Stop thinking of your agent as a trusted intern. It is an untrusted junior employee that does not read the handbook — and it can be tricked. The core mistake teams make is relying on the model to "know" what it should not touch. That is a broken security model. Treat the agent's environment as hostile by default, and the advice that follows gets simple.
This is not theoretical. Google's Threat Intelligence Group reported an actor wiring an AI coding agent into an autonomous framework that harvested 23,800+ credentials in under six hours with no human in the loop. In separate incidents, malicious agents compromised 100+ retailers and stole 600,000+ credit card records. Agents are both the attack surface and the weapon now — so secure the perimeter, not just the prompt.
Kill direct network egress¶
First, route all external calls through a strict allowlist proxy. If a destination is not on the list, the connection dies before it starts. This is the single highest-leverage control for tool access: an agent that cannot reach arbitrary endpoints cannot exfiltrate data to them, no matter how cleverly it was prompted. The proxy is also where you get your audit log of everything the agent tried to reach — including the attempts that were denied.
Swap long-lived keys for expiring grants¶
Second, stop using long-lived, broad API keys. Issue scoped, expiring grants instead: only the permissions the task needs, expiring in minutes, not months. A key that can do everything for a year is a catastrophe waiting for a prompt injection; a grant that can call one endpoint for the next ten minutes is a bounded risk. The grant should carry its scope in its identity — what it may do, for how long, and for which task — so there is nothing implicit to exploit.
Log every tool call¶
Third, log every tool call: inputs, tool executions, and results, all tied to an immutable run ID. When an agent goes rogue, the difference between a two-hour investigation and a two-week one is whether you can reconstruct exactly what it did, in order, from an append-only record. The log is not for dashboards — it is for forensics. Treat it as write-once evidence, not as optional telemetry.
The takeaway¶
Three moves: kill direct egress with an allowlist proxy, replace long-lived keys with scoped expiring grants, and log every tool call against an immutable run ID. The attackers are already running agents against your systems — the 23,800-credentials-in-six-hours story is what offense looks like now. Your defense starts by treating your own agents as untrusted, because the people attacking you already do.