Teamday
← People

Aiden Sochowski

Founding Engineer at Runlayer

agentssafetyenterpriserunlayer

About Aiden Sochowski

Aiden Sochowski is a founding engineer at Runlayer, a startup that secures and governs how AI agents connect to tools through the Model Context Protocol (MCP). Runlayer came out of stealth in November 2025 with an $11 million seed round led by Khosla Ventures and Felicis.

In his talk at AI Engineer, "300 Agents, 60 People: How We Secured Our Own AI Agents," Sochowski describes how Runlayer turned its own monitoring on itself. The company deployed a gateway, logged every agent session and tool call, and found that a team of about 50 to 60 people was running more than 300 agents every day. The talk covers what that data revealed about prompt injection, over-permissioned agents, attacks that spread between agents, and runaway costs.

His perspective is practical rather than theoretical: he works on the problem from inside a company that runs agents for recruiting, support and code review, and is candid that defining agent security policies is "still being worked on."

Career Highlights

  • Founding engineer at Runlayer, an MCP and AI agent security company
  • Speaker at AI Engineer (2026) on securing a company's internal agent fleet
  • Helped instrument Runlayer's own use of agents: inventory, risk mapping by topic and blast radius, and visualizations of every agent run and the MCP servers it touches

Notable Positions

On Agent Visibility

Sochowski argues most companies have no visibility into the agents their employees run: local MCP clients, agent products signed up for on the web, authentications to MCP servers from unmanaged devices. Runlayer's own count, more than 300 agents for 50 to 60 people, is his evidence that agents already outnumber the people running them. See Agent Observability.

On Prompt Injection and Session-Level Attacks

Every tool call is an attack surface. Layered gateway policies (instruction classifiers on inbound email, PII rules on outbound messages, blocks on sensitive data sources) help but are never 100% effective. Some attacks, such as an author repeatedly arguing with a PR-review agent until it approves, unfold over a whole session, so Runlayer trained classifiers that check each tool call against the agent's defined purpose. See Prompt Injection.

On Scoping Permissions

Because permissions are hard to define up front, Sochowski favors learning them from behavior: flag runs where a well-scoped agent uses unusual tools, and use its past tool calls to suggest access it can lose. He also argues for tightly limiting where agents can write, since one poisoned input in a shared system can reach every agent that reads it.

On Agent Costs

Monitoring also catches waste. His examples: a vibe-coded MCP server whose formatting errors sent an agent into costly retry loops, and agents whose costs rose more than 100x in a week after a switch to a far more expensive model. Budgets, sane defaults and rate limits brought Runlayer's costs back down.

Key Quotes

  • "We have over 300 agents that are running every single day." (on agent sprawl at a 60-person company)
  • "Trying to be deterministic and scoping down those permissions is super important, but it's really hard to define up front." (on agent permissions)
  • "At the end of the day, agents are just software." (on how agents move data between systems)