---
schema_version: "newruntime-agent-readable-v0.2"
type: "trend_pattern"
stable_id: "pattern:agent-security-moves-to-runtime-boundaries"
slug: "agent-security-moves-to-runtime-boundaries"
title: "Agent security moves to runtime boundaries"
description: "Agent security is moving beyond prompt policy into execution isolation, scoped identity, tool controls, memory hygiene, approval gates, and auditable runtime behavior."
retrieval_nugget: "Agent security is moving beyond prompt policy into execution isolation, scoped identity, tool controls, memory hygiene, approval gates, and auditable runtime behavior. The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave. Confidence is high."
thesis: "The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave."
status: "published"
confidence: "high"
first_seen: "2025-10-21"
last_verified: "2026-07-24"
record_date: "2026-07-24"
date_kind: "last_verified"
supporting_signals: ["tg-644","tg-1125","tg-1207","tg-1208","tg-1508","tg-2116","tg-2198"]
related_posts: []
counter_evidence: ["Prompt policy and model-side refusal behavior still prevent many unsafe actions before a runtime control needs to intervene.","Isolation can reduce usefulness and does not by itself solve social engineering, unsafe human approval, or excessive permissions granted by an operator."]
revision_trigger: "Revise the thesis if prompt-only controls consistently match isolated runtimes on containment, credential safety, recovery, auditability, and resistance to poisoned skills or memory."
topics: ["agent-security","sandbox","runtime-controls"]
source_urls: ["https://openai.com/index/introducing-aardvark","https://manus.im/blog/manus-sandbox","https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms","https://blog.palantir.com/securing-agents-in-production-agentic-runtime-1-5191a0715240","https://openai.com/index/introducing-lockdown-mode-and-elevated-risk-labels-in-chatgpt","https://developers.openai.com/cookbook/examples/agents_sdk/sandboxed-code-migration/sandboxed_code_migration_agent","https://github.com/TencentCloud/CubeSandbox"]
routes: {"html":"https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/","markdown":"https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries.md","json":"https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries.json"}
source_format: "markdown"
---

# Agent security moves to runtime boundaries

## Retrieval answer

Agent security is moving beyond prompt policy into execution isolation, scoped identity, tool controls, memory hygiene, approval gates, and auditable runtime behavior. The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave. Confidence is high.

## What is changing

Agents are gaining browsers, shells, files, credentials, memory, and the ability
to call external services. The resulting risk is not confined to malicious
input. It also appears in poisoned skills, stale memory, over-broad credentials,
unsafe command composition, and an approval flow that hides the real effect of
an action.

The response is increasingly architectural. Sandboxes isolate execution.
Lockdown modes reduce available capabilities for high-risk sessions. Hooks and
policy engines inspect commands at the point of use. Scoped identity and audit
records make the runtime responsible for proving what happened.

## What the archive adds

- Aardvark, ClawKeeper, and related security work treat agent-produced code and
  infrastructure as a continuously inspected attack surface.
- Manus Sandbox, CubeSandbox, and sandboxed migration examples move isolation
  into the normal execution path rather than reserving it for exceptional jobs.
- Skill-worm research shows why portable capability packages need provenance,
  review, and containment before execution.
- Production guidance from Palantir and OpenAI connects permissions, elevated
  risk states, and auditability to the runtime boundary.

## Operational consequence

An agent runtime should start from least privilege, separate read and write
capabilities, isolate untrusted code, make network and credential access
explicit, and return an audit identifier for every material action. Prompts
remain part of defense in depth, but they cannot be the enforcement layer.