IBM and CoreWeave Engineer Security Controls for AI Agent Workloads

Keeping agent workloads isolated has shifted from a theoretical concern to a concrete infrastructure problem. Research organizations are now executing code and testing autonomous agents on systems originally designed for compute-intensive training tasks, requiring those platforms to safely handle interactions with external tools, storage systems and services.

IBM Research faces growing complexity in its computing infrastructure as its development practices expand beyond traditional model training. The addition of reinforcement learning workflows introduces new operational demands, according to Brian Belgodere, senior technical staff member at International Business Machines Corp.

The RL process is [that] you are in the middle of training a model. At some point, you take that checkpoint and then actually load it into inference, ask it to do something and you're measuring. That's your testing phase.

Brian Belgodere, IBM Research

Belgodere discussed these challenges during an exclusive broadcast at the Fully Connected event, speaking with theCUBE Research's Dave Vellante and John Furrier on theCUBE, SiliconANGLE Media's livestreaming studio.

From model training to executing agent code

Building out IBM Research's Granite family of models demanded substantial computational resources. The thermal and electrical requirements of newer hardware generations prompted IBM to partner with CoreWeave Inc., Belgodere explained.

That was what gave me, 'Hey, go build out our infrastructure.' We went out and built a large H100 cluster, and we did it ourselves: got the space, soup to nuts. It was a huge task.

Brian Belgodere

The partnership has evolved beyond infrastructure provisioning into collaborative development of identity management and workload control systems. IBM articulated its requirements for extending internal identity infrastructure into CoreWeave's environment, then worked through multiple refinement cycles with the provider, according to Belgodere.

Oftentimes they will come to us and say, 'Hey, we're thinking of this, can we get your feedback?' And we'll happily go through it.

Brian Belgodere

Agent workload isolation becomes a design requirement

IBM Research operates much of its cluster as single-tenant infrastructure, with dedicated storage resources within CoreWeave and additional capacity provisioned according to cost and security constraints, Belgodere noted. The IBM-CoreWeave partnership incorporates CoreWeave Sandboxes, which enable isolated code execution either on dedicated hardware or through a managed serverless platform. This flexibility allows researchers to determine execution location and define resource access boundaries for agent code.

There are a lot of misses, and people tend to underestimate the cost to change some of these decisions. If you decide to make a poor architecture decision early on, the cost is either going to be [that] you accidentally bought way too much networking infrastructure, or you have to go buy and refit everything.

Brian Belgodere

IBM evaluates how security controls affect system performance by comparing against established benchmarks, using those measurements to inform discussions with security teams about acceptable tradeoffs. Workload isolation functions as a complement to enterprise identity integration within the overall security framework.

https://www.youtube.com/embed/Q3dG2cooq28?start=22&feature=oembed

This is a supply chain problem, top to bottom. It's not just the hardware, it's the firmware, kernel levels, code, your data provenance. Then you get into the whole world of agents, your images. It is an absolute provenance problem.

Brian Belgodere