Security

An agent that reads untrusted content and can also call tools is a new attack surface, and most of the controls teams already have are aimed at the wrong layer. Content filters watch what the agent says. Nothing watches what it does. The essays under this tag are about that second thing: the actions, the credentials behind them, and the code and skills an agent is willing to run.

The frame I use is least privilege applied to a system that generates its own instructions at runtime. Treat everything the agent reads as data, not commands. Give it scoped, short-lived credentials instead of one shared API key. Run the code it writes in a box with no secrets and no egress. Put a policy gate between the model's intent and the side effect.

Read prompt injection defense first, because it sets up the trust boundary everything else depends on. Then action authorization as policy-as-code for the gate on what the agent does, and code execution sandboxing for the case where the agent writes and runs its own code.