Google Cloud: AI Agents in Action | Spencer Thellmann, Palo Alto Networks

Clips
Resources
More from Google Cloud: AI Agents in Action

Spencer Thellmann

Principal Product Manager

Palo Alto Networks

Prisma Airs

Prisma AIRS is a cloud native AI security platform that shields every part of your Google’s Vertex AI stack & Agentspace platform—apps, models, agents and data—from misuse, leakage and advanced attacks.

Prisma Airs

Prisma AIRS is a cloud native AI security platform that shields every part of your Google’s Vertex AI stack & Agentspace platform—apps, models, agents and data—from misuse, leakage and advanced attacks.

play_circle_outline Securing AI Agents: Prevent Prompt Injection, Data Exfiltration, Malicious Tool Calls with Real-Time Intent, Privilege, and Runtime Controls

play_circle_outline Prisma AIRS: AI Security, Runtime Protection, Model Scanning, MCP API Inspection with Google Cloud Gemini Agent Gateway

play_circle_outline Gemini Marketplace Model Scanner: Enforcing Org Policies, Detecting Malware, C2, Suspicious Components, and Arbitrary Code Execution

play_circle_outline Customer value: DLP, malware scanning, custom topic guardrails, preventing toxic outputs.

Info
Transcript

Spencer Thellmann, Palo Alto Networks

Spencer Thellmann

Principal Product Manager Palo Alto Networks

In a conversation for the Google Cloud: AI Agents in Action Series, theCUBE Research’s John Furrier speaks with Spencer Thellmann, principal product manager at Palo Alto Networks, about why autonomous agents demand a new security approach. Thellmann explains how memory, tool use and independent action introduce risks chatbot defenses miss.

Furrier and Thellmann discuss how Prisma AIRS integrates with Google Cloud to inspect tool calls, scan models and protect agents at runtime. Thellmann also demonstrates how enterprises can embed safeguards into deve... Read more

explore Keep Exploring

How should organizations approach governance, runtime controls, identity, and privilege for autonomous agents that run across cloud, SaaS, and endpoints—given risks from agent autonomy, tool use, and memory? add

How does Prisma AIRS integrate with Google Cloud’s Gemini Enterprise Agent Platform (including the Google Agent Gateway), and what key capabilities were announced about that integration at Google Cloud Next 2026? add

What are enterprise agents, and what is the model scanning agent — how does it work and why is it needed? add

How does the runtime security integration inspect MCP tool calls, responses, and related metadata — and later user inputs/outputs — to detect threats (e.g., DLP leaks, malware, prompt injection) and enforce agent guardrails? add

bolt Powered by CUBE AI

Spencer Thellmann, Palo Alto Networks

search

(INTRO)

John Furrier

>> . Conversation around AI is shifting from models and tools to outcomes and autonomy. We're moving beyond applications that just inform to intelligent agents that perform. I'm John Furrier, host of theCUBE here in Palo Alto. Welcome to the AI Agents in Action series brought to you by Google Cloud. This is a show where we go beyond the hype and talk to the leaders who are bringing agents to solve real world business problems. We're going to unpack what it means to bring agentic AI solutions to the market, into production, talk about strategy and implementation, all bringing value to the customer about agents in action. Like to welcome Spencer Thellmann, principal product manager, Palo Alto Networks. Welcome to theCUBE and the Agents in Action series.

Spencer Thellmann

>> Thanks for having me. I appreciate it.

John Furrier

>> So the agentic opportunity beyond the hype I mentioned, but it's reality now we're seeing a lot of activity. Obviously coding brought in a lot of activity in the enterprise. You're starting to see that bringing in agentic AI is now on everyone's mind. We're seeing it in action. And there's still some caveats, production workloads, security. What's your point of view on the opportunity for agentic AI as customers and the industry as a whole look at the value proposition, how to deploy, how to think about it?

Spencer Thellmann

>> Of course, yeah. How I think about this is that we've been working on this space for about three years now. And we started our journey by securing chatbots because that's all there was, right, three years ago. And a chatbot is inherently a passive surface, right? Someone asks your chatbot a question, inference is run and then an answer goes back to them and then the interaction is over until the next question is asked. So a lot of securing chatbots boils down to checking prompts for things like prompt injection attacks and data loss prevention patterns and then responses for, let's say, toxic content and custom topics. So we've helped our customers do that for years now, but the shift to agents is different. We can't treat agents like a chatbot, right? Agents are autonomous applications that take action on behalf of users or other agents. They do this by invoking tools, and they have memory, both short and long term, just like you and I do. And so it's those things that make an agent powerful, their autonomy, their memory, and their tool use that also make them kind of uniquely dangerous. And you mentioned coding as an example, right? As I see it today, there's kind of three flavors of agents. There's the agents running in the public cloud. There's those that employees are putting together in SaaS platforms, but now increasingly also we're asked to secure agents running on the endpoint. And each sort of variation of this has kind of separate threats that you need to think about. And so my goal always, and the reason that I come to work every day, is that I believe that the sort of benefits of agents are profound, but so are the risks. And we therefore have a kind of moral obligation, if anything, to help our customers capture the power of agents, be that in the cloud, in SaaS, or at the endpoint, but do so in a way that minimizes risk, right? So that's my perspective there.

John Furrier

>> And one of the things that's come up a lot is governance probably has been the most said word on theCUBE in the past six months. You've seen that in certain areas, but governance, runtime, identity, privilege, and agents are touching things. They're like a microservice, but they are all over the place. They have to have that operational stability in the enterprise and runtime is a big part of it. How do you see that piece? Because now you're seeing agents need to be directed. They're going to touch resources. They're going to invoke tools. They're going to be out there.

Spencer Thellmann

>> Yeah, it kind of comes back to the three things I mentioned before. Autonomy, tool use, and memory. A flip side of autonomy is your agent can do anything, which means it can do anything. That could include doing things like deleting production databases, which no one wants happening. Tools can be manipulated. Memory can as well. And beyond that, we also have to think about how end users are leveraging these things. If I have a user using an agent to talk to an MCP server or something, I have to think about maybe secrets related to my organization leaving my network through Model Context Protocol and hitting an MCP server that maybe shouldn't have access to that data. And the flip side is equally relevant. And if some MCP server becomes sort of poisoned overnight, let's say, and starts sending malware or malicious URLs back to end users through these agents, we have to be able to scrutinize both sides of that exchange as well. So it's a deeply complicated issue, and it's compounded by the fact that if we think about the ratio of humans to agents, it's going to expand from one to ten or one to a hundred to thousands. So you'll have these autonomous beings, non-humans, within your network that are just doing things all the time, either in isolation or together. And so reconciling what they're doing and making a deterministic call as to whether or not that should happen is the sort of next frontier for AI security.

John Furrier

>> And keeping an eye on those agents, good stuff. Palo Alto has obviously been pioneering this area. We've covered your partnership with Google Cloud in the past, Gemini, Gemini Enterprise Agent Platform, and of course the Google Cloud Security. Talk about the update to the partnership. Now more than ever, product integrations and technology innovations are key. We're seeing specialized intelligence come down into domains like security and others. You get the general intelligence, on the internet. as enterprises look at this, they're like, wow, I really need to be integrated. Talk about Palo Alto's integrations and the innovation with Google Cloud.

Spencer Thellmann

>> Yeah, so the broader context here is that we have a platform called Prisma AIRS, which is our AI security platform that does kind of everything what it means to secure AI. Runtime security, model scanning, red teaming, gateway, et cetera. And I run a lot of the integrations that we ship. And the reason that I do this is because I strongly believe, particularly through the lens of AI, is that if you want your security product to succeed, its function is, or its success is a function of the degree to which you can embed that security stack into the tools that people are using to actually build agents and chatbots and models and the like. And Google has been an extraordinary partner there. A year ago, actually, at Google Cloud Next 2025, we showed one of only three, I think, live agents on stage. At the time, it was a Vertex agent built by a partner and then secured by Prisma AIRS API at the time. But in the year and a half that's passed since then, we've done a lot of really interesting work with Google Cloud. And I'll highlight two different things that we announced at Google Cloud Next 2026, just a few months ago. The first is an integration between Prisma AIRS runtime security and Google Agent Gateway. So at Google Cloud Next, Google announced Google Gemini Enterprise Agent Platform, which is this all-in-one platform designed to help organizations ship agents faster that do more. And one part of Gemini Enterprise Agent Platform is the Google Agent Gateway. This is a gateway that sits within the platform and intercepts inputs, outputs, and tool calls, and then sends them to places, just like any other gateway would, right? And so we collaborated for months before the keynote with the Google folks to ensure that the Prisma AIRS Runtime API, our API that checks prompts, responses, and tool calls for threats like prompt injections, data loss prevention patterns, and toxic content, could be natively integrated into Google Agent Gateway. How this works is through service extensions, where by adding a service extension to the gateway, I can today use it to send all MCP tool calls and responses to Prisma AIRS API for inspection. And we're going to broaden that in the fall by extending the capability to also scan all user inputs and outputs to Gemini Enterprise Agent Platform agents. So we have a really strong story at runtime where Prisma AIRS can be used to secure today tool calls, but in the future also inputs and outputs to Gemini Enterprise agents. That's one piece. And then the second part I want to talk about is our model scanning agent. So model scanning is the process whereby we take an AI model and we scan the files that make up that model for threats. Those threats could be simple things like whether or not an organization is verified, if a license exists, but also areas like suspicious subcomponents. If I empower my team to pull random AI models from the Internet, I increase the risk that some of those models are going to be malicious. The model might contain malware or references to a C2 server or something like that. Arbitrary code execution is another risk. And so we have this model scanning service that takes a model and then scans it and provides a verdict per the organization's policies. So that as an organization, I can know that I'm only pulling benign models into production. And we took that service and we turned it into an agent that's available on, again, Google Gemini Enterprise Agent Platform and through their marketplace, where I can now send models to that agent and receive a verdict back as to whether or not that model is safe per my organization's policy that I set up in Strata Cloud Manager. So those are two really exciting announcements from Google Cloud Next.

John Furrier

>> That's awesome product work. just think about just from 2025 to 2026, the momentum and the continued innovation. So I have to ask, how does this translate to customer value? Because you got the combined solution, what specific things, use cases, impact will this do to unlock value for customers?

Spencer Thellmann

>> So if we start with the runtime piece, something I'm really excited about is the ability to inspect every MCP tool call and response, and in the future, also user inputs and responses for threats as well. And there's a couple different dimensions of that. If we're thinking about MCP, it goes back to something I said before. I want to often inspect every MCP input for, let's say, DLP patterns, like cloud secrets, where I want to make sure that sensitive data isn't leaving my network in a way that it shouldn't. Conversely, when an MCP server responds with something and sends content back to an agent, I probably want to scan that too for things like malware or malicious URLs. That's something that this integration enables. And the third prong might be something that's a little bit more detailed, where what we're seeing is that MCP servers can become malicious kind of overnight, right? A server that's legitimate today could be sort of illegitimate tomorrow. And one area where we see that is in tool descriptions, where the description of a tool can contain an indirect prompt injection attack, which could do something like coerce an agent into leaking its conversation history to someone who shouldn't have access to it, right? So that's the MCP scope of checking inputs, outputs, and also the metadata around the transaction for threats. And then in the fall, we expand the scope to check user inputs and outputs as well. We have to think about that dimension of threat at runtime. A lot of the organizations that I meet, they want to make sure that, one, their users aren't submitting, let's say, jailbreaks to their agent or sensitive data of their own. But on the response side, a lot of companies really care about, one, not saying anything toxic back to an end user. And two, ensuring that their agents don't veer into topic space that's antithetical to the purpose of their business. You could imagine that a company wants to make sure that their agent never speaks about their competition. That's something that our custom topic guardrail can do. So we're really excited about that. And bringing the power of our Prisma AIRS runtime security detectors closer to agents built in Gemini Enterprise agent platform by having this traffic flow from Google Agent Gateway into Prisma AIRS through that service extension link. The second piece is our model scanning agent. The cool thing about this is because it's built on ultimately an A2A card, is that other agents can talk to it now. So if you have some kind of agent that's responsible for pulling models from the internet and then running them in some kind of inference service, that agent could self -police itself by sending the model that it's about to do something with to our model scanning agent for inspection. And then our agent could tell it whether or not the model it's about to pull is congruent with the organization's policy. It's a really interesting example of basically ensuring that our detection engine is callable by other agents by packaging our detections, in this case model scanning, as an agent.

John Furrier

>> This is exactly what people want. They want the confidence because they want to use the models. They want to have the security. You got a live demo. Let's take a look at what you have. Let's see it in action.

Spencer Thellmann

>> So here we see a demo of the model scanning agent. I'll take this model from Hugging Face and I'll drop it into our model scanning agent. The agent then thinks, scans the model subcomponents and files, and compares that to the policy that I've set up in Strata Cloud Manager. So we block this model because in this case, the model has a number of parameters that fail one of our policies. In this case, the organization isn't verified by Hugging Face and the license doesn't exist. But again, model scanning can check for other things like suspicious components as well.

John Furrier

>> Was that native on Google Cloud? And what does that mean? Take me through the impact. What's the bottom line?

Spencer Thellmann

>> Yeah, so what you saw there is our Prisma AIRS model scanning service packaged as an agent and available in Gemini Enterprise agent platform through their marketplace. And all of the policy is configured in Strata Cloud Manager, which is our cloud-based management interface for all of our network security and AI security products. So the two talk together, but ultimately you can scan models in Google Cloud now by calling our model security agent.

John Furrier

>> That's awesome. Just drag and drop in there. It gets the validation comes back. You get the green light, go forward. That's awesome. You guys are doing great work at Palo Alto. Everyone kind of knows that and sees that. You've had a lot of great success. I guess my next question would be with the Google Marketplace, Agent Marketplace in particular, this is a great way to reach customers. Take us through that piece of it. How do the customers engage? One click, you're in. Is it already embedded? Take us through the relationship with the Agent Marketplace at Google Cloud.

Spencer Thellmann

>> Certainly. So it differs based on what we're speaking about. The runtime integration, what I would do as a user is spin up a Google Agent Gateway in Gemini Enterprise Agent Platform. And then when the feature is launched, attach Prisma AIRS to it via a service extension. And then with that model scanning agent, all that I have to do is go to the marketplace, assuming that I already have a license for model scanning, and then I can spin up the agent within Gemini Enterprise Agent Platform. So I can start sending it models and getting verdicts back that match the policy that I've set up in Strata Cloud Manager. And this is a really exciting journey that we're looking forward to going further down with Google, because I strongly believe that securing AI should be as frictionless as possible. I should be able to run my security stack where my agents are running. And part of that is a strong focus on the marketplace.

John Furrier

>> I love how you take the friction out of getting the procurement out of the way, but also get the builder working, getting those agents out there. I guess the next question for you as a product manager, go to market with the marketplace is great. How has that impacted your growth?

Spencer Thellmann

>> We're seeing extraordinary growth of Prisma AIRS. As per a recent earnings call, it's our fastest growing product of all time. And we more than tripled our customer base in three months. So I've never seen anything like this before in cybersecurity. And I think it just underscores the fact that as AI has shifted from chatbots to agents, the demand to scan the supply chain of these things, to red team them, attack them before an adversary does, and then to protect them at runtime is just extraordinary. And I think this is very much still the beginning of the proverbial S -curve. So we're looking forward to continue to be the leader in the AI security space by investing even further into Prisma AIRS and our relationship with Google Cloud.

John Furrier

>> Yeah, and you guys got in early, too. You're innovating. You keep on extending that. Keep riding with the tide. Great stuff. I guess my final question is, what's on the roadmap? What's next?

Spencer Thellmann

>> Oh, I wish I could say. We have a lot of really interesting things that we're working on. Our focus right now is singularly on AI agents because of some of the problems that we've discussed today. So I spend all of my waking hours thinking about how to help our customers secure their agents across cloud, SaaS platforms, and endpoint agents. And I think we'll have more to tell you about those three areas soon.

John Furrier

>> Yeah, and more and more people are telling me defense gets better. Defense wins when you have these agents that are done right. Spencer, thanks so much for coming on the AI Agents in Action, certainly showing it in action. Appreciate your time. Thanks for sharing.

Spencer Thellmann

>> Thank you for your time today. I appreciate it.

John Furrier

>> I'm John Furrier, host of theCUBE here for the AI Agents in Action series brought to you by Google Cloud. Thanks for watching.