I recently went over two articles from March-May 2026 that highlight how we must always assume that aligned models can make unexpected decisions. Perplexity’s Security Considerations for Artificial Intelligence Agents develops a layered defense strategy; Christodorescu et al.’s
Agent Security Is a Systems Problem treats the model as untrusted and enforce security invariants outside it.
A boundary that holds only when the model correctly interprets an instruction or recognizes an attack is a behavioral expectation, not an enforceable restriction. Moving enforcement outside the model is necessary, but letting the same untrusted model freely define its own policy would recreate the original dependency. The articles recognize open research problems including verifiable translation of user’s intent from natural language into enforceable constraints.
Taking the untrusted model assumption seriously changes how we design agents. A model-generated tool call is a request for authority, not proof of authorization. These requirements become harder when the workflow itself emerges at runtime, rather than following a program whose resource needs are known in advance. There are excellent analogies in here for people working on code integrity, particularly dynamic/JITted code security.
Related designs explore how to enforce these boundaries: aflock places authorization and evidence generation in an external MCP server, while Grimlock uses eBPF-mediated sandbox boundaries and attested channels to enforce identity and constrain delegation outside agent code. Many of the projects I’m tracking in the bureado/awesome-agent-runtime-security collection are attempting to tackle this angle.
The core idea in Grimlock is separation of concerns for high-agency systems: agent code handles orchestration, while the sandbox
substrate enforces identity, authentication, authorization, provenance, and least-privilege delegation. Much of this is established security architecture; what I found
interesting is how the pieces are composed while leaving agent code unchanged.
eBPF provides no-bypass, application-transparent mediation at the sandbox boundary and associates ordinary socket flows with stable sandbox identities. Guard-to-guard
communication uses TLS 1.3 with kTLS for the data plane, allowing authentication context and longer-lived channels to amortize setup costs.
Post-handshake attestation is of special note. TLS exporters bind fresh TEE evidence to an already-established channel, including nonce, audience,
and requested delegation scope. Successful appraisal produces short-lived, channel-bound Scope Tokens that the destination guard revalidates before releasing plaintext to
the destination sandbox.
Beyond Zero: Enterprise Security for the AI Era establishes that the application is no longer a sufficient trust boundary. Beyond Zero
pushes authorization down to individual actions on individual resources, with contextual risk decisions running at machine speed. What’s new since BeyondCorp is fusing
static authorization guarantees with dynamic AI reasoning without turning security into a fully probabilistic system.
The mechanism is essentially a continuous feedback loop: an enterprise security world model precomputes context about users, agents, roles, resources, and expected work;
event intake adds endpoint, server, and agent signals, including prompts, plans, and tool invocations; a hierarchical reasoning engine then feeds allow, deny, challenge,
or containment decisions directly back into authorization. Expensive inference is front-loaded so thousands of decisions per second can remain low-latency.
This also collapses the traditional separation between access management and security operations: investigations can happen continuously and immediately change the actor’s
“access bubble.” Challenges add granular friction under ambiguity; containments contract authority when risk increases. More broadly, this suggests that machine-speed
agentic systems may require security to become a closed-loop authorization system rather than a monitoring layer around applications.
aflock applies familiar ideas from SPIFFE/SPIRE, in-toto, capability systems, and policy engines to agent
execution. Rather than trusting an agent to report its own behavior, aflock moves authorization and evidence generation into an external MCP server. Agent identity is
derived from introspectable properties; short-lived JWTs convey authority; and the server signs attestations with keys the agent never sees.
Policies can constrain individual actions and cumulative properties of an execution trajectory. Session attestations are committed through a Merkle tree to provide
ordering and completeness evidence, while Rego evaluates cross-attestation constraints. Hierarchical sub-agent delegation uses in-toto-style sublayouts with mandatory
attenuation, so delegated authority cannot exceed the parent’s constraints.
The broader systems principle is compelling: securing autonomous agents may require treating execution trajectories much like software supply chains—externally
constrained, cryptographically recorded, and recursively verifiable—rather than relying on the agent itself to enforce or describe its boundaries.
I maintain
Awesome Agent Runtime Security,
a Linux-focused curation of long-form writing, specifications, and technologies
at varying levels of maturity. It collects approaches to kernel- and
hypervisor-enforced agent isolation, secrets injection, and deriving
credentials from an agent’s measured state.