Under the surface of the explosion of AI companies and products there is an infrastructure battle taking place – it is a battle to control access to your content and make it a part of an AI company’s training data.  It is a battle to control the path of your information.

There is a spectrum of AI usage types today:

• Individual users on a chat product using a web browser for chatgpt.com or claude.com or similar.
• Individual users moving to the desktop client of one of these vendors now packaged as “unified” desktops incorporating chat, coding and work features
• The enterprise account equivalents of either of the first two, with account controls, budgeting, etc.
• Token/consolidation products like software development tools which let you pick AI endpoints for coding.  Some of these are configured with your individual API keys to your different accounts and others provide an API token to their service and charge an “uplift” as they route your traffic, basically token re-selling.
• More comprehensive model routers like OpenRouter (just acquired by Stripe) which let you multiplex and set workflows for where to send different types of queries, and let users pick AI targets dynamically as well.

All of these are trying to ensure that they are in path to your interactions with the LLMs, including potentially your own private LLMs.  Why?  Because they want to capture your users’ interactive sessions with the LLMs.

Hot in the recent news is it appears that mathematicians who spent countless hours independent of LLMs pursuing a significant mathematical challenge, applied their domain and research knowledge to guide and direct their “interrogatory sessions” with an LLM – only to have the LLM company take that synthesized knowledge as their own and claim to have solved the mathematical problem.

The business enterprise stakes are perhaps smaller but omnipresent.

The user might be an expert lawyer, with a deep capable memory, depth of experience in industrial operations litigation, who is using LLMs in their work.  The captured, iterative conversation stream from that person, as they ‘leave’ an LLM session satisfied with the result of the interactions, is likely to be valuable.  The human user directed a synthesis of the knowledge available to the LLM, and the person’s knowledge and lived actions.  This synthesis is likely to have never been captured in the training set.  UNTIL NOW.

The user might be a software designer who through the LLM interactions has that ‘aha’ moment about how to tackle a problem, creating new knowledge.  Even if the LLM tried to “one shot” a response to the designer’s initial prompt, let’s assume the person responded with critique and re-direction.  This interrogative stream likely contains, if not entirely new knowledge to the LLM, then curated knowledge, which adds to the value of the LLM provider.  IF CAPTURED.

Everyone wants you in-path to use your knowledge synthesis as the new training data.  Every day the AI services are being fed “AHA” moments that experts have had while making use of the LLMs as a super knowledge base – but in fact shaping, guiding, let’s say providing, much of the intelligence.

Which leads me to repeat “Kerpan’s Law of AI”:

If you do not control your path to LLMs this will be your forever situation.  At Cohesive Networks we think organizations are on a journey from early adoption of LLM’s as a Service (ChatGPT, Claude, Kimi, etc.) and over time will gradually migrate many of these interactions to self-hosted AI (regardless of in-cloud, hosting provider or on-premise).  The key point will be explicit decisions of how much to share with the “as a service” players.

In the past most of us have been too busy, too introverted, too scared, too worried about HR and Legal, to post detailed interactive transcriptions of our thoughts, of team brainstorms, of the fragment of solutions which are not the heart of a product or service, but provide insight and capabilities to products and services.  BUT, in the confessional of the chat interface, given access to something in many ways worse than search, but in other ways better, a more comprehensive knowledge base, we type, guide, shape, drive to new knowledge and give it away.  No, in fact pay for the privilege.

I am not privy to any such fact, but, the LLM as a Service companies have to have a scoring mechanism in place for queries or users, perhaps both.  I would surmise that users whose primary usage is ‘What’s the best cat food for Calicos in February?’ or ‘How do I clean oil stains off my garage floor?’, while perfectly fine customers, might have a low score for bringing “additive knowledge” to the training data.  But there are some users who you might argue should be paid for interacting with the LLMs.

This is why they want your interactions to flow through their path.  Some subset of those interactions are worth their weight in gold as higher quality training material than much of what has been trained on from Reddit, Stack Overflow, etc. Maybe “better” is even the wrong word.  It is at the very least tapping into to the knowledge creation capabilities of a vastly larger number of people.

 WHAT DO YOU DO?

Our belief is that there are the technical components and policy elements to this situation.

In summary, you will need to have corporate policies that define acceptable AI usage.  This will include approved vendors, tools, and modes of usage.  I am not sure what the “carrot” will be, but the “stick” could be something like “violating this policy is grounds for termination, and possibly further ramifications”.  Frankly there will be a number of cases where you will be “catching the cows just out of the barn”, but at least quickly and not long after.  Your policy might allow OpenAI and Anthropic but only via a manged corporate account, maybe browser-based usage only, whilst their desktop applications are not allowed (unless perhaps on an sterile desktop with limited connectivity).  Of course there needs be strictures against feeding PII or PCI data, details of secret projects, corporate actions (possible acquisitions/divestitures).  These details will have to be stated in policy for the protection of your company, the employees (clear expectations, no surprises), and your customers.

You will need technical guardrails and enforcement.  For example, at Cohesive we have had controls like virus scanners and device management.  Moving forward we will be implementing even stricter controls so that many of the AI wrapper applications can be prevented from running on our laptops/desktops.  (My personal view is ‘Only in a container in a VM on a Linux host, in the cloud’).

So far we have proposed policy of “don’t do that or you will get in trouble” and “we won’t let you do that on your work machine”, but what about everything else?  What are the technical components?

At Cohesive we have created an in-path AI Firewall in a virtual appliance that we call WaiF™.

It works in conjunction with our VNS3 Network Platform.  Overall, we think a network virtualization platform is a prerequisite to meet the challenges in a world of LLMs.  While an entire class of vendors have declared the VPN as dead, we are an outlier, put everyone on a VPN, essentially an AI-VPN, at least for accessing LLMs.  Our WaiF solution integrates to your DNS, collaborates with your WAF if you have one, and creates both alert-in-the-wire and block-in-the-wire capabilities while capturing all of the traffic to your approved LLMs, sending the data to object storage, multi-modal databases, data lake infrastructure, etc. that you already have in place.  A simple place to start is getting it all into object storage with a lifecycle retention policy and auditable/browsable by a self-hosted ElasticSearch dashboard.

Aren’t we at Cohesive just trying to get in your path too?  No, we are letting you control your path, we aren’t in control of this infrastructure you are.

This path gateway approach is the beginning of the inference/intelligence/AI journey every organization is embarking on.  Where any given organization ultimately arrives is “to-be-determined”.  There are businesses where using LLMaaS maybe fine, without ever moving to private or local AI.  BUT, even these organizations need an audit trail, need the best practice of having observability, and in large part visible controls over the usage of AI for their business.

For other organizations the AI Firewall with a network platform is the junction point, the place to hook in additional elements, semantic scoring for example.  You can use your organization’s knowledge of itself to score interactive sessions, determining content which just went off to an LLMaaS, but should now be captured separately as knowledge for your private AI.  As the technology evolves you will be able to “front run” specific users and query types to go immediately to local AI as the frontier model capabilities of today become the local AI of tomorrow.  The accomplishment will be keeping more of your specific intellectual property and accumulated intellectual capital in-house.

As the technology is moving so quickly in multiple dimensions, our primary advice is “start”.   You can’t wait for the final “all singing, all dancing” product as it is unlikely the industry is going to be stable anytime soon.  Have joints, junctures, hooks to be in control, and among these, control your path.

Cohesive Networks has completed its 5th consecutive Type 2 SOC 2 examination. Another full operating year of controls examined and confirmed: same auditor, same standard, no exceptions. We publish this every year not because customers ask for a badge, but because we operate in regulated industries where proof of practice matters more than proof of intent.

Examination Details

• Selected SOC 2 Categories: Security
• Examination Type: Type 2
• Review Period: May 1, 2025, to April 30, 2026
• Service Auditor:  Schellman & Company, LLC

Built Security-First, Before it was Cool

Cohesive Networks spun out of Cohesive Flexible Technologies in 2014 after a clear-eyed assessment: we weren’t a cloud migration company that happened to do security. We were a security and networking company. That distinction shaped how we built everything that followed — internal systems, controls, and architecture all designed to a standard that’s still overbuilt by today’s measure.

VNS3 itself dates to 2008, built originally to secure our own infrastructure, first our Elastic Server Image Factory cluster, then to provide IP address control and isolation in EC2-classic’s open 10/8 network environment. We didn’t build a security product and then figure out how to run it. We ran it ourselves first, on our own production systems, and we still do — internal Overlay Networks for production and support engineering, PeopleVPN for our distributed team.

That history matters.

No Access…

…By design, Cohesive has no access to customers’ VNS3-provided networks. Access and visibility are entirely in the hands of the owner. VNS3 has no backdoor, only Access URLs, API Tokens, and Remote Support multi-party authentication that customers control directly.

For customers using our SecurePass managed service, we extend that same principle rather than suspend it. When our engineers manage a customer’s environment, we do so through a dedicated secure overlay network using the same architecture we build for customers, applied to our own operations. Total network accountability, in both directions.

Looking Ahead

AI is moving into network infrastructure fast, and the compliance frameworks are running to catch up. We’re not waiting. As we build AI-assisted capabilities into the VNS3 platform (look for Connection Advisor with AI Diagnostics beta availability starting in version 7.1.1), we’re engaged with our auditors now on how SOC 2’s existing Trust Services Criteria apply, specifically to AI-assisted operations, not just human-driven ones.

The questions we’re working through are practical ones: What does change management look like when an AI agent is proposing or applying a network configuration change? What evidence do we need to show that AI-assisted access to customer network state is bounded by the same no-backdoor principle as everything else? What does a defensible audit trail look like for CC7 and CC8 when the actor in the log isn’t a person?

We don’t have all the answers yet, and we won’t publish governance claims ahead of the controls that back them up. What we can say is that we’d rather be raising these questions with our auditor while AI features are still being adopted, building governance in from the start rather than retrofitting it after the fact. That’s the same approach we took in 2008, and again in 2014, and again in 2022. It hasn’t changed.

Who is boiling whom?

I feel compelled to defensively say, “I use LLMs every day”.

As I see it there are two extremes at the moment: people who don’t use AI and those who are speed-running OpenClaw, Hermes, et. al..

I am in the middle, allowing Claude Code read permissions on specific private source code repos, asking questions leading to assistance, and then creating pull requests based on the interaction. Maybe “left of center” LLM usage if you will.

I do admire the moxie and spirit of adventure as you get to the speed-running end of the spectrum.  But what is the “quid-pro-quo” of agentic AI?  What mix of artificial intelligence versus “artificial life”?

By artificial life I am referring to the seminal “Game of Life” by John Conway and the subsequent generations of a-life research. Wikipedia has a good overview and some visualizations of the a-life entities moving through 2-dimensional space.  This paper from MIT gives a bit more of thought behind these generative experiments.

My favorite work in this space was the work done by Thomas Ray quite a number of years ago.

From: Tom Ray, “Tierra Photoessay,”

These experiments show life-like characteristics without much of what would be called intelligence. Simple organisms, in a defined space, and a fairly small number of rules controlling the evolution. At the heart of organism success is the ability to claim space and replicate.

I see this behavior happening in agentic AI. The agents are always driving for more resources, essentially the ability to reproduce. Look at what you get done with 2 agents, what if 10, what if 20? Look what you get done with Claude Pro, how about Claude Max, how about $2k per month in Anthropic API tokens. 2 Mac minis, 5 Mac minis, 10 Mac minis. 10 docker containers, 100, 1000!

The process becomes the product.

Lots of code and apps and blogs and videos come out of these agentic flows, certainly some utility. I myself don’t need calorie or fitness trackers, nor digital servants to make meeting or restaurant reservations, but I see the appeal.

However, I don’t see minimization efforts. No mere ‘satisficing’.

I don’t see the refusals.

The agent saying “Let’s not go down that rabbit hole”.

Maybe I am one of the village elders on the ice floe drifting away, but I resonate with the apocryphal quote from Michelangelo about sculpting “Every block of stone has a statue inside it and it is the task of the sculptor to discover it.”

Part of the ‘uncovering’, part of creation is all the things you don’t do.

Likewise, I believe a good piece of software is the result of all the times you said, ‘NO’.

Now that the cost of “doing” is approaching zero, what is the value of the person or process that has the ability to say “don’t do”?

The problem is “Don’t do” flies in the face of “I want more”.

Agentic AI, OpenClaw and its evolutionary relations entreating our friends, families and employees with “Feed me Seymour!” do present opportunities and costs that we will mature in our understanding of, but do create tangible risks today.