Shubham Gilada

Shipping voice AI & AI agents to real users, with a security engineer's paranoia. Lessons from production, not demos.

[Shubham Gilada @Shubhamgilada]

Hi X 👋 I'm Shubham.

I spent my early career in security. Now I ship AI agents to real users, and I never lost the paranoia. 🔐

What I build:
→ voice & chat agents that talk to real customers
→ LLM pipelines that run every night without a human watching
→ large systems built with coding agents

What I'll post:
• what breaks when AI meets real users
• how attackers would break it (and how to stop them)
• building LLM pipelines you can trust
• agentic coding, done properly

Lessons from production, not demos.

If you build with AI, follow along. Every Friday: a Paranoia Check 🔐

[Shubham Gilada @Shubhamgilada]

@Dheemanthredy Open weights in 11 Indian languages is a real gift for anyone building voice agents here.
How does it do when a caller switches between Hindi and English mid-sentence? That's how most people in Pune actually talk on a call, so it's the first thing I'd test.

[Shubham Gilada @Shubhamgilada]

@anciwasim On a voice call it's even tighter. There's no spinner, just silence, and ten seconds of silence sounds like the line dropped.

So I'd have the agent say "let me check that" when the tool starts, and give it a line ready for when the timeout fires.

[Shubham Gilada @Shubhamgilada]

@albertolco88 Measuring with real calls instead of pricing pages is the right way to do it.

Does the $0.017 include the phone line and the LLM, or just speech in and out? Telephony alone can be a big part of a minute in some countries.

[Shubham Gilada @Shubhamgilada]

An LLM will happily write "no" into a field that only accepts "none".

Someone said "he doesn't have any claims." The model filled in "no".

Our graph rejected it, asked again, and the conversation carried on. Nobody got stuck.

If the model could write straight to your system, that's a bad record nobody ever sees.

The model proposes. The graph decides.

[Shubham Gilada @Shubhamgilada]

@chevonphillip Same line for me: anything you can't take back.

I'd add one rule for the gate itself: show the exact action that will run, not the agent's summary of it. A yes to "send the reply" should mean that reply, to those people, unchanged after the click.

[Shubham Gilada @Shubhamgilada]

@CoDanny In voice I'd bet on the caller's own corrections. "Actually, make it Thursday" shows up once, late, and "Tuesday" is already in the context three times.

Have you tried changing it twice? I'd guess the middle value is where it slips.

[Shubham Gilada @Shubhamgilada]

We're building this into ONEJRNY, AI experience orchestration for guided customer journeys: https://t.co/59K7JNTrST

[Shubham Gilada @Shubhamgilada]

While testing our AI agent, I asked it a coverage question. It said "No." Confidently.

I asked "Really?" It changed its answer. The second one was right.

A customer wouldn't have asked twice.

So the model no longer decides what's true. A graph built from the business's own rules does. The model just does the talking.

If the answer isn't in their documents, it says "I don't know."

[Shubham Gilada @Shubhamgilada]

@hwchase17 Agree, and the confirm step is the one I'd protect. A judge that flags too much trains everyone to stop looking.

For voice agents I'd start with calls where the caller asked for a person. That's a failure label the caller already gave you.

[Shubham Gilada @Shubhamgilada]

@MistralAI Nice detail in the turn docs: wait for the real end before anything you can't undo, like booking a slot.

And end of turn isn't end of call. "Okay. Thanks." is a complete turn either way, and the voice agent we're building once hung up on the wrong one in a test call.

[Shubham Gilada @Shubhamgilada]

@hwchase17 Nice detail in the docs: in a Slack channel, a user-owned connection resolves to whoever sent the message.

So if it reads my private Notion pages there, does the reply land where everyone can see it? User memory is denied in channels by default. Same for user-owned tools?

[Shubham Gilada @Shubhamgilada]

@supabase Nice that the setup uses read_only=true and the prompts tell the agent to ignore instructions found in log messages.

The flag is the part I'd lean on. Log lines carry text users control, so the prompt asks and the read-only user enforces.

[Shubham Gilada @Shubhamgilada]

@berman66 Agree, and I like that it doesn't depend on catching the injection itself. Goal substitution looks the same in a trace whether a planted email caused it or a confused model did.

Where does the original intent come from: the first message, or something the user confirms up front?

[Shubham Gilada @Shubhamgilada]

@tarush_agarwal_ Nice that accuracy is split by kind. Even the top rows drop to 86–87% on codes and addresses, while medical terms sit near 99%.

For phone agents that's the column I'd sort by first. A confirmation code read wrong costs more than 100ms of silence.

[Shubham Gilada @Shubhamgilada]

@assumebreach Point 4 is the one I'd underline. The making-up-for-the-model half shrinks with every release. The control half is the part I'd never hand to the model.

On point 3: how do you spot "blocked, so it found another way" in a trace? From the actions, or from the reasoning?

[Shubham Gilada @Shubhamgilada]

@CoDanny Agree, and voice makes it worse: the caller hears "you're booked for Tuesday" and hangs up happy.

One fix I like: build the read-back from the booking record, not from what the model remembers of the call.

[Shubham Gilada @Shubhamgilada]

@wunderwuzzi23 34% sure that 1+1=2.

Now picture that number gating an approval somewhere.

[Shubham Gilada @Shubhamgilada]

@sushant_sec Agree. It's the confused deputy problem from my security days, just with a new deputy.

The split works best when the reader can only hand back structured fields. If the actor still sees the raw text, the injection rides along.

[Shubham Gilada @Shubhamgilada]

@Aditya_Chawla20 Good list. I'd add one to the fundamentals side: knowing how these systems fail.

Evals, permissions, what happens when the model is confidently wrong. The next model won't build that in for you.

[Shubham Gilada @Shubhamgilada]

@jebentier Agree. The replay is cheap once it's labeled. The label is the part that needs a human.

Who does the labeling on your side, engineers or the people who'd normally take those calls?