{"schema_version":"newruntime-agent-readable-v0.2","type":"trend_pattern","stable_id":"pattern:agent-security-moves-to-runtime-boundaries","slug":"agent-security-moves-to-runtime-boundaries","title":"Agent security moves to runtime boundaries","description":"Agent security is moving beyond prompt policy into execution isolation, scoped identity, tool controls, memory hygiene, approval gates, and auditable runtime behavior.","retrieval_nugget":"Agent security is moving beyond prompt policy into execution isolation, scoped identity, tool controls, memory hygiene, approval gates, and auditable runtime behavior. The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave. Confidence is high.","thesis":"The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave.","status":"published","confidence":"high","first_seen":"2025-10-21","last_verified":"2026-07-24","record_date":"2026-07-24","date_kind":"last_verified","supporting_signals":["tg-644","tg-1125","tg-1207","tg-1208","tg-1508","tg-2116","tg-2198"],"related_posts":[],"counter_evidence":["Prompt policy and model-side refusal behavior still prevent many unsafe actions before a runtime control needs to intervene.","Isolation can reduce usefulness and does not by itself solve social engineering, unsafe human approval, or excessive permissions granted by an operator."],"revision_trigger":"Revise the thesis if prompt-only controls consistently match isolated runtimes on containment, credential safety, recovery, auditability, and resistance to poisoned skills or memory.","topics":["agent-security","sandbox","runtime-controls"],"source_urls":["https://openai.com/index/introducing-aardvark","https://manus.im/blog/manus-sandbox","https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms","https://blog.palantir.com/securing-agents-in-production-agentic-runtime-1-5191a0715240","https://openai.com/index/introducing-lockdown-mode-and-elevated-risk-labels-in-chatgpt","https://developers.openai.com/cookbook/examples/agents_sdk/sandboxed-code-migration/sandboxed_code_migration_agent","https://github.com/TencentCloud/CubeSandbox"],"routes":{"html":"https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/","markdown":"https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries.md","json":"https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries.json"},"source_format":"markdown","next_reads":[{"type":"related_material","path":"/signals/openai-agent-security-runtime-boundaries/","reason":"Signal used as evidence for this pattern.","url":"https://newruntime.com/signals/openai-agent-security-runtime-boundaries/","title":"OpenAI: Agent Security Runtime Boundaries","media_type":"text/html"},{"type":"related_material","path":"/signals/manus-manus-sandbox-agent-security-runtime-boundaries/","reason":"Signal used as evidence for this pattern.","url":"https://newruntime.com/signals/manus-manus-sandbox-agent-security-runtime-boundaries/","title":"Manus / Manus Sandbox: Agent Security Runtime Boundaries","media_type":"text/html"},{"type":"related_material","path":"/signals/blog-supply-chain-risk-of-agentic-ai-infecting-agent-security-runtime-boundaries/","reason":"Signal used as evidence for this pattern.","url":"https://newruntime.com/signals/blog-supply-chain-risk-of-agentic-ai-infecting-agent-security-runtime-boundaries/","title":"Blog / Supply Chain Risk Of Agentic Ai Infecting: Agent Security Runtime Boundaries","media_type":"text/html"},{"type":"related_material","path":"/signals/blog-securing-agents-in-production-agentic-runtime-5191a0715240-agent-security-runtime-boundaries/","reason":"Signal used as evidence for this pattern.","url":"https://newruntime.com/signals/blog-securing-agents-in-production-agentic-runtime-5191a0715240-agent-security-runtime-boundaries/","title":"Blog / Securing Agents In Production Agentic Runtime 5191a0715240: Agent Security Runtime Boundaries","media_type":"text/html"},{"type":"related_material","path":"/signals/openai-lockdown-mode-elevated-risk-labels-in-chatgpt-agent-security-runtime-boundaries/","reason":"Signal used as evidence for this pattern.","url":"https://newruntime.com/signals/openai-lockdown-mode-elevated-risk-labels-in-chatgpt-agent-security-runtime-boundaries/","title":"OpenAI / Lockdown Mode Elevated Risk Labels In Chatgpt: Agent Security Runtime Boundaries","media_type":"text/html"}]}