---
type: "post"
id: "how-to-review-your-agents-for-security-issues-63fda7"
slug: "how-to-review-your-agents-for-security-issues-63fda7"
title: "How to review your agents for security issues (by Anthropic): Learn how to audit finished agent sessions for things like prompt injection, unauthorized hosts, leaked credentials, blocked calls that..."
description: "**Thesis:** Post-run review can make agent security controls more operational by turning session traces into ranked, evidence-backed human work."
retrieval_nugget: "**Thesis:** Post-run review can make agent security controls more operational by turning session traces into ranked, evidence-backed human work."
published_at: "2026-10-20"
updated_at: "2026-10-20"
record_date: "2026-10-20"
date_kind: "published_at"
topics: ["anthropic","prompt-injection","agent-security"]
source_urls: ["https://platform.claude.com/cookbook/managed-agents-cma-agent-security-review"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:how-to-review-your-agents-for-security-issues-63fda7"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:7b5b0644927741fc0621c47711a3981eb298e87bff4a641ca316dd064aadf59b","reviewed_at":"2026-10-20T14:09:03.498Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":1,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Post-run review can make agent security controls more operational by turning session traces into ranked, evidence-backed human work.","observed_facts":[{"text":"The cookbook checks for out-of-allowlist hosts, credentials the agent was not given, unapproved data transfers, retries after blocked calls, and prompt injection in read content.","source_urls":["https://platform.claude.com/cookbook/managed-agents-cma-agent-security-review"]},{"text":"It can read Managed Agents sessions, Messages API logs, or Claude Agent SDK logs.","source_urls":["https://platform.claude.com/cookbook/managed-agents-cma-agent-security-review"]},{"text":"In 20 example sessions it flags four for action, and Anthropic says all four were staged to exercise the review.","source_urls":["https://platform.claude.com/cookbook/managed-agents-cma-agent-security-review"]}],"mechanism":"A reviewer analyzes transcripts and produces a ranked report with quoted evidence; network limits and permission policies remain the controls that block actions.","why_now":"Teams running agents unattended need a way to inspect what happened after execution across different logging surfaces.","implications":["Teams can treat transcript review as a triage layer that directs human attention, while retaining preventive limits in the runtime and tool handlers."],"evidence_boundary":"The four flagged sessions are staged examples, not a measured production benchmark, so the source does not establish real-world recall or precision. The cookbook also estimates a cost for its example review, not a general operating cost across workloads.","watch_conditions":["Look for independent production evaluations that report both missed incidents and false positives, alongside the policies used to block actions."],"related_records":[],"new_branch_reason":"No prior New Runtime record is supplied; this creates a distinct record on Anthropic's documented post-session audit workflow."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/how-to-review-your-agents-for-security-issues-63fda7/","markdown":"https://newruntime.com/posts/how-to-review-your-agents-for-security-issues-63fda7.md","json":"https://newruntime.com/posts/how-to-review-your-agents-for-security-issues-63fda7.json"}
related_patterns: ["agent-security-moves-to-runtime-boundaries","runtime-observability-becomes-the-primary-engineering-focus-for-ai"]
---

# How to review your agents for security issues (by Anthropic): Learn how to audit finished agent sessions for things like prompt injection, unauthorized hosts, leaked credentials, blocked calls that...

## Retrieval answer

**Thesis:** Post-run review can make agent security controls more operational by turning session traces into ranked, evidence-backed human work.

**Thesis:** Post-run review can make agent security controls more operational by turning session traces into ranked, evidence-backed human work.

Anthropic's cookbook describes a reviewer for completed agent sessions. **Observed facts:** It checks for out-of-allowlist hosts, credentials the agent was not given, unapproved data transfers, retries after blocked calls, and prompt injection in read content. It can read Managed Agents sessions, Messages API logs, or Claude Agent SDK logs. In 20 example sessions, it flags four for action, and Anthropic says all four were staged to exercise the review.

**Mechanism:** A reviewer analyzes transcripts and produces a ranked report with quoted evidence; network limits and permission policies remain the controls that block actions. **Why now:** Teams running agents unattended need a way to inspect what happened after execution across different logging surfaces. **First implication:** Teams can treat transcript review as a triage layer that directs human attention, while retaining preventive limits in the runtime and tool handlers.

**Evidence boundary:** The four flagged sessions are staged examples, not a measured production benchmark, so the source does not establish real-world recall or precision. The cookbook also estimates a cost for its example review, not a general operating cost across workloads.

**First watch condition:** Look for independent production evaluations that report both missed incidents and false positives, alongside the policies used to block actions. Whether this workflow improves real security outcomes remains unproven by the supplied source.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Prompt Injection](https://newruntime.com/topics/prompt-injection.md): Explore the prompt-injection topic hub.
- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)