Key Takeaways

  • Stripe deployed its internal AI agent, Kai, to more than 10,000 active employees every week.
  • Autonomous agent loops act as unintended stress tests, repeatedly hitting internal APIs until core services risk total failure.
  • Stripe isolates all agent code execution inside cloud sandboxes equipped with strict boundaries for data input, search, and retrieval.
  • Assigning explicit agentic identities to AI requests allows engineering teams to prioritize human traffic and shed agent load during traffic spikes.

Autonomous Loops Amplify Every Existing Infrastructure Flaw

When Stripe opened up its internal agent, Kai, to 10,000 weekly internal users, the engineering team quickly discovered that autonomous software behaves nothing like a human behind a keyboard. A human gets an error message, stops, and thinks. An agent gets an error, spins up a new attempt, and fires off fifty more requests in two seconds.

Sharadh Krishnamurthy observed this pattern firsthand as Kai scaled across Stripe. “Agents are very creative at bringing your infra down,” Krishnamurthy explained. “It turns out that agents just dial up all your failure modes. It just multiplies the amplitude of problems you can get. There were agents that went rogue. There were agents that may have almost taken down core systems.”

When an AI model runs in an open feedback loop, small API hiccups turn into cascading outages. A minor database timeout prompts the agent to retry with slight variations, effectively launching a distributed denial-of-service attack against internal backends. If your infrastructure has a weak join or an unindexed query, an agent will find it and hammer it until the server falls over.

Sandboxes and Agentic Identity Keep Production Alive

To prevent autonomous tasks from wrecking core services, Stripe established two technical guardrails: isolated cloud execution environments and agentic identity tracking.

First, Stripe built secure cloud sandboxes. Instead of allowing Kai to execute code or process raw files directly against production clusters, every session runs in an isolated container. Non-technical staff can ask the agent to write custom scripts or analyze large datasets without granting the underlying model unmonitored access to live databases. As Krishnamurthy noted, Stripe built dedicated tools to manage this boundary: tools to pipe data in securely, tools to search the sandbox, and tools to extract outputs safely.

Second, Stripe began treating agents as distinct network actors with their own traffic tiers. Krishnamurthy pointed out that teams need clear visibility into what an agent is attempting so infrastructure can make intelligent routing choices: “Thinking about how do we say that this is an agent and this is what it's trying to do... and using that as a way to think about priorities and load shedding.”

If checkout traffic surges or primary databases experience latency, internal agent traffic should drop first. Without an agentic identity tag attached to every background loop, your load balancers cannot distinguish between a real customer completing a transaction and an AI assistant attempting to parse a spreadsheet.

What to Do With This

Audit your internal API gateway tomorrow morning and check whether agent traffic shares the same rate limits and authentication tokens as production user traffic. If an agent loops on a failure, tag its requests with a custom header (such as x-agent-identity) and configure your load balancer to drop those requests first whenever upstream response times exceed 300 milliseconds.