An alert fires in one of Gravwell's own data centers at 3 a.m. Before PagerDuty wakes anyone up, an agent runs a set of scoped queries, pulls together enough context to orient a half-asleep analyst, and drops a plain-language playbook in Slack. By the time the phone rings, there's something to act on instead of a raw alert and a blinking cursor.
That's the job of the new Alert Triage Agent, one of five AI agents the security data platform shipped this week in its 5.10 release, alongside agents for case investigation, admin questions, nightly summaries, and platform hygiene. All five live inside Logbot, Gravwell's chat interface, and pull their own context straight from live telemetry, detections, and system state through an MCP server, instead of working from a case file a human assembled.
That's also exactly the kind of autonomy Gravwell CEO Corey Thuen told me he's wary of. At Black Hat, Thuen said unsupervised junior analysts paired with LLMs is "a recipe for disaster," and argued security work should be broken into deterministic pieces — scripts, API calls, steps with knowable outcomes. Five agents deciding on their own what to query sound like the opposite of that. So I put it to David Fritz, Gravwell's VP of research, who built the framework these agents run on.
Fritz didn't dodge it. Full autonomy — "loop forever, open-source-agent style," as he put it — is already possible in the framework, but Gravwell hasn't exposed it to customers yet; that's coming with the 6.0 release later this year. What ships today is built as a graph: steps that fan out, fan in, and loop, with constraints set at each step. An alert triage run can execute certain queries and nothing else — no new assets, no reaching the public internet — before handing findings to the next step, which writes the playbook.
"That graph is the only deterministic part," Fritz told me. Inside any single step, there's no script running the show — it's "essentially just a system prompt, a list of tools it's allowed to hit, and off it goes." State from each step folds into the next until the whole thing produces a final write-up. In practice, that's asking case-agent to check for ingest spikes and getting back a runnable query — start=-24h tag=* count over 1h | chart count — with a button straight to the query editor, not a paragraph of advice.
I asked what actually stops an agent from pulling more than it should — whether "read-only until told to save" is a permission the model respects or a technical wall it can't cross. Mostly the former. Grant an agent write access, and it can create or modify assets. The one thing it can't do under any configuration is delete. Past that, Gravwell relies on the same tool every AI product relies on: telling the model what not to do, and hoping it listens. Fritz pointed to Claude Code's own system prompt as the same problem. "It can choose to ignore that."
That extends to data quality. If the telemetry an agent works from is incomplete or has been quietly manipulated, Fritz said flatly, "the agent is not going to be any more useful than a human looking at that bad data" — everything downstream still presumes what's in Gravwell is ground truth. And on Thuen's point that most teams keep only 60 to 70 percent of their logs due to storage cost, Fritz argued agent frameworks reward the opposite instinct: ingest everything raw and structure it at query time, since an LLM can hold context no human could, and whatever's thrown away at ingestion can't be recovered later.
What's real about the audit trail, versus an LLM narrating its own reasoning after the fact? The tool calls, Fritz said — those are logged and reconstructable regardless. A separate telemetry layer fingerprints otherwise stateless chat sessions with a transaction ID, so an analyst can rebuild one "the same way you'd reconstruct a session in Wireshark," including any MCP calls Gravwell makes as a client to other servers. Running their own Claude Code traffic through that pipeline, Fritz found a simple "hello world" logs three megabytes of text — mostly Claude's own 70-kilobyte system prompt. "It kind of dispels some of the magic," he said, "when you see just how dumb these things are, literally."
Access is scoped through what Gravwell calls CBAC in its own admin documentation — an MCP server inherits exactly what its token was granted, nothing more, and an agent runs as the user who invoked it, with tools whitelisted per step. Gravwell also pays outside teams to audit the product, including the MCP layer: prompt injection attempts, binary extraction, the works.
When I asked whether a security vendor's own agent layer becomes the next attacker target, Fritz pushed back on the premise. The bigger blind spot, he argued, is that nobody has real visibility into what ordinary LLM use is already doing — even enterprise tiers of Claude or GitHub Copilot don't expose what data users are sending out. "It's like not knowing how many printers are on your network," he said, except worse, since making sense of it means running AI against your own AI logs. "That's a billion-dollar idea" nobody's built yet.
Asked about the honest failure mode a month in, Fritz named two unglamorous ones: storage cost catching Splunk migrants off guard once they stop discarding data they didn't realize they'd been discarding, and detection rot — rules that quietly stop firing when an upstream source changes. Gravwell's own audit agent found one internally that had gone silent since March, because someone switched ingestion to a different tag, and offered to fix it on the spot.
His real 12-month worry isn't security. It's economics — whether LLM token pricing, propped up by venture money, survives an eventual "reckoning," his word for the day, when costs stop being subsidized. That's part of why Gravwell runs its own GPU compute for customers who want it, even though open-weight models still trail the frontier. It's also where he landed, unprompted, on data sovereignty: Gravwell's hosted LLM service doesn't train on or retain customer prompts, since sending cybersecurity telemetry to a model that might train on it is "concerning." For a company selling agents that read your logs, that's arguably the guardrail doing the most work.
