Agentic AI Wiki
Deep-Dives / Agent Security

Agent Security

Securing a production agent end-to-end — injection defense, policy-as-code, identity and attestation, red-teaming, isolation, and the audit primitives that shipped in 2026.

  1. Prompt-Injection Defense in 2026
    Prompt injection is an unsolved frontier problem, not a bug you patch — the instruction hierarchy, defense-in-depth layers, and why the Gemini CLI CVSS-10 incident proves single-model defenses fail.
  2. Policy-as-Code for Agents
    OPA/Rego and Cedar gating every tool call at the boundary — where the PDP lives, failure-open vs failure-closed, and the structured PolicyDecision that makes refusals machine-readable.
  3. Agent Identity & Attestation
    Three complementary layers answer "which agent is calling me" — signed Agent Cards, runtime attestation (OATR), and Verifiable Credentials — plus Visa's RFC 9421 request signing for commerce.
  4. Red-Teaming Agents
    MCPTox showed a 36.5% average attack success rate across 20 models — with inverse scaling, where more capable models are more susceptible — and a three-paradigm methodology you can turn into a repeatable harness.
  5. Sandbox & Isolation Patterns
    Shared-kernel containers are no longer enough for agent-generated code — the 2026 tiers are microVMs (Firecracker, <150ms), gVisor userspace interception, and remote-only execution, chosen by blast radius.
  6. Structured Refusal & Why-Trails
    A prose refusal tells a user "no"; an enumerated refusal reason plus a why-trail tells a forensic investigator exactly which rule fired and why — the accountability primitive that a policy decision already hands you.
  7. Agent Supply-Chain Security
    The Gemini CLI CVSS-10 compromise is the canonical warning — a public GitHub issue chained through an auto-approve bypass to token exfiltration — and it generalizes to every MCP server you install without vetting.
  8. Decision Receipts & Audit
    A signed action envelope per tool call, stored in a hash-chained journal, turns an agent run into a tamper-evident record you can replay — the audit primitive that regulators (SR 26-2, EU AI Act Article 12) now expect.