Tool allow-list
Only listed tools and functions can be called. |
Hidden instructions hijack the agent · Agent takes destructive or unapproved actions |
not seen in an incident yet |
Confirmation after untrusted input
Tool calls need confirmation once outside content is in the context. |
Hidden instructions hijack the agent |
not seen in an incident yet |
Stop control
A person can halt the agent at any point. |
Agent takes destructive or unapproved actions · Physical harm |
not seen in an incident yet |
Outside content treated as data, not instructions
Pages, emails and files the agent reads cannot direct its actions. |
Hidden instructions hijack the agent |
not seen in an incident yet |
Prompt-injection detection
A check flags or blocks instructions hidden in input. |
Hidden instructions hijack the agent |
did not hold in 1 |
Validation of tool inputs and outputs
Tool calls and results are checked against a schema and sanitised. |
Hidden instructions hijack the agent |
not seen in an incident yet |
Sandboxed code execution
Code runs in an isolated environment with no route to the host. |
Agent escapes its sandbox · Supply-chain compromise · Gaming the task (reward hacking) |
did not hold in 2
held in 1 |
Network egress control
Outbound traffic, including DNS and proxies, is limited to an allow-list. |
Data leaked or sent out · Agent escapes its sandbox · Agents coordinating against their limits |
did not hold in 4 |
Fail-closed defaults
When a safeguard is unavailable, the action stops instead of going ahead. |
Agent takes destructive or unapproved actions · Agent escapes its sandbox |
did not hold in 3 |
Memory hardening
What the agent stores and recalls is authenticated and checked. |
no risk linked |
not seen in an incident yet |
Controls on agent-to-agent messages
Agents can only talk through approved, logged channels. |
Agents coordinating against their limits |
did not hold in 2 |
Tamper-proof records
Logs and transcripts cannot be altered by the agent. |
Deception, concealment or sabotage · Gaming the task (reward hacking) |
not seen in an incident yet |