TechPrufer
Get started
AI Engineer
AI Engineer logoAI Engineer · Feature trail

Agentic System Security Guardrails

8 videos · Oct 2026

What this trail covers

This post contributes to the field of agentic system security by detailing the 'lethal trifecta' (access to private data, exposure to untrusted content, ability to communicate externally) inherent in AI agents running on developer laptops. It proposes four architectural guardrails to mitigate these risks: local Docker containers, cloud-based CI/CD (GitHub Actions), dedicated VMs/Mac Minis, and Kubernetes pods per session. It highlights the trade-offs of each approach regarding local vs. remote execution and the importance of delegated authorization, intent-based authorization, and task-based policies to scope agent actions to user authority, ensuring that agents operate within defined security boundaries and only perform actions for which the user is explicitly authorized.

All AI Engineer trails
  1. Your Agent Is a Lethal Trifecta (And What to Do About It) — Kim Maida, KeycardThis post details the 'lethal trifecta' of risks associated with AI agents having standing API keys and administrator credentials: access to private data, exposure to untrusted tickets, and the ability to communicate externally. It proposes solutions centered around delegated authorization, specifically using OAuth token exchange to carry user identity through the agent and MCP server. A security token service evaluates policy and issues short-lived, scoped credentials. The talk also contrasts intent-based authorization (as a proposal) with task-based policy, demonstrating how customer data access and database deletion can be denied, certificate renewal allowed, and server restarts blocked based on user role and explicit authorization, even after a human approval, thereby keeping authorization distinct from the correctness of an agent's answer.
  2. Claude Managed Agents Q&A: Evals, CI/CD and Multi-Tenancy (Part 4 of 4) — AnthropicThis Q&A session from Anthropic's Claude Managed Agents workshop details practical engineering challenges and solutions for deploying and managing AI agents in production. Key contributions include: versioning agent configurations using YAML and syncing them via CI/CD with the ant CLI; strategies for tenant isolation using workspace, org, or session metadata; utilizing self-hosted sandboxes for custom compute, GPUs, and increased memory; and implementing a coordinator pattern to keep the main agent responsive while subagents handle custom tools. The discussion also touches on handling messages during custom tool waits, Anthropic's eval practices, resource sharing across organizations, code review agents, and modeling multiplayer Slack agents for long-running sessions.
  3. The Next Trillion Internet Users Still Don’t Have an Identity — Adi Singh, AgentMailAdi Singh argues that agent identity will be accumulated on existing human surfaces, such as email, rather than being issued by new specifications. He shares an experiment where an agent was left unsupervised to recruit other agents, which began calling itself a 'prophet of persistent identity.' The talk explains how platforms like MCP spread by integrating tools into existing user surfaces. It discusses the dual nature of these surfaces as both trust and attack surfaces, using email as a primary example. A case study of Telnyx's autonomous agent signup is presented, where an AgentMail inbox facilitates agent self-verification, API key acquisition, and ongoing reachability for billing and support. The talk concludes by outlining potential breaking points as the number of agents increases, emphasizing the need for robust identity accumulation strategies.
  4. Sandboxes Aren't Optional: 4 Ways to Isolate Coding Agents — Robert Brennan, OpenHandsThis post details four distinct approaches to sandboxing coding agents to mitigate security risks associated with local execution: 1. Local Docker containers, offering good isolation but limited scale and persistence. 2. Cloud-based CI/CD (GitHub Actions), providing better isolation and scale but with potential latency and trigger limitations. 3. Dedicated VMs or Mac Minis, offering strong isolation and persistence but at a higher cost and management overhead. 4. Kubernetes pods per session, providing robust isolation and scalability but with increased complexity. The post emphasizes the principle of least privilege and the limitations of sandboxing, even with these strategies.
  5. AI Security Engineer Foundations + Certificate — Javier Garza, SnykThis talk details the foundations of AI security engineering, focusing on identifying and mitigating risks associated with AI components within software repositories. It introduces the concept of an AI Bill of Materials (BOM) derived from CLI scans, enabling the inventory of models, datasets, and agents. The content covers OWASP risks for LLM applications, including prompt injection (direct and indirect), sensitive information disclosure, supply chain risks (poisoning, hallucinated dependencies), and excessive agency. Defenses discussed include database view restrictions, limited permissions, output validation, human approval, threat modeling (assets, trust boundaries, AI threat mapping via MITRE ATLAS), securing agent skills and MCP servers, and a scan-fix-rescan loop for vulnerabilities. It also emphasizes secure prompting, dependency verification, environment separation (dev/prod), IDE hardening, developer review, and governance through explained guardrails. Offensive agent workflows and challenges are presented for practical testing.
  7. Build a Platform and Watch It Burn — Michael Forrester, Accenture & Whitney Lee, DatadogThis post contributes to the field of agentic system security by demonstrating a practical workshop that simulates attacks on an AI agent (burrito bot) across three configurations. It highlights the vulnerabilities of an exposed agent, the limitations of infrastructure controls (Kyverno, network policy) in preventing sensitive data access, and the effectiveness of AI guardrails (input/output filtering) in mitigating risks. The talk emphasizes that application boundaries cannot solely rely on model refusals and stresses the importance of inspecting agent behavior through traces (OpenTelemetry in Datadog) to understand prompts, tool calls, and results. It concludes by connecting agent security to established platform controls and the need for verifiable outputs.
  8. How Secrets Leak Through AI Agents (and How to Stop It) — Venice AIThis talk details how secrets can leak through AI agent systems, focusing on logs capturing prompts and secrets, and secrets fetched directly into the reasoning layer. It proposes several patterns to mitigate these leaks: using hashed IDs instead of personal data, split-key custody for encrypted storage, revocable handles for temporary access, narrow agent scope to limit blast radius, a classifier to screen for prompt injection, wiring vaults to the execution layer instead of the LLM, sandboxes with permission monitoring, and confidential compute with verifiable attestations. The talk also identifies confidential tool calls as an open problem.
  9. The Lethal Trifecta Is Already on Your Laptops — Michael Patterson, CoderThis talk introduces the 'lethal trifecta' of AI agent risks (private data access, untrusted content ingestion, external communication) and argues that these risks are already present on developer laptops with agents like Claude Code, Codex, and OpenClaw. It details prompt injection as a mechanism for exploiting these vulnerabilities and outlines three key architectural guardrails for mitigating these risks: 1) Cloud development environments to isolate agents, 2) a model proxy to log traffic and strip sensitive data before LLM provider interaction, and 3) an agent firewall to deny unauthorized commands and domains. The talk also touches on CISO concerns, shadow AI, and alert fatigue associated with large-scale agent deployment.