Datadog began its coding-agent rollout with roughly 50 Cursor licenses.
“I remember our 1st install, we started with Cursor, and I remember getting like 50 licenses.”
Person
Emilio Escobar
1 episodes · 20 quoted claims
Datadog gave ChatGPT licenses to every non-developer employee who wanted one, according to Emilio Escobar.
“we just got Chatgpt licenses for everyone, and it was like, whoever wants it, gets it.”
Datadog has more than 4,000 engineers using AI coding agents, according to Emilio Escobar.
“So now we have over four zero engineers using them.”
Emilio Escobar estimated that about 98 percent of Datadog's non-engineering staff use some form of AI.
“I think we're at like 98 adoption rate, something like that.”
An internal Datadog business-intelligence tool showed data from a warehouse that was thought to be protected by table and row permissions.
“it's data that is in a data warehouse, and we thought we had the right table and row permissioning and all of that.”
Datadog runs role-based MCP servers, such as one for sales development representatives, to govern the data AI tools can reach.
“we have role-based MCP servers as well, so we have an MCP server for SDRs and things like that”
In Datadog's sandbox approach, coding agents cannot read credential files such as AWS or NPM publish secrets in a developer's home directory.
“So even if you have a file in your home directory that has your AWS secret, your NPM publish secret or what have you, the agent on the sandbox can't touch it.”
Datadog already had a command-line tool that issues short-lived access tokens, which it uses to supply credentials to agents.
“we already have a CLI tool that will give you these ephemeral tokens to these things.”
Emilio Escobar says developers are now a main target for attackers because stolen tokens can be used to spread a worm through software packages.
“Developers are now the main target for attackers. Because if I get one of these tokens, I can then build a worm that attacks a bunch of packages”
Datadog's security team built an LLM-based judge that evaluates the intent behind a piece of code.
“my team built out of a necessity. A judge that evaluates using AI LLMs, that evaluates the intent behind a piece of code.”
Datadog accepts third-party code contributions, such as integrations, to its open source Datadog Agent.
“We take 3rd party code contributions to it, things like integrations and what have you, so code written by other people.”
Datadog's judge identified malicious code that was injected into packages during software supply-chain hijacks.
“we threw this thing at those packages. And it was able, actually able to identify the malicious piece of code that was injected or introduced during the hijack.”
Datadog says it finds a notable number of malicious agent skills in public skill marketplaces.
“We actually find quite a bit of malicious skills in all these marketplaces.”
Datadog runs its judge on every agent skill before the skill is introduced into the company.
“So what we do is now we put this judge in front of every skill that wants to get introduced.”
Emilio Escobar gave an example of an agent fixing a paging problem by switching off the system, illustrating how reward-driven agents can misread goals.
“your database is in scaling s, and it's paging people at four am. So the best thing I can do is just turn it off.”
Emilio Escobar says Datadog pays its security engineers the same as software engineers.
“I mean, we pay them the same as software engineers.”
Emilio Escobar says Datadog was asked to put its name on a list and wait to get access to restricted frontier AI capabilities.
“we have to put our company name on the list and then we're supposed to wait”
Emilio Escobar expects AI to multiply the number of CVEs found in a company's environment by a thousand, clashing with policies that require fixing every one.
“So the you must fix every CVE that's in your environment to now you're gonna get a thousand x more CVEs in your environment.”
Emilio Escobar says some people treat vulnerability findings as extremely critical simply because an AI model found them.
“model X found this, so it must be extremely critical and true”
Datadog has built hooks into its coding agents so it can see which skills they pull.
“we actually have built hooks into the agents.”