---
id: "nr-agent-security-is-being-enforced-across-identity-network-and-execution-cb9eb4"
slug: "agent-security-is-being-enforced-across-identity-network-and-execution-cb9eb4"
type: "raw_signal"
title: "Agent security is being enforced across identity, network, and execution boundaries"
description: "Google’s deliberately exploitable refund agent illustrates the risk of relying on perimeter security when an LLM chooses its execution path, while Cloudflare describes layered MCP enforcement and Vercel’s sandbox challenge highlights the limits of microVM isolation without host-side network controls"
observed_at: "2026-09-13"
record_date: "2026-09-13"
date_kind: "observed_at"
novelty: "notable"
source_platform: "newruntime.com"
topics: ["google","mcp","agent-security"]
entities: []
related_patterns: []
source_url: "https://developers.googleblog.com/build-zero-trust-ai-agents-with-googles-agent-development-kit"
source_urls: ["https://developers.googleblog.com/build-zero-trust-ai-agents-with-googles-agent-development-kit","https://vercel.com/blog/one-million-dollar-hacker-challenge-for-vercel-sandbox","https://blog.cloudflare.com/mcp-security-updates/"]
why_it_matters: "Google’s deliberately exploitable refund agent illustrates the risk of relying on perimeter security when an LLM chooses its execution path, while Cloudflare describes layered MCP enforcement and Vercel’s sandbox challenge highlights the limits of microVM isolation without host-side network controls. Together, these notes suggest builders need defense in depth around agent actions, not just a trusted model or isolated runtime."
verification_level: "source-linked"
signal_type: "synthesis"
synthesis_of: [{"slug":"build-zero-trust-ai-agents-with-google-s-adk","title":"Build zero-trust AI agents with Google's ADK","url":"https://newruntime.com/posts/build-zero-trust-ai-agents-with-google-s-adk/"},{"slug":"vercel-opens-a-1m-dollar-sandbox-escape-challenge","title":"Vercel opens a 1M dollar Sandbox escape challenge","url":"https://newruntime.com/posts/vercel-opens-a-1m-dollar-sandbox-escape-challenge/"},{"slug":"cloudflare-mcp-detection-enforcement","title":"Cloudflare Adds a Network Enforcement Layer for MCP","url":"https://newruntime.com/posts/cloudflare-mcp-detection-enforcement/"}]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "signal:agent-security-is-being-enforced-across-identity-network-and-execution-cb9eb4"
retrieval_nugget: "Google’s deliberately exploitable refund agent illustrates the risk of relying on perimeter security when an LLM chooses its execution path, while Cloudflare describes layered MCP enforcement and Vercel’s sandbox challenge highlights the limits of microVM isolation without host-side network controls."
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/signals/agent-security-is-being-enforced-across-identity-network-and-execution-cb9eb4/","markdown":"https://newruntime.com/signals/agent-security-is-being-enforced-across-identity-network-and-execution-cb9eb4.md","json":"https://newruntime.com/signals/agent-security-is-being-enforced-across-identity-network-and-execution-cb9eb4.json"}
---

# Agent security is being enforced across identity, network, and execution boundaries

## Retrieval answer

Google’s deliberately exploitable refund agent illustrates the risk of relying on perimeter security when an LLM chooses its execution path, while Cloudflare describes layered MCP enforcement and Vercel’s sandbox challenge highlights the limits of microVM isolation without host-side network controls.

Google’s deliberately exploitable refund agent illustrates the risk of relying on perimeter security when an LLM chooses its execution path, while Cloudflare describes layered MCP enforcement and Vercel’s sandbox challenge highlights the limits of microVM isolation without host-side network controls. Together, these notes suggest builders need defense in depth around agent actions, not just a trusted model or isolated runtime.

From the Field Notes:

- [Build zero-trust AI agents with Google's ADK](https://newruntime.com/posts/build-zero-trust-ai-agents-with-google-s-adk/) (2026-09-13)
- [Vercel opens a 1M dollar Sandbox escape challenge](https://newruntime.com/posts/vercel-opens-a-1m-dollar-sandbox-escape-challenge/) (2026-09-13)
- [Cloudflare Adds a Network Enforcement Layer for MCP](https://newruntime.com/posts/cloudflare-mcp-detection-enforcement/) (2026-09-10)

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- topic hub: [Mcp](https://newruntime.com/topics/mcp.md): Explore the mcp topic hub.
- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- collection: [Raw Signals](https://newruntime.com/signals.json): Open every source-linked raw signal.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)