Security of the agentic stack
Trust boundaries, egress, secrets and adversarial pressure across the whole agentic and GenAI landscape.
Trust boundaries
Egress control
Adversarial testing of the whole path
The problem
Agent security is being discussed almost entirely at the model layer — jailbreaks, refusals, alignment — while the failures that actually land are ordinary. An identity scoped wider than its task. A tool that trusts its caller. Content that becomes instruction. Secrets reachable from a process that had no business holding them. These are decade-old failure modes, now driven by something that enumerates faster than any red team, never gets bored, and has no malicious intent to detect.
Where it breaks
| Failure point | What actually happens |
|---|---|
| Over-scoped non-human identity | An agent inherits whatever its identity can touch. If the credential reaches ten systems, so does the agent, whether or not its task involves nine of them. |
| Tools that trust their caller | A tool built for one internal service is now reachable by an agent that can be steered by text it retrieved. The tool's threat model was written before that was possible. |
| Content as instruction | Injection is not a prompt-writing problem. It is what happens when the control path and the data path are the same path. |
| Egress nobody is watching | Prompts and retrieved content leave the boundary as an ordinary API call. Data-loss tooling built for email and file shares does not see it. |
| Secrets in reach | A process that can read a config, an environment or a cache can spend anything in it. Short lifetimes and hard rotation are the only controls that survive harvesting. |
| Testing the model, not the path | Red-teaming the model tells you what it will say. The exposure is what the system will do — which is a property of tools, identity and egress, not of the model. |
Standards and regimes named on this page were last checked against their primary sources on . Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
What this actually consists of
- Non-human identity inventory and least-agency scoping — one identity, one task, bounded lifetime
- Trust-boundary mapping across the agent, its tools, its retrieval path and its egress
- Adversarial testing of the whole path rather than the model in isolation
- Detection tuned for lateral movement and privilege escalation, which is where an agent incident actually shows
- Rehearsed revocation: killing an identity mid-run, tested before the day it is needed
The test
Would anything you run today flag a service account that suddenly started moving between clusters? If the honest answer is no, that is the gap — and it is the gap that turned a sandbox escape into a breach.
Where does this sit in your estate?
The useful version of this conversation is specific — one workflow, one deadline, one thing you are not sure you could evidence. That is usually twenty minutes.