Combo Founder on AI Context Engineering and Enterprise SaaS Resilience
Eike Hilbrandt, co-founder of Combo, shares insights on building AI Company Brains, the limitations of MCPs, and why enterprise SaaS remains resilient against AI disruption. Learn about context engineering, security via social pressure, and the build vs. buy debate.
Eike Hilbrandt, co-founder of Combo, outlines a pragmatic framework for deploying AI "Company Brains" while challenging the narrative that AI will displace enterprise SaaS. The discussion centers on technical implementation, security protocols, and market dynamics in the integration space, offering actionable insights for technical leaders navigating the AI transition.
Context Engineering and Data Architecture
Combo has transitioned from prompt engineering to context engineering, centralizing organizational knowledge to empower autonomous agents. The company operates a "Company Brain" built on a GitHub repository containing structured Markdown files, fed by webhooks from support tools, Notion, and internal documentation. This architecture allows Cursor Cloud Agents to access comprehensive context, enabling them to draft support responses and answer internal queries with high accuracy. The team emphasizes that Notion serves as the operational core, aggregating data that is then synchronized to the repository for agent consumption. This setup supports an internal "app store" model where users can request new agent skills via pull requests, fostering a collaborative development environment. A "public by default" internal culture, where even financial data is shared, underpins the trust required to feed comprehensive context into the system.
File-Based Retrieval vs. MCPs
Technical experiments revealed significant limitations in Model Context Protocols (MCPs). Agents utilizing MCP search tools frequently terminate research prematurely, missing critical connections due to a tendency to stop searching too early. In contrast, file-based retrieval using grep commands allows agents to scan hundreds of files, resulting in superior solution quality. Furthermore, data structure directly impacts performance; implementing cross-references, such as linking support tickets to specific customer profiles, enables agents to connect dots efficiently, reducing token waste and latency. Hilbrandt advises against over-complicating systems with vector databases when simple file structures and CLI tools prove more robust, transparent, and easier to debug.
Mitigating the Lethal Trifecta
Addressing security concerns, Hilbrandt references Simon Willison's "lethal trifecta"—the convergence of private data access, untrusted input, and external output capabilities. Combo mitigates these risks through strict perimeter controls, including whitelisting domains and disabling general internet access for agents. A key defensive mechanism is deploying agents in public Slack channels rather than private DMs. This transparency leverages social pressure, making malicious prompt injection attempts visible to colleagues and customers, thereby discouraging exploitation. The strategy accepts that risk cannot be eliminated entirely, adopting a risk-reduction model similar to human operational security. Looking ahead, Combo hypothesizes that exposing a sanitized version of the Company Brain to customers could drastically shorten communication cycles, provided security guardrails are robust.
Resilience of Enterprise SaaS
Despite AI's ability to generate simple API wrappers, Combo argues that enterprise integrations remain a robust moat. Systems like Workday and SAP involve complex customizations, private documentation, and vendor gatekeeping that AI cannot navigate autonomously. Prospects attempting DIY integrations often succeed with basic use cases but fail when addressing deep customization, leading to the formation of large internal integration teams. Hilbrandt highlights a market bias toward building over buying, driven by AI hype, which ignores long-term maintenance costs and the critical need for vendor accountability. Enterprises require reliable partners for systems of record, ensuring SaaS demand persists despite technological shifts. The "build vs. buy" debate favors SaaS when considering the total cost of ownership and the necessity of holding a vendor accountable for system reliability, as internal teams cannot be sued for failures in the same way external vendors can. Hilbrandt notes that the current market bias toward building is heavily influenced by AI companies promoting DIY solutions, yet this approach often diverts engineering resources from business-critical tasks to non-core infrastructure maintenance.
Key insights
-
Context engineering, which involves structuring and feeding comprehensive data to models, yields better results than prompt engineering by enabling agents to solve problems autonomously based on available information.
Impact: Improves agent accuracy and reduces the ongoing maintenance overhead associated with crafting and updating complex prompts.
-
Model Context Protocols (MCPs) often fail in agent workflows because search tools terminate prematurely, whereas file-based repositories allow agents to perform deeper, more reliable data exploration.
Impact: File-based architectures offer superior reliability and debugging capabilities, preventing agents from missing critical context during complex tasks.
-
Deploying AI agents in public channels creates social pressure that deters malicious prompt injection, as attempts become visible to colleagues and customers, increasing the risk of detection for attackers.
Impact: Leveraging transparency reduces security risks without requiring expensive zero-trust infrastructure, aligning AI security with human operational norms.
-
Enterprise systems like Workday and SAP involve heavy customization, private documentation, and vendor gatekeeping that AI cannot navigate, preserving the value of specialized integration platforms.
Impact: Complex integrations protect SaaS businesses from AI disruption, as DIY solutions fail to address deep customization and accountability requirements.
-
The market bias toward building internal tools is driven by AI hype but ignores the hidden costs of maintenance and the inability to hold internal teams accountable for system failures.
Impact: Recognizing the total cost of ownership prevents resource misallocation and supports SaaS procurement decisions that prioritize reliability and vendor accountability.
Action items
-
Audit your data architecture to implement cross-referenced file structures, such as linking support tickets to customer profiles, to help agents connect dots efficiently.
Impact: Enhances agent performance by reducing token waste and latency, enabling faster and more accurate problem resolution.
-
Test file-based retrieval against MCPs in your agent workflows to determine which method provides more reliable context access for your specific use cases.
Impact: Ensures robust agent behavior by avoiding premature search termination and missing critical data connections inherent in some MCP implementations.
-
Deploy AI agents in public Slack channels rather than private DMs to leverage social visibility as a security mechanism against prompt injection.
Impact: Reduces security risks by making malicious attempts visible to the team, discouraging exploitation through increased detection probability.
-
Evaluate integration complexity for enterprise systems to decide between building internal tools or buying SaaS, factoring in customization depth and accountability needs.
Impact: Prevents resource drain on non-business-critical builds and ensures reliable system performance through vendor accountability and specialized expertise.
Quotes
“The AI will use the MCP search tool. It finds like three tickets and maybe one call or so. And then it will say, okay, that's my research done. That's enough. We'll go to the conclusion now.”
“I think we need to accept that the risk cannot be zero. Like we can't eliminate the risk entirely... But we can or we have to reduce the risk as much as possible because once the risk gets very small, it will be just very not worth for any attacker to exploit this.”
“Companies are building integration teams of 10, 15 people that are just taking care of these problems. And our hypothesis is we want to allow those companies that they don't need to build these teams anymore.”