5 min read
Agent Security Model
Agent security is the control of context, capabilities, identity, side effects, and auditability around a non-deterministic actor that can use tools.
Source Tweet Artifacts
Core model
Classic app security protects code paths. Agent security also has to protect decision paths: what the model read, what it believed, what tools it could call, what authority those tools carried, and what side effects happened before a human noticed.
The practical security boundary has five layers:
| Layer | Security question | Local owner |
|---|---|---|
| Context | Can untrusted text steer the agent into unsafe action? | Brin - Agent Context Security, prompt-injection checks, source provenance |
| Capability | Which tools, MCP servers, CLIs, and remote agents are available? | Agent Capability Registry, MCP Registry, Capability Routing Map |
| Authority | What credentials, scopes, networks, and filesystem paths does a tool carry? | secrets policy, OAuth scopes, sandbox mounts |
| Execution | Where does untrusted code or tool work run? | MicroVM and Sandbox Isolation Architecture, Vercel/E2B/Dedalus sandboxes |
| Audit | Can an operator reconstruct the run and revoke/repair damage? | Agent Trajectory Evaluation, logs, traces, approvals |
OWASP's agentic-application work frames the risk shift similarly: agents introduce tool misuse, excessive agency, memory/context poisoning, insecure tool integration, and governance failures beyond ordinary prompt injection. Source: OWASP Agentic Applications Top 10, https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/, 2026-06-19
Threat taxonomy
| Threat | How it appears | Control |
|---|---|---|
| Prompt/context injection | A web page, issue, email, or tool result instructs the agent to ignore policy or leak data | Treat external context as hostile; annotate source trust; isolate instructions from observations |
| Tool confusion | Agent chooses the wrong overlapping capability or misreads a tool contract | Narrow tool surfaces; Tool-Calling Design; resolver routing; evals |
| Tool-trace leakage | Logs, WebSocket events, screenshots, or streamed tool results expose filesystem paths, .env contents, tool schemas, or internal capability names |
Redact traces before display; separate observability from secrets; safe-disclosure template; never treat path exposure as permission to read |
| Excessive authority | Read task has write credentials; dev task has prod secrets | Least privilege, scoped credentials, approval gates |
| Untrusted code execution | Agent runs repo scripts, package installs, or generated code | Sandboxes, network policy, filesystem isolation |
| Model access provenance | Agent routes through discounted, resold, or account-pooled model access | Provider provenance checks, account ownership checks, revocation path, billing anomaly monitoring |
| Memory poisoning | Bad facts enter persistent memory and influence future runs | Knowledge Compilation discipline; timelines; source citations; review before durable rules |
| Side-effect drift | Agent mutates state outside versioned systems | Production Safety, migrations, idempotency, audit logs |
| Opaque autonomy | Nobody can explain why the agent acted | traces, artifact retention, trajectory evaluation |
IRL comparison
| System / standard | Useful lesson |
|---|---|
| OWASP Agentic Applications Top 10 | Agent risks are specific to tool-using systems; treat tool authority and context as first-class attack surfaces. |
| NIST AI RMF Generative AI Profile | Risk management should track data provenance, human oversight, monitoring, incident response, and measured impact, not only model behavior. Source: NIST AI RMF GenAI Profile, https://www.nist.gov/itl/ai-risk-management-framework, 2026-06-19 |
| Golf - MCP Agent Security | Enterprise buyers need discover/govern/audit for MCP and agent connections. |
| Brin - Agent Context Security | Context scoring is complementary to guardrails; unsafe context is often the input that compromises the agent. |
| LangSmith Sandbox Auth Proxy | Keep credentials outside the sandbox while the proxy injects request auth and enforces outbound host/port policy. |
| Agent Machines | Persistent skilled workers need credential gates, sandboxed execution, and trajectory-level observability. |
Kevin policy
- Discovery is not approval. Registry presence never means a tool is trusted.
- Read-only should be the default authority tier.
- Any prod, billing, external-send, credential, or destructive operation needs an explicit gate.
- Tool results are observations, not instructions.
- Persistent memory writes require source and timeline discipline.
- Agent security claims must be backed by traces, tests, or reproducible policy checks.
- Cheap or resold model access is not automatically safe. The reviewed HN screenshot frames discounting as a mixture of pooled accounts, suspicious payment flows, and possible output or reasoning-trace resale. Verify provider provenance, account ownership, logging, data handling, terms, revocation, and billing anomaly controls before routing agent work through any reseller. Source: X/@GregKamradt, 2026-06-25; Source: Hacker News thread, 2026-06-25
- A leaked path, tool name, or streamed trace is evidence for a report, not authorization to fetch more. The reviewed Cursor/OpenAI artifact shows the right split: refuse file retrieval/exfiltration, then document the exposed tool capabilities and paths as an observability/security finding. A companion screenshot shows the failure mode: streamed output summarizing
.envand top-level files. Source: X/@sathuashrith, 2026-05-27; Source: local artifact review, 2026-07-03
The strong version: a capable agent should feel free inside a small, well-defined box. Making the box explicit is security engineering.
Timeline
- 2026-07-04 | Added LangSmith Sandbox Auth Proxy as a concrete authority-layer control: sandbox code can call external APIs through proxy-injected credentials while egress remains host/port policy. Source: LangSmith docs, 2026-07-04; Source: X/@LangChain, 2026-05-21
- 2026-07-03 | Added tool-trace leakage as a named threat after reviewing the Cursor/OpenAI artifact: safe refusal plus disclosure language is the right response; leaked WebSocket/tool traces and
.envsummaries are the system failure. Source: X/@sathuashrith, 2026-05-27; Source: local artifact review, 2026-07-03 - 2026-07-02 | Reviewed the local HN screenshot artifact and made model-access provenance a named threat row. Source: wiki/assets/x-bookmarks/2069968506951725419/image-01.jpg
- 2026-06-25 | Added grey-market token access as a provenance and billing-security risk, not a harmless cost lever. Source: X/@GregKamradt, 2026-06-25; Hacker News thread, 2026-06-25
- 2026-06-19 | Created from the wiki-wide coverage audit to connect agent guardrails, MCP governance, context security, sandboxing, production safety, and trajectory auditability. Source: whole-wiki concept review, 2026-06-19
Related Pages
24 pages link here
Agent Guardrails ArchitectureArchitectureAgent MachinesProjectsAgent Operating SystemArchitectureAgent2Agent (A2A)ConceptsBrain CapsulesMetacli-to-serverToolsConcept System MapConceptsDedalus AuthToolsDedalus SDKToolsDeepSeek APIToolsHuman-in-the-Loop ControlConceptsLangGraphToolsLangSmith Sandbox Auth ProxyToolsMCP as the Integration StandardConceptsOrigamiToolsProduction SafetyConceptsQuality Review StackToolsSantander AI Open SourceToolsTool-Calling DesignConceptsUnbrokerToolsVercel ConnectToolsVibecoding CritiqueConceptsWiki Concept Coverage MapMetaX Bookmarks: AI Agents & Tools (Jan 2025 – Jun 2026)Tools