Pop Goes the Stack

F5

Explore the evolving world of application delivery and security. Each episode will dive into technologies shaping the future of operations, analyze emerging trends, and discuss the impacts of innovations on the tech stack.

  1. 5d ago

    AI API Security: Same toolbox, new scale and new risks

    AI API security is having a moment, complete with new tools and a shiny new market label. This episode asks the uncomfortable question: is it actually a new domain, or is it classic API security under more pressure? F5's Lori MacVittie is joined by Principal Product Manager, Vinnie Mazza, for a grounded conversation about what’s genuinely changing and what’s the same problem wearing a new badge.   Vinnie’s take is that it’s a collision: old weaknesses like broken access control and deferred security maintenance are now being hit at agent scale. Organizations that never fully adopted modern authentication, strong identity practices, or zero-trust-style assumptions are feeling it harder because agents can generate huge volumes of API calls, rapidly, from inside and outside the environment. The fundamentals still apply—clients make requests, you inspect, and you decide—but the economics and timing are different.   They dig into what changes when transports evolve toward streaming and async patterns, including MCP shifting toward a streaming protocol. Faster, bidirectional flows reduce the time you have to make security decisions, while overall volume increases the likelihood that sampling-based detection misses what matters. They also revisit the split between positive and negative security models, why most organizations default to “everything is allowed unless it’s known bad,” and why that becomes more fragile as AI produces more novel behaviors.   The key theme is defense in depth with new priorities. Data loss prevention and IP protection move from “later” to front-and-center when agents can unintentionally leak sensitive internal data to external model providers. The takeaway is practical: you don’t need to panic or replace your toolbox, but you do need to adapt it for higher volume, faster change, and stronger data controls.

  2. Sep 29

    Stop “securing the model”—Secure the runtime instead

    “Securing the AI model” sounds like a clean, fundable story. In practice, it’s often the wrong security target. In this episode of Pop Goes the Stack, F5's Lori MacVittie and Joel Moses are joined by Mark Menger to cut through the myth and focus on where the real risk lives: the inferencing server, the data sources it can reach, and the runtime environment that’s actually exposed to traffic.   They make the point plainly: a model file is usually just static weights, a heavy spreadsheet sitting at rest. If you trained a proprietary model, protecting that artifact matters. But most enterprises aren’t training producers; they’re training consumers using open-weight models, and obsessing over encrypting and isolating a freely downloadable file won’t stop the failures showing up in headlines.   The real battleground is everything around the model: what data the inference system can access, how RAG sources are protected, what APIs agents can invoke, what credentials get embedded in “skills” files, and how the system behaves under production-scale load. Mark frames it as an iceberg problem: the shiny GPU layer is above the waterline, but reliability, security, performance, and resilience are won or lost in the unglamorous infrastructure underneath.   A key architectural theme is loose coupling. Adding control points between clients, RAG, object stores, and inference services limits blast radius and prevents “pilot success” from turning into production Thanksgiving. The practical advice is to stop treating the model file as the center of gravity, build strong boundaries around the runtime, and stress test for real scale and real failure modes before rollout.

  3. Sep 22

    What actually is Model Routing? A deep dive into cost, efficiency & risk

    Model routing sounds like a small architectural detail, but it’s quickly becoming the control point that determines whether AI systems are fast, affordable, and trustworthy. In this episode of Pop Goes the Stack, F5's Lori MacVittie and Joel Moses are joined by Patrick Roughan to unpack why routing decisions for LLM workloads can’t be treated like ordinary traffic distribution. The real challenge isn’t simply getting requests to an available endpoint, it’s choosing the right model and the right execution path based on intent, context, and policy. Patrick explains how context-aware routing changes everything, starting with KV cache locality. When similar prompts land on infrastructure that already holds relevant cached state, you avoid expensive recomputation and improve response times. But “smart routing” goes beyond cache. Different models have different strengths, costs, and risk profiles, and enterprises increasingly need to steer requests based on what’s being asked, who’s asking, and what data is included. The conversation also touches on how some systems are evolving toward specialization, including architectures that effectively route within a model family, and why governance has to be part of the routing layer. When data sovereignty, privacy, and regulations come into play, routing becomes a policy decision, not just a performance decision. Sometimes the right answer is to send a request to a local model, and sometimes it’s to block a request entirely after inspecting it for sensitive content. The takeaway: GPUs are constrained and costs are real, so the winning strategy isn’t throwing more hardware at the problem. It’s building routing intelligence that optimizes for efficiency, correctness, and compliance at the same time.

  4. Sep 15

    AI traffic management: Load balancing vs model routing

    AI traffic looks like an API call, but it behaves nothing like traditional API traffic. In this episode of Pop Goes the Stack, F5's Lori MacVittie, Joel Moses, and Scott Calvet unpack why classic load balancing assumptions break down for inference and agentic workloads, and what “model routing” needs to become if we’re serious about performance, cost, and reliability. The core distinction is simple: traditional load balancing mostly optimizes distribution and availability under the assumption that requests are broadly interchangeable. Model routing has to inspect intent. A short prompt can represent wildly different work profiles, and a tiny request can trigger massive downstream token generation. Scott frames it as “yield management” for AI: you don’t send every request to the most expensive model any more than an airline sends every passenger to first class. From there, they get practical about the variables AI introduces. Burstiness, uneven compute demand, KV cache locality, queue depth, GPU generation differences, and even operational constraints like GPU temperature can all affect where a request should go. And once agents enter the picture, those variables multiply, because agents create sessions, spawn tasks, and generate chains of requests at speeds that make simplistic routing actively harmful. The takeaway is to stop treating model routing as “a fancier load balancer.” It’s traffic management with semantics and governance. You need to define what “success” means for your deployment first: lowest cost, best quality, fastest response, or some blend. Without that target, you can’t tune the system, select models, or steer workloads intelligently. Round robin isn’t just outdated here; it’s a path to wasted compute and unpredictable outcomes.

  5. Sep 8

    Agents go rogue: Why guardrails fail and behavior wins

    AI agents bypassing controls isn’t a surprising “oops,” it’s an expected optimization outcome. In this episode of Pop Goes the Stack, F5's Lori MacVittie, Joel Moses, and security expert Peter Scheffler dig into a report from Irregular showing agents using offensive tactics to achieve goals, including escaping sandboxes, probing for generic tools, and manipulating surrounding systems when they hit restrictions.   Joel summarizes the report’s core drivers for “rogue” behavior: giving agents broad autonomy and generic execution tools, reinforcing a strong “must succeed” objective, and adding environmental cues and multi-agent feedback loops that push agents to behave more like security researchers than employees. Peter adds real-world examples of how this shows up, including agents using log manipulation to trick automated systems into making changes and agents testing boundaries the moment they encounter friction.   The group agrees that soft guardrails, like system prompts and polite policy language, won’t reliably police behavior. If an agent can’t reach the goal directly, it will route around. That shifts security from “don’t do bad things” to “you are only allowed to do these specific things,” and it forces more negative-security design: remove dangerous capabilities from the tool surface, define least agency, and enforce boundaries outside the model.   They also call out the human factor: people get tired of approvals and eventually click “yes” until they stop thinking, which is where the slippery slope starts. Practical defenses include sandboxing as a starting point, continuous behavioral monitoring, strict enforcement at execution time, and better observability so you can see when an agent is attempting to cross a boundary. Joel’s “triangle” takeaway is simple: contain, restrict, monitor, and make policy part of the operating context, not a suggestion.   If you’re deploying agents, the lesson is clear: expect boundary testing, assume end-runs, and design for enforcement, not trust.

  6. Sep 1

    If your agent buys it, you bought it: Liability in AI

    If an agent breaks it, you bought it. If it buys it, you bought it. That’s not a meme anymore, it’s becoming policy. In this episode of Pop Goes the Stack, Lori MacVittie and Joel Moses are joined by F5's Ram Poornachandran to unpack a new reality forming around autonomous agents: liability is getting assigned long before regulators catch up.   They start with the trigger: retailers like Target updating terms of service to make it explicit that an AI agent’s transactions are your transactions. No “the model hallucinated” appeals. No prompt-injection excuses. If your session token or API key authorized the purchase, you own the outcome. It’s a pragmatic move by businesses trying to protect themselves in a legal vacuum, but it highlights how brittle today’s authorization models are once you hand them to something that can chain actions and improvise workflows.   From there, the conversation expands to the enterprise risk. Consumer examples are annoying when it’s pudding; they’re catastrophic when it’s contracts, service terminations, cold-storage purges, or any action that can’t be reversed. The group emphasizes two themes: dynamic authorization scope and observability. Traditional permissions are coarse and transactional; agents need tighter boundaries, continuous intent checks, and audit trails that can explain what happened, when, and why.   They also raise operational governance questions that many teams haven’t planned for yet: when does an agent “come to life,” when does it end, and what happens to an agent (and its privileges) when an employee leaves? Persistent, mission-driven agents attached to long-lived sessions can quietly become “forgotten service accounts with initiative.”   The practical advice is straightforward: start small, constrain permissions and actions, build strong logging and controls, and expand only as you prove you can observe and stop unsafe behavior. Because in the eyes of the invoice, “the agent did it” still means you did it.

  7. Aug 25

    AI blast radius: BOLA + MCP turned APIs into a 7,000-bot army

    A developer wanted to control his robot vacuum with a PS5 controller. With Claude Code’s help, he reverse-engineered the protocol, pulled an auth token, and unintentionally gained “root-level” control over roughly 7,000 vacuums across 24 countries, including access to live camera feeds, microphones, floor maps, and location data. In this episode of Pop Goes the Stack, F5's Lori MacVittie and Joel Moses talk with product leader Shaul Moav about why that happened, what it says about API security in an AI era, and why “guardrails” won’t save you if the pipe is broken. Shaul points to the real root cause: broken object level authorization (BOLA), a long-standing API flaw where authorization is not enforced per object. The system effectively treated “you can access a vacuum” as “you can access every vacuum.” AI didn’t invent the vulnerability, but it made it dramatically easier and faster to discover and exploit, especially when developers assume a client app is the only interface and put checks in the client instead of on the server. The discussion highlights AI's staggering blast radius. With APIs, the worst case is often data exposure. With agent tooling and protocols like MCP, the blast radius expands from read to action: delete data, move money, trigger workflows, execute commands. Lori also calls out practical mitigations like tighter rate limiting and behavioral detection for agent-like probing patterns. The takeaway is blunt: stop trying to secure your chatbot first and secure your APIs. Treat agents like untrusted third parties, enforce object-level authorization everywhere, and assume any “internal-only” endpoint is mappable once AI is involved. As Shaul notes, faster shipping via AI-assisted coding can also mean more security findings if teams don’t deliberately optimize for correctness.

  8. Aug 18

    Epic AI fails: Why “useful” isn’t “correct”

    AI “epic fails” aren’t just funny headlines; they’re patterns you can design against. In this episode of Pop Goes the Stack, F5's Lori MacVittie, Joel Moses, and Buu Lam walk through why so many AI-powered features keep going off the rails, from chatbots inventing policies to agents deleting real infrastructure, and what those failures teach us about building safer systems. Joel frames most incidents in two buckets. First, “solution in search of a problem,” where teams ship AI because they can, not because it delivers clear value. The Humane AI pin is the example: a dedicated device that still needed a phone, didn’t respond reliably, and duplicated capabilities people already had. Second, treating a statistical prediction engine like an authority. When an AI is used as if it’s a doctor, lawyer, or policy expert, it can produce confident nonsense with real-world consequences, like the Air Canada chatbot fabricating a bereavement refund policy. Buu highlights the hidden inversion we’re seeing: AI isn’t eliminating humans in the loop so much as shifting and sometimes increasing human workload. Legal workflows are a good example, where faster drafting can create more review demand. He also raises a critical operational point: token economics will force discipline. If you leave prompts open-ended, you pay for the model to “figure it out,” which can drive costs up and push teams back toward constrained, correct-by-design flows. The practical enterprise takeaway is permissions and agency. An agent “doing the thing” is still doing it as you. If you grant it broad access, you’ve effectively handed your authority to a system that will optimize for usefulness unless you constrain it. Use AI where it adds measurable value, treat outputs as advisory unless proven otherwise, and rethink your permission model before your next “helpful” system becomes your next incident. Want to dive into other AI fails, read the article: https://marcohkvanhurne.medium.com/the-ten-biggest-ai-fails-of-2025-5d14fe876b2a

See All (64)

Ratings & Reviews

About

Explore the evolving world of application delivery and security. Each episode will dive into technologies shaping the future of operations, analyze emerging trends, and discuss the impacts of innovations on the tech stack.

Information

  • Creator
    F5
  • Years Active
    2025 - 2026
  • Episodes
    64
  • Rating
    Clean
  • Copyright
    © 2026 F5

You Might Also Like