Evidence-linked trend hypothesis
Agent security moves to runtime boundaries
Agent security is moving beyond prompt policy into execution isolation, scoped identity, tool controls, memory hygiene, approval gates, and auditable runtime behavior.
Current thesis
The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave. Confidence: high. Supported by 26 normalized raw signals. This New Runtime record is an evidence-linked retrieval unit.
Source ledger
Publishable sources attached to this record.
| # | Source | Role | Public status |
|---|---|---|---|
| 1 | openai.comsource | primary receipt | source_urls |
| 2 | manus.imsource | supporting receipt | source_urls |
| 3 | blog.lukaszolejnik.comarticle | supporting receipt | source_urls |
| 4 | blog.palantir.comarticle | supporting receipt | source_urls |
| 5 | openai.comsource | supporting receipt | source_urls |
Showing 5 of 7; the complete set is exposed in the JSON route.
What is changing
Agents are gaining browsers, shells, files, credentials, memory, and the ability to call external services. The resulting risk is not confined to malicious input. It also appears in poisoned skills, stale memory, over-broad credentials, unsafe command composition, and an approval flow that hides the real effect of an action.
The response is increasingly architectural. Sandboxes isolate execution. Lockdown modes reduce available capabilities for high-risk sessions. Hooks and policy engines inspect commands at the point of use. Scoped identity and audit records make the runtime responsible for proving what happened.
What the archive adds
- Aardvark, ClawKeeper, and related security work treat agent-produced code and infrastructure as a continuously inspected attack surface.
- Manus Sandbox, CubeSandbox, and sandboxed migration examples move isolation into the normal execution path rather than reserving it for exceptional jobs.
- Skill-worm research shows why portable capability packages need provenance, review, and containment before execution.
- Production guidance from Palantir and OpenAI connects permissions, elevated risk states, and auditability to the runtime boundary.
Operational consequence
An agent runtime should start from least privilege, separate read and write capabilities, isolate untrusted code, make network and credential access explicit, and return an audit identifier for every material action. Prompts remain part of defense in depth, but they cannot be the enforcement layer.