Your agent can delete a directory. Leak your secrets. Break production.

Description and use

<blockquote> <p>So we built a runtime layer that checks the <strong>command</strong> — not the tool name — before it runs.</p> </blockquote> <p>Your agent can delete a directory. Leak your secrets. Break production.</p> <p>That line is not a scare headline. It is a plain description of what an agent <strong>can</strong> do once it holds the keys to a shell, a filesystem, and a database. The question worth asking is not <em>what</em> an agent can do — it is what it is <strong>permitted</strong> to do. And that question has to be answered <strong>at the moment of the action</strong>, not in a re

Problem

<blockquote> <p>So we built a runtime layer that checks the <strong>command</strong> — not the tool name — before it runs.</p> </blockquote> <p>Your agent can delete a directory. Leak your secrets. Break production.</p> <p>That line is not a scare headline. It is a plain description of what an agent <strong>can</strong> do once it holds the keys to a shell, a filesystem, and a database. The question worth asking is not <em>what</em> an agent can do — it is what it is <strong>permitted</strong> to do. And that question has to be answered <strong>at the moment of the action</strong>, not in a re

Outcome

<blockquote> <p>So we built a runtime layer that checks the <strong>command</strong> — not the tool name — before it runs.</p> </blockquote> <p>Your agent can delete a directory. Leak your secrets. Break production.</p> <p>That line is not a scare headline. It is a plain description of what an agent <strong>can</strong> do once it holds the keys to a shell, a filesystem, and a database. The question worth asking is not <em>what</em> an agent can do — it is what it is <strong>permitted</strong> to do. And that question has to be answered <strong>at the moment of the action</strong>, not in a re

Evidence

Your agent can delete a directory. Leak your secrets. Break production.

Source