Field note
Google's Agent Development Kit team published a zero-trust guide on 17 August built around a deliberately realistic target: an autonomous customer support and returns agent, written with ADK and Gemini, open-sourced with a runnable demo in a zero-trust-agents repository. The point of shipping the vulnerable thing is that defence patterns are only checkable against real exploits.
The argument underneath is about where the security boundary sits. A framework makes multi-tool autonomous workflows trivial to assemble, but the moment those sessions reach live databases, internal APIs and dynamic runtimes, the agent stops generating text and starts mutating production state: issuing refunds, modifying records, executing code. Because the model determines its own execution path in unstructured natural language, traditional perimeter security is blind to how the agent behaves internally, so the controls have to sit on each action rather than at the edge.
That is precisely the conclusion this site reached in agent security moving outside the model and in AISI's incident being an authorization failure rather than a sandbox failure. The agent security hub keeps the cases together.
This is a vendor engineering post with an open repository, not an audited threat model or a measured comparison of defence patterns. The condition to watch is whether the repository accumulates reproduced exploits and their mitigations over time, because a zero-trust demo that stays at one scenario teaches a pattern rather than a boundary.