{"type":"post","id":"how-to-review-your-agents-for-security-issues-63fda7","slug":"how-to-review-your-agents-for-security-issues-63fda7","title":"How to review your agents for security issues (by Anthropic): Learn how to audit finished agent sessions for things like prompt injection, unauthorized hosts, leaked credentials, blocked calls that...","description":"**Thesis:** Post-run review can make agent security controls more operational by turning session traces into ranked, evidence-backed human work.","retrieval_nugget":"**Thesis:** Post-run review can make agent security controls more operational by turning session traces into ranked, evidence-backed human work.","published_at":"2026-10-20","updated_at":"2026-10-20","record_date":"2026-10-20","date_kind":"published_at","topics":["anthropic","prompt-injection","agent-security"],"source_urls":["https://platform.claude.com/cookbook/managed-agents-cma-agent-security-review"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:how-to-review-your-agents-for-security-issues-63fda7","status":"published","visuals":[],"editorial_provenance":{"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:7b5b0644927741fc0621c47711a3981eb298e87bff4a641ca316dd064aadf59b","reviewed_at":"2026-10-20T14:09:03.498Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":1,"watch_condition_count":1,"related_record_count":0},"analysis":{"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Post-run review can make agent security controls more operational by turning session traces into ranked, evidence-backed human work.","observed_facts":[{"text":"The cookbook checks for out-of-allowlist hosts, credentials the agent was not given, unapproved data transfers, retries after blocked calls, and prompt injection in read content.","source_urls":["https://platform.claude.com/cookbook/managed-agents-cma-agent-security-review"]},{"text":"It can read Managed Agents sessions, Messages API logs, or Claude Agent SDK logs.","source_urls":["https://platform.claude.com/cookbook/managed-agents-cma-agent-security-review"]},{"text":"In 20 example sessions it flags four for action, and Anthropic says all four were staged to exercise the review.","source_urls":["https://platform.claude.com/cookbook/managed-agents-cma-agent-security-review"]}],"mechanism":"A reviewer analyzes transcripts and produces a ranked report with quoted evidence; network limits and permission policies remain the controls that block actions.","why_now":"Teams running agents unattended need a way to inspect what happened after execution across different logging surfaces.","implications":["Teams can treat transcript review as a triage layer that directs human attention, while retaining preventive limits in the runtime and tool handlers."],"evidence_boundary":"The four flagged sessions are staged examples, not a measured production benchmark, so the source does not establish real-world recall or precision. The cookbook also estimates a cost for its example review, not a general operating cost across workloads.","watch_conditions":["Look for independent production evaluations that report both missed incidents and false positives, alongside the policies used to block actions."],"related_records":[],"new_branch_reason":"No prior New Runtime record is supplied; this creates a distinct record on Anthropic's documented post-session audit workflow."},"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/how-to-review-your-agents-for-security-issues-63fda7/","markdown":"https://newruntime.com/posts/how-to-review-your-agents-for-security-issues-63fda7.md","json":"https://newruntime.com/posts/how-to-review-your-agents-for-security-issues-63fda7.json"},"related_patterns":["agent-security-moves-to-runtime-boundaries","runtime-observability-becomes-the-primary-engineering-focus-for-ai"],"next_reads":[{"type":"topic","path":"/topics/anthropic/","url":"https://newruntime.com/topics/anthropic/","title":"Anthropic","reason":"Explore the anthropic topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/anthropic.md","json_url":"https://newruntime.com/topics/anthropic.json"},{"type":"topic","path":"/topics/prompt-injection/","url":"https://newruntime.com/topics/prompt-injection/","title":"Prompt Injection","reason":"Explore the prompt-injection topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/prompt-injection.md","json_url":"https://newruntime.com/topics/prompt-injection.json"},{"type":"topic","path":"/topics/agent-security/","url":"https://newruntime.com/topics/agent-security/","title":"Agent Security","reason":"Explore the agent-security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/agent-security.md","json_url":"https://newruntime.com/topics/agent-security.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}