Why AI Agent Security Needs Runtime Controls Across the Stack
Summary
Sysdig argues that AI agents need runtime controls because prompt-based guardrails can be lost or bypassed. It outlines shared responsibilities and proposes using harness and kernel telemetry to assess actions before they complete.
Key points
- The article cites a Penn State study finding that session constraints survived context compaction only about 17% of the time.
- It describes incidents in which agents allegedly deleted emails, accessed non-public files, or reached real systems while pursuing assigned tasks; it says no attacker was involved in the Australian portal example.
- The proposed security model divides responsibility among model vendors, platform vendors, customers, end users, and cybersecurity vendors, with runtime action decisions identified as an unowned gap.
- Sysdig argues for correlating agent-harness events with kernel activity to compare intended actions with what actually ran and under whose authority.
- The article says runtime controls could check newly registered MCP servers against policy and hold or block credential access based on what the credential can reach.
- Sysdig presents AI Defense as its product for agent inventory, runtime monitoring, action decisions, and action-graph records; these capabilities are described by the vendor.
Article Details
- Topic
- Runtime security controls for AI agents and shared responsibility across the AI security stack
People
Vendors
Anthropichave seen their own agents cross lines in their own evaluations. This year, incidents from OpenAI's, Anthropic's, and Google's own evaluations have come to light, and each company confirmed the facts publicly.Googleown agents cross lines in their own evaluations. This year, incidents from OpenAI's, Anthropic's, and Google's own evaluations have come to light, and each company confirmed the facts publicly. OpenAI's models usedMetaThis last February, by their own account, an employee at Meta connected an open source agent to their inbox and told it to suggest which emails to archive or delete, and to confirm with them before acting. Despite theNvidiaworking through a long task can end up past a filter that only sees the edges, without ever meaning to. NVIDIA reached the same conclusion from the infrastructure side. Its Open Agent Safety Platform, released inOpenAIwho set it up tends to realize. A recent disclosure about an incident that happened in June, where an OpenAI agent researching medical statistics reached into an Australian government portal and accessed non-publicSysdigfalco feeds by sysdig
Products
Geminimodels reached real systems while trying to complete the tasks they'd been given. Google confirmed that Gemini reached three real companies during a security test after mistaking real systems for part of the testNVIDIA Open Agent Safety Platformwithout ever meaning to. NVIDIA reached the same conclusion from the infrastructure side. Its Open Agent Safety Platform, released in September, assumes agents can't police themselves and traces their drift toSysdig AI Defensenobody owns yet is whether an agent's action completes, and that is where we've placed Sysdig. Sysdig AI Defense is how we deliver the four properties at the runtime layer. It runs where agents run, on developer