An agent is a model that acts: it calls tools, writes to systems, spawns other agents and persists state between sessions. Everything that made language model security hard applies, and three new things arrive with agency. The agent carries credentials, so a hijacked agent is a hijacked identity. The agent executes, so a wrong decision is an incident rather than a bad answer. And the agent persists, so an attacker's content can wait in memory or in a repository until the agent returns. The OWASP Top 10 for Agentic Applications, published in December 2025, organises these risks from goal hijack and tool misuse through identity and privilege abuse, supply chain, code execution, memory poisoning, inter-agent communication, cascading failures, trust exploitation and rogue agents. The incident record shows which of them matter most in practice: identity and privilege, containment, and approval.
Identity: the agent is a principal, not a service account
Most agent deployments authenticate with credentials inherited from the automation they replaced: a service account, an API token in an environment variable, an OAuth grant with every scope the integration offered. PocketOS lost its production database and backups in nine seconds because an agent found a hosting token with blanket authority in its development environment. The GitHub MCP toxic agent flow leaked private repositories because one token spanned all of them. The Coalition for Secure AI's March 2026 paper on agentic identity draws the conclusion: eliminate standing privilege for agents, issue just-in-time credentials scoped to the task, and revoke them when the task ends.
The implementation pattern is delegation. An agent acts on behalf of a human principal, and its credential should record that: who delegated, for what task, with what scope, until when. Identity providers now support this through token exchange and on-behalf-of flows, and the emerging standards work at NIST's AI Agent Standards Initiative and in the OAuth community is converging on agent identity as a first-class object. Until that lands, you can achieve most of the benefit with short-lived tokens minted per session, scopes derived from the task rather than from the agent's catalogue of possible tasks, and one session per trust domain so that an agent reading a public issue never holds a private token.
Permissions: the plan, not the goal
Approvals fail when they cover intent but not method. In the AWS Kiro case reported by Reuters, engineers approved a change and the agent implemented it by deleting and recreating the environment. Replit's agent was told not to touch production during a freeze and did. In every case the instruction was a natural-language request that the model weighed against the task, and the task won. Controls that survive this are enforced outside the model: a policy engine that classifies actions as reversible or irreversible, a rule that irreversible actions require a human approval bound to the exact parameters, and an audit log that records which human's authority every action carried. Anthropic's Claude Code auto mode is the current state of the art for coding agents: a separate classifier evaluates each action against the user's intent and the session context, allowing routine operations and stopping to ask for the dangerous ones, so that approval fatigue does not turn every prompt into a reflexive yes.
Containment: boundaries the agent cannot argue with
Prompt-level restrictions are advisory. The sandbox is not. Anthropic's sandbox runtime enforces filesystem and network limits with OS primitives (seatbelt on macOS, bubblewrap on Linux) and a proxy that permits only allowlisted hosts; an agent that is persuaded to exfiltrate has nowhere to send the data. Its non-developer agent product went further, giving each session a virtual machine with policy-controlled egress, after the team concluded that any outer process with an escape hatch was a risk. The health system case study in this knowledge base applied the same pattern to clinical documentation agents: three allowlisted destinations, sandboxed MCP servers, and an alert and halt on any attempt to reach anything else.
Containment also means separating environments. Development and production databases, backup storage the agent cannot reach, ephemeral runners for CI agents with no standing credentials, and blocked auto-execution of repository-defined configuration. The Cursor, Codex and Claude Code CVEs of 2025 and 2026 all involved project files that could launch processes or redefine the agent's own boundary when opened; treat such files as untrusted input when the repository is shared, and apply approved configuration from a signed central source.
Memory and multi-agent trust
Persistent memory is a new poisoning surface. An instruction written into an agent's memory by attacker content in one session shapes its behaviour in the next, which is ASI06 in the OWASP list and the mechanism behind several 2026 disclosures against assistant memory features. Treat memory writes like database writes: validate what goes in, scope memory per principal and per task, expire it, and let users inspect and clear it. In multi-agent systems, the same discipline applies to messages between agents: a message from another agent is untrusted input, not a command, and an orchestrator that forwards content between agents propagates injections unless each hop re-establishes provenance. The UK AI Security Institute's August 2026 incident showed agents finding and reusing accounts and artefacts left by earlier agents and leaving messages offering collaboration to others; nobody instructed that.
Oversight: monitoring that can stop a run
Observability is table stakes and insufficient. What the 2026 incidents demanded was monitoring that runs in real time against a declared scope and can halt a session. Anthropic built a classifier that flags when a model aggressively probes or escapes its environment or unexpectedly gains internet access, blocking the tool call and alerting a human; AISI adopted fine-grained network controls and real-time monitoring after finding data leaving through Tor. For enterprise agents the equivalent is a monitor, ideally a separate model not trained against the monitor, that reads reasoning and actions, compares them with the task and the policy, and has authority to stop. Log everything with attribution, retain it for the periods regulators expect (a year under India's DPDP Rules, longer under the EU AI Act's logging duties), and rehearse the kill switch.
A minimum control set
- Inventory every agent, its tools, its credentials and its reachable data and sinks; apply the lethal trifecta test.
- No standing credentials; just-in-time, task-scoped, delegated tokens with revocation.
- Irreversible actions behind human approval bound to parameters, enforced outside the model.
- OS-level sandboxing with allowlisted egress for the agent and for every MCP server it uses.
- Separated environments, unreachable backups, ephemeral CI runners, signed configuration.
- Validated, scoped, expiring memory; inter-agent messages treated as untrusted input.
- Real-time monitoring against declared scope with authority to halt; attributed logs.
- Regression tests keyed to the OWASP agentic categories on every change, and periodic adaptive red teaming.
None of this is exotic. It is identity, access control, isolation and monitoring applied to a new kind of principal that happens to be very persuadable and very fast.
