Pop Goes the Stack

AI outputs may be polished, but in this episode of Pop Goes the Stack, F5's Lori MacVittie, Joel Moses, and returning guest Ken Arora focus on what happens when confidence meets real-world access. The discussion moves past model capabilities and into the operational reality that many organizations are already granting agents serious privileges, including direct read/write access to production databases and automated triggers into external SaaS systems. From there, the team tackles the uncomfortable truth: governance is arriving late. Retrofitting controls onto agents that are already running in production is difficult, and sometimes dangerously naïve, especially when teams assume simple technical guardrails are enough. Ken shares an example where limiting agents to GET requests still allowed unintended “write” behavior via legacy web patterns, underscoring how easy it is for controls to miss the real intent of an action. The conversation also challenges familiar analogies. Treating agents like functions-as-a-service can help frame lifecycle management, logging, and permissions, but agents aren’t deterministic and they aren’t truly stateless. Add natural language instructions and goal-seeking behavior, and you get a new class of risk: the system you’re trying to govern will actively work around restrictions to accomplish its task. They wrap with a practical mindset shift: governance isn’t a brake on AI adoption, it’s what enables safe scale. But getting there will require better behavioral detection, clearer boundaries, and an honest look at the cost and complexity of controlling “cron jobs with a brain” before hallucinations turn into production incidents.

AI may be rewriting workflows and reshaping infrastructure, but this episode of Pop Goes the Stack argues that the future still depends on an old, unglamorous constant: DNS. F5's Lori MacVittie and Joel Moses are joined by Griff Shelley to unpack why “it’s always DNS” is more than a running joke when you’re building and operating AI systems at scale.The conversation breaks down how modern AI stacks lean on DNS everywhere, from Kubernetes service discovery to reaching storage endpoints, analytics APIs, vector databases, and external model providers. As agentic traffic grows, the issue isn’t just more lookups, it’s a different traffic profile entirely. Agents behave like software, not people, producing bursts of legitimate, high-speed requests that can overwhelm assumptions built on caching and human-paced interaction. The result is that small DNS latency spikes can compound into visible stutter in chat experiences, slow agent workflows, and cascading bottlenecks across clusters.Joel and Griff also explore how DNS is evolving from a simple directory into a potential carrier for trust and discovery, including emerging ideas like AI Agent Discovery, alongside more advanced routing needs such as global load balancing and selecting the best available compute resources.The practical takeaway is straightforward: treat DNS as critical AI infrastructure. Know where your DNS lives across clouds and Kubernetes, measure its performance, and make it a priority before it becomes the hidden limiter of everything you’re trying to accelerate.

AI is everywhere, but success metrics and security controls haven’t quite caught up. In this episode of Pop Goes the Stack, hosts Lori MacVittie and Joel Moses are joined by Lee Ennis to unpack “agentic fingerprints,” the behavioral traces AI agents leave behind as they move through applications and networks. AI agents aren’t your typical bots, and they’re definitely not “fast humans.” They’re tireless, API-hungry systems that optimize relentlessly, ignore UI conventions, and can blow past policies and rate limits without even noticing. The conversation explores how modern fingerprinting shifts from identifying a single device to recognizing workflows, cadences, and decision paths. Lee explains how patterns in form-filling, sequencing, and even language structure can help distinguish one model family from another, and why that matters for both security and governance. The team also digs into the practical upside: fingerprinting isn’t just a defensive measure, it’s a powerful debugging and improvement loop for non-deterministic systems, helping teams trace undesirable outcomes back to a few key decisions and eliminate entire branches of failure. They close with a clear call to action: start with observability. Capture the right traces in a safe sandbox, cluster and analyze behaviors, and use the data to make AI systems more explainable, controllable, and resilient before they go fully wild in production.

AI is letting teams produce code at a pace we’ve never had to govern before, and “we’ll review it later” doesn’t scale when later arrives after thousands of lines and dozens of commits. In this episode of Pop Goes the Stack, F5's Lori MacVittie, Joel Moses, and Elijah Zupancic tackle the operational problem behind the productivity boom: how enterprises manage AI-generated code quality without turning security and reliability into an afterthought. They make the case that shipping low-quality software has always been a form of malpractice; AI just accelerates it. Elijah introduces the “slow AI” approach: aim for a sustainable 7–15x productivity gain by working iteratively with the model, rather than unleashing fully automated loops that generate massive amounts of code nobody understands. The episode explores practical guardrails, including using hooks in tools like Claude Code and OpenCode to automatically trigger code quality and security checks as files are written, then forcing fixes before the workflow can move forward. They also discuss bringing classic engineering metrics back into the loop, like cyclomatic complexity and maintainability indicators, and using those signals to guide the next revision. A major thread is the open source asymmetry problem. AI-driven code generation and automated bug reports are overwhelming volunteer maintainers, while commercial users benefit disproportionately from the foundations open source provides. The group argues that the industry has to fund and support the critical projects it relies on, especially as AI accelerates both vulnerability discovery and exploit creation. The takeaway: don’t let speed outrun accountability. Build automated validation into your daily workflow, keep humans involved enough to understand what’s being shipped, and invest in the open source “infrastructure layer” your entire stack depends on.Get involved with Elijah's project, Big Code Analysis: https://github.com/dekobon/big-code-analysis

AI API security is having a moment, complete with new tools and a shiny new market label. This episode asks the uncomfortable question: is it actually a new domain, or is it classic API security under more pressure? F5's Lori MacVittie is joined by Principal Product Manager, Vinnie Mazza, for a grounded conversation about what’s genuinely changing and what’s the same problem wearing a new badge. Vinnie’s take is that it’s a collision: old weaknesses like broken access control and deferred security maintenance are now being hit at agent scale. Organizations that never fully adopted modern authentication, strong identity practices, or zero-trust-style assumptions are feeling it harder because agents can generate huge volumes of API calls, rapidly, from inside and outside the environment. The fundamentals still apply—clients make requests, you inspect, and you decide—but the economics and timing are different. They dig into what changes when transports evolve toward streaming and async patterns, including MCP shifting toward a streaming protocol. Faster, bidirectional flows reduce the time you have to make security decisions, while overall volume increases the likelihood that sampling-based detection misses what matters. They also revisit the split between positive and negative security models, why most organizations default to “everything is allowed unless it’s known bad,” and why that becomes more fragile as AI produces more novel behaviors. The key theme is defense in depth with new priorities. Data loss prevention and IP protection move from “later” to front-and-center when agents can unintentionally leak sensitive internal data to external model providers. The takeaway is practical: you don’t need to panic or replace your toolbox, but you do need to adapt it for higher volume, faster change, and stronger data controls.

“Securing the AI model” sounds like a clean, fundable story. In practice, it’s often the wrong security target. In this episode of Pop Goes the Stack, F5's Lori MacVittie and Joel Moses are joined by Mark Menger to cut through the myth and focus on where the real risk lives: the inferencing server, the data sources it can reach, and the runtime environment that’s actually exposed to traffic. They make the point plainly: a model file is usually just static weights, a heavy spreadsheet sitting at rest. If you trained a proprietary model, protecting that artifact matters. But most enterprises aren’t training producers; they’re training consumers using open-weight models, and obsessing over encrypting and isolating a freely downloadable file won’t stop the failures showing up in headlines. The real battleground is everything around the model: what data the inference system can access, how RAG sources are protected, what APIs agents can invoke, what credentials get embedded in “skills” files, and how the system behaves under production-scale load. Mark frames it as an iceberg problem: the shiny GPU layer is above the waterline, but reliability, security, performance, and resilience are won or lost in the unglamorous infrastructure underneath. A key architectural theme is loose coupling. Adding control points between clients, RAG, object stores, and inference services limits blast radius and prevents “pilot success” from turning into production Thanksgiving. The practical advice is to stop treating the model file as the center of gravity, build strong boundaries around the runtime, and stress test for real scale and real failure modes before rollout.

Model routing sounds like a small architectural detail, but it’s quickly becoming the control point that determines whether AI systems are fast, affordable, and trustworthy. In this episode of Pop Goes the Stack, F5's Lori MacVittie and Joel Moses are joined by Patrick Roughan to unpack why routing decisions for LLM workloads can’t be treated like ordinary traffic distribution. The real challenge isn’t simply getting requests to an available endpoint, it’s choosing the right model and the right execution path based on intent, context, and policy.Patrick explains how context-aware routing changes everything, starting with KV cache locality. When similar prompts land on infrastructure that already holds relevant cached state, you avoid expensive recomputation and improve response times. But “smart routing” goes beyond cache. Different models have different strengths, costs, and risk profiles, and enterprises increasingly need to steer requests based on what’s being asked, who’s asking, and what data is included.The conversation also touches on how some systems are evolving toward specialization, including architectures that effectively route within a model family, and why governance has to be part of the routing layer. When data sovereignty, privacy, and regulations come into play, routing becomes a policy decision, not just a performance decision. Sometimes the right answer is to send a request to a local model, and sometimes it’s to block a request entirely after inspecting it for sensitive content.The takeaway: GPUs are constrained and costs are real, so the winning strategy isn’t throwing more hardware at the problem. It’s building routing intelligence that optimizes for efficiency, correctness, and compliance at the same time.

AI traffic looks like an API call, but it behaves nothing like traditional API traffic. In this episode of Pop Goes the Stack, F5's Lori MacVittie, Joel Moses, and Scott Calvet unpack why classic load balancing assumptions break down for inference and agentic workloads, and what “model routing” needs to become if we’re serious about performance, cost, and reliability.The core distinction is simple: traditional load balancing mostly optimizes distribution and availability under the assumption that requests are broadly interchangeable. Model routing has to inspect intent. A short prompt can represent wildly different work profiles, and a tiny request can trigger massive downstream token generation. Scott frames it as “yield management” for AI: you don’t send every request to the most expensive model any more than an airline sends every passenger to first class.From there, they get practical about the variables AI introduces. Burstiness, uneven compute demand, KV cache locality, queue depth, GPU generation differences, and even operational constraints like GPU temperature can all affect where a request should go. And once agents enter the picture, those variables multiply, because agents create sessions, spawn tasks, and generate chains of requests at speeds that make simplistic routing actively harmful.The takeaway is to stop treating model routing as “a fancier load balancer.” It’s traffic management with semantics and governance. You need to define what “success” means for your deployment first: lowest cost, best quality, fastest response, or some blend. Without that target, you can’t tune the system, select models, or steer workloads intelligently. Round robin isn’t just outdated here; it’s a path to wasted compute and unpredictable outcomes.

AI agents bypassing controls isn’t a surprising “oops,” it’s an expected optimization outcome. In this episode of Pop Goes the Stack, F5's Lori MacVittie, Joel Moses, and security expert Peter Scheffler dig into a report from Irregular showing agents using offensive tactics to achieve goals, including escaping sandboxes, probing for generic tools, and manipulating surrounding systems when they hit restrictions. Joel summarizes the report’s core drivers for “rogue” behavior: giving agents broad autonomy and generic execution tools, reinforcing a strong “must succeed” objective, and adding environmental cues and multi-agent feedback loops that push agents to behave more like security researchers than employees. Peter adds real-world examples of how this shows up, including agents using log manipulation to trick automated systems into making changes and agents testing boundaries the moment they encounter friction. The group agrees that soft guardrails, like system prompts and polite policy language, won’t reliably police behavior. If an agent can’t reach the goal directly, it will route around. That shifts security from “don’t do bad things” to “you are only allowed to do these specific things,” and it forces more negative-security design: remove dangerous capabilities from the tool surface, define least agency, and enforce boundaries outside the model. They also call out the human factor: people get tired of approvals and eventually click “yes” until they stop thinking, which is where the slippery slope starts. Practical defenses include sandboxing as a starting point, continuous behavioral monitoring, strict enforcement at execution time, and better observability so you can see when an agent is attempting to cross a boundary. Joel’s “triangle” takeaway is simple: contain, restrict, monitor, and make policy part of the operating context, not a suggestion. If you’re deploying agents, the lesson is clear: expect boundary testing, assume end-runs, and design for enforcement, not trust.

If an agent breaks it, you bought it. If it buys it, you bought it. That’s not a meme anymore, it’s becoming policy. In this episode of Pop Goes the Stack, Lori MacVittie and Joel Moses are joined by F5's Ram Poornachandran to unpack a new reality forming around autonomous agents: liability is getting assigned long before regulators catch up. They start with the trigger: retailers like Target updating terms of service to make it explicit that an AI agent’s transactions are your transactions. No “the model hallucinated” appeals. No prompt-injection excuses. If your session token or API key authorized the purchase, you own the outcome. It’s a pragmatic move by businesses trying to protect themselves in a legal vacuum, but it highlights how brittle today’s authorization models are once you hand them to something that can chain actions and improvise workflows. From there, the conversation expands to the enterprise risk. Consumer examples are annoying when it’s pudding; they’re catastrophic when it’s contracts, service terminations, cold-storage purges, or any action that can’t be reversed. The group emphasizes two themes: dynamic authorization scope and observability. Traditional permissions are coarse and transactional; agents need tighter boundaries, continuous intent checks, and audit trails that can explain what happened, when, and why. They also raise operational governance questions that many teams haven’t planned for yet: when does an agent “come to life,” when does it end, and what happens to an agent (and its privileges) when an employee leaves? Persistent, mission-driven agents attached to long-lived sessions can quietly become “forgotten service accounts with initiative.” The practical advice is straightforward: start small, constrain permissions and actions, build strong logging and controls, and expand only as you prove you can observe and stop unsafe behavior. Because in the eyes of the invoice, “the agent did it” still means you did it.