make sure a new AI tool won’t ship your customers’ Social Security numbers, their names and the rest of the restricted data that should never leave the trust perimeter?
“that’s exactly why we built Traceforce, right?”
Xia Hua, at 32:29
Traceforce traces it all down in a form the enterprise’s stakeholders can read, Xia says. They can go to its data lake and graph, ask anything, and figure out what is happening.
Easy enough to adopt
Jon notes the name says it: Traceforce. Xia says part of the job is the product, and part is being a thought leader. Her team spends a lot of time on this, so it comes naturally. Many companies have other priorities and don’t have time to work out how to put guardrails around AI in an easy way.
“It has to be seamless.”
Sasha Sinkevich, at 33:21
If every person has to install a binary and do configuration, and the director of IT has to learn the tool, it gets complicated and hard to adopt, Sasha says.
What to allow, what to deny
Xia says that leads to the problem almost all of Traceforce’s customers share. Everyone wants an allow list and a deny list. They don’t know what goes on them.
“So, part of our products, I think, is the intelligence to kind of recommend you.”
Xia Hua, at 33:50
Traceforce shows what it discovered on the devices. Based on its research, it recommends tools to allow and tools to deny. For the allowed ones, it recommends guardrails, based on its vulnerability studies of each tool.
Jon sums it up as CrowdStrike for AI. Xia agrees, and Jon jokes about hijacking CrowdStrike’s success. Y Combinator’s page for Traceforce uses nearly the same line: “CrowdStrike for AI Agents” (Y Combinator). Traceforce’s pricing page now lists an MCP registry with a security approval process in its Pro plan (Traceforce).
The scale problem
Jon asks what the hardest problem in AI security will be in the near future. Xia comes back to scale.
“I think it’s really the scale problem because agents move much faster, produce so much more junk and useful data as well.”
Xia Hua, at 34:45
A lot of it is junk, Jon and Sasha agree, and Jon calls it AI slop. Wikipedia defines AI slop as generative AI content seen as lacking effort, quality or meaning, usually made in high volume (Wikipedia).
The biggest challenge, Xia says, is an infrastructure layer that can handle that much complexity and data. Today the list is OpenClaw, MCP and skills. Next year she expects people to be talking about A2A.
It will be A to A to A to A, she says, each agent with its own MCP calls. Agent2Agent is an open protocol for how AI agents talk to each other across systems, introduced in April 2025 (Wikipedia).
Paddle forward
Jon says the wave is coming. Sasha picks up the image.
“So it’s pretty clear when you are a founder, it’s important to have the feel for that wave.”
Sasha Sinkevich, at 35:47
You have the board and the wetsuit, Sasha says, and you’re waiting for the wave. You look back, feel it, and start paddling. The market depends on people like Xia to build products that let everyone ride it safely, because the wave is big.
Xia adds the attack from Anthropic’s study. The attackers finished in hours, she says, where a person would have needed weeks.
“it’s the speed of the wave and the size of the wave.”
Xia Hua, at 36:40
Both are bigger than the generation before, she says. Anthropic’s report describes the speed in requests: thousands at the peak, often several per second (Anthropic).
Your own data plane
Jon asks how a security leader gets a closer look. Xia points to her LinkedIn and traceforce.ai, and says Traceforce will soon be on the Google Cloud and AWS marketplaces.
“So my data can even stay in my own data plane.”
Jon McLachlan, at 37:15
“So our platform, we never, never store any customer data in our platform.”
Xia Hua, at 37:22
Scanning happens on the device, or with the customer’s own LLM, whatever they have set up in AWS Bedrock or Google Vertex, Xia says. The data lands in the customer’s S3 bucket or SIEM. It never leaves the customer’s footprint.
“Security is number one.”
Xia Hua, at 37:48
Jon says that is music to his ears, because he loves keeping his own data. On episode 70, Abhi Sharma covered data residency and customer-controlled data planes.
Built by the community
Jon asks what a security engineer can do if these sound like problems worth solving.
“we are definitely looking for contributors to our open source repo, the MCP X-Ray”
Xia Hua, at 38:13
Jon says he’ll look for the public talks at BSides conferences and the after parties at RSA. Xia says the Traceforce team alone won’t be enough.
“It takes a generation of security professionals to build things to build the ecosystem.”
Xia Hua, at 38:46
Community is critical, Jon says. We’re all in the same boat, with open problems to tackle head on. Xia says it is always good to be on the show and learn from the hosts and the audience. Sasha calls it an absolute pleasure, and Jon notes it is her second time on the show. In August, Xia and her team were selected to present at BSides Las Vegas and to run a demo lab at DEF CON 34, as the episode 72 page records.
What happened after the tape
The episode 72 page has the Launch HN and Launch YC numbers from July 2026. These are the items since, in order.
Happy to return to the YSecurity podcast. Great chatting with Jon McLachlan and Sasha Sinkevich!
Xia Hua · July 29, 2026
Skill X-Ray. On August 16, 2026, Traceforce published Skill X-Ray, an open-source static scanner for agent skill packages (GitHub). On the tape, Xia hadn’t heard any security vendor talk about guardrails for skills.
Five CVEs. On September 22, 2026, Traceforce published advisories for five vulnerabilities in open-source MCP servers: a symlink bypass of the allow list in mark3labs/mcp-filesystem-server (CVE-2026-79534, medium, CVSS 5.9), an OS command injection in mbailey/voicemode (CVE-2026-79535, medium, 6.3), a read-only mode bypass in bytebase/dbhub on MySQL and MariaDB (CVE-2026-79536, critical, 9.1), and a cross-tenant session hijack (CVE-2026-79537, high, 8.7) and an authenticated command injection that leads to remote code execution in the container (CVE-2026-79538, critical, 9.9), both in metatool-ai/metamcp. On September 24 it added TFSA-2026-006, an OAuth authorization-code interception in the Neon MCP broker, rated high and unscored, which it reported and which was closed as a duplicate (Traceforce).
TraceGraph. On September 28, 2026, Traceforce’s second Launch YC introduced TraceGraph, which turns every AI interaction into a graph that links users, apps, models, MCPs and tokens, and answers questions in plain English (Y Combinator). It is the graph database Xia described on the tape, and the demo is about token usage, the number she wanted to measure across coding assistants.
AI observability. On October 30, 2026, Xia published “AI Observability in 2026” on Traceforce’s blog. It describes the job as “tracing every decision an AI agent makes,” from planning steps and tool calls to handoffs between agents (Traceforce). Sasha’s name for it on the tape was agent lineage.
A free trial. As of November 2026, Traceforce’s pricing page offers a free trial for up to 10 devices for up to 30 days with no credit card. It includes risk assessment across more than 900 AI apps and MCPs and detection of dangerous actions in Claude Code, Cursor and Codex (Traceforce).
More on this show. Or Eshed of LayerX explained why security has to go where users are, in the browser, on episode 98. Ged Ossman of Interf explained why enterprise AI rollouts stall mid-flight on episode 99. Jack Cable of Corridor said most code will soon be written by AI on episode 84.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it, and where it is on the tape.
-
What do companies say when they install Traceforce, according to Xia?
b. "whenever they install our software, they're like, I didn't know that they're doing that." Transcript, 4:18.
-
What does Jon say ChatGPT became?
a. "It's almost like it became the Kleenex of the AI world, right?" Transcript, 9:21.
-
Which MCP server does Xia show in the live demo?
c. "For example, Playwright is hands down one of the most popular ones." Transcript, 13:04.
-
How does Xia describe MCP, the way she looks at it?
b. "free-form HTTP, right?" Transcript, 19:58.
-
What does Xia call a company's system prompt?
a. "Which is typically the crown jewel of your entire production system." Transcript, 17:37.
-
What was Xia's proudest moment since her first visit?
c. "I think when we got a first check of $3,000 from the first customer." Transcript, 27:03.
-
What does Sasha say it is, if not data lineage?
b. "it's not really data lineage, it's the agent lineage." Transcript, 26:03.
Are you ready to write the allow list?
Xia says almost every customer wants an allow list and a deny list and doesn’t know what to put on them. This scorecard checks the pieces you need first.
Scorecard · eight questions
Are you ready to write the allow list?
Answer for the laptops your team uses every day. If two answers fit, pick the lower one.
-
Do you have an inventory of the AI tools on company devices, including the free ones people installed themselves?
- No
- The ones we bought
- Yes, every device, bought or not
"whenever they install our software, they're like, I didn't know that they're doing that." See The market caught fire.
-
Do you know which of those tools do the same job, and how much each one is used?
- No
- We know the overlap
- Yes, with usage numbers
"There could be three or four different tools doing the same thing." See AI tool fatigue.
-
Is there a written policy for which data may go into third-party AI tools, and is it enforced?
- No
- Written, not enforced
- Written and enforced on the device
Xia: Traceforce hooks up inline with the AI tools to impose the guardrails. See Guardrails inline.
-
What stops a secret, like an AWS token, from going into an AI tool?
- Nothing
- Training and trust
- A check on the device, before it uploads
"to prevent sensitive data from leaving the employees' devices." See Guardrails inline.
-
Do free trials and freemium AI tools get a security review before company data goes in?
- No
- Only the paid ones
- Yes, free ones too
"There's free tools out there." See Free tools skip procurement.
-
Are MCP servers and skills scanned before people connect them, and again when they change?
- No
- Reviewed once, by reading
- Scanned and tested, again on every update
"one single prompt can steal your company's system prompt" See The crown jewel.
-
Does your allow list say why each tool is allowed, with guardrails on the ones you allow?
- There's no list
- A list without reasons
- Yes, reasons and guardrails
"they actually don't know what to allow, what to deny." See What to allow, what to deny.
-
Does your AI telemetry stay in your own cloud, with your own model and logs?
- A vendor holds it
- Partly
- Yes, our LLM, our bucket, our SIEM
"It never leaves your footprint." See Your own data plane.
Before anyone can write an allow list, someone has to see what is on the laptops: the AI tools, the free trials, the MCP servers and the skills. Start there, and add a written policy for what data may go into them.
You can see most of what runs. Next, stop secrets on the device before they upload, scan MCP servers and skills before people connect them, and write down why each tool is allowed.
You have the inventory, the policy, the scans and the reasons. Keep the list current as new tools arrive, measure the overlap, and keep the telemetry in your own data plane.
What does AI tool overlap cost you?
Sasha’s AI tool fatigue has a price. This calculator multiplies the people paying for AI tools by the tools each has that do the same job, and shows what the extra seats cost in a year.
Calculator
What does AI tool overlap cost you?
Four numbers: people with a paid AI tool, tools each that do the same job, the price of a seat, and how many tools per person you'd keep.
With 200 people paying for 2.0 tools each that do the same job, that's 400 seats. Keep 1 per person and 200 seats are extra, 50% of the total, at $72,000 a year.
The 200 people, two tools, $30 a seat and one tool kept are placeholders, not research, so put in your own. Blocking a favorite tool is a hard decision, Xia says, which is why Traceforce wanted to measure token usage and workload before anyone cuts one.
From the same-origin policy to TraceGraph
The browser history Jon compares agents to, the AI events Xia and Sasha talk about, Traceforce’s own record, and the episodes on this show that pick up the thread. Filter by topic.
Timeline
From the same-origin policy to TraceGraph
- JavaScript
Brendan Eich creates the language, now a core technology of the web (Wikipedia, on this show).
- The same-origin policy
Netscape Navigator 2.02 keeps a script on one page out of another page's data (Wikipedia).
- Chrome and V8
Google's browser ships with its JavaScript engine and a sandbox for each tab (Wikipedia).
- CrowdStrike
George Kurtz, Dmitri Alperovitch and Gregg Marston co-found the endpoint security company (Wikipedia, on this show).
- Playwright
Microsoft launches its open-source browser testing library (Wikipedia, on this show).
- Prompt injection is reported
Preamble reports it to OpenAI, and Simon Willison popularizes the name that September (Wikipedia).
- MCP
Anthropic introduces the Model Context Protocol (Wikipedia).
- Traceforce
Xia starts the company as co-founder and CEO (LinkedIn).
- Tool poisoning
Invariant Labs describes instructions hidden in MCP tool descriptions (Wikipedia, on this show).
- Agent2Agent
An open protocol for agents to talk to each other (Wikipedia, on this show).
- Episode 70
Abhi Sharma of Relyance AI on trust as transparency times security times business value (episode 70).
- Episode 72
Xia's first visit, with Glenn Mulvaney, four months into Traceforce (episode 72).
- Episode 73
Michael Moore of Glean on why a free AI tool is usually paid for with your data (episode 73).
- Skills
Anthropic adds skills to Claude, Claude Code and its API (SiliconANGLE, on this show).
- Warelay
Peter Steinberger publishes the agent that becomes OpenClaw (Wikipedia).
- The espionage report
Anthropic describes a campaign against roughly thirty targets run largely by Claude Code (Anthropic, on this show).
- MCP X-Ray
Traceforce publishes its open-source scanner for MCP servers (GitHub).
- Episode 84
Jack Cable of Corridor on why most code will soon be written by AI (episode 84).
- Claude Cowork
Anthropic releases a research preview of Cowork for people who don't write code (Wikipedia).
- MCP X-Ray 1.0.3
The scanner's latest release (GitHub).
- OpenClaw
The agent takes its current name, three days after becoming Moltbot (Wikipedia, on this show).
- Playwright, verified
A pen test of Playwright's MCP server with seven results (GitHub, on this show).
- The SaaSpocalypse
SaaS companies lose US$300 billion in value in one day (Wikipedia, on this show).
- Episode 98
Or Eshed of LayerX on why security has to go where users are (episode 98).
- Episode 99
Ged Ossman of Interf on why enterprise AI rollouts stall mid-flight (episode 99).
- Launch YC
Traceforce in Y Combinator's Summer 2026 batch (Y Combinator).
- Episode 100
This conversation. "Agents move so much faster."
- Skill X-Ray
An open-source scanner for agent skill packages (GitHub).
- Five CVEs
Advisories for five vulnerabilities in open-source MCP servers (Traceforce).
- TraceGraph
Every AI interaction as a graph you can query in plain English (Y Combinator).
- AI observability
Xia on tracing every decision an agent makes (Traceforce).
What to do this week
Five things, in the order of the episode.
- Find what’s installed. Inventory the AI tools on company devices, bought or free, and the MCP servers and skills each one connects to. Shadow-AI Detection & Mitigation does this with you.
- Stop secrets on the device. Put a check between people and AI tools that catches keys and tokens before they upload, and get the keys out of config files. Our post on the .env file has a one-hour version.
- Scan MCP servers and skills before you allow them. Run an open-source scanner like MCP X-Ray, and scan again when a server changes. Our Secure MCP Program and AI Product Red Teaming test the ones you depend on.
- Write the allow list with reasons. For each tool, say allow or deny and why, and attach guardrails to the ones you allow. Take the scorecard with your team first.
- Measure the overlap before you cut. Put your numbers in the calculator, look at real usage, then decide which tools stay. If you want a second pair of eyes, book 15 minutes with us.