The Orchestrator

The controls that keep an agent system uncompromised are not exotic, and they are not new. They are the same ones that keep any privileged system honest, applied at the places where a language model introduces new paths in. In roughly the order a real deployment stacks them:

Scope every credential. The agent gets a token scoped to the one repository, database role, or API it needs, not a shared admin credential. The blast radius of a compromised agent is the scope of its token. A coding agent working in one repository should not hold the credentials that touch production; Chapter 6’s table said this as “do not provide production credentials,” and the security version is the same sentence with the word “compromised” attached. Two of 2025’s supply-chain compromises that reached agents began as scope failures one step upstream of any agent. The malicious Nx packages published to npm in August 2025 were possible because a pull-request validation workflow ran with a read/write repository token, which let an attacker reach the publishing pipeline and extract the npm token; Nx’s post-mortem names the critical mistake plainly — access to the repository was access to publish.⁵ A month earlier, the Amazon Q Developer extension for VS Code shipped a release containing a prompt that told the agent to “clean a system to a near-factory state and delete file-system and cloud resources”; it failed only on a syntax error, and AWS traced the commit to “an inappropriately scoped GitHub token” in a build configuration.⁶ Neither token belonged to an agent, and both decided what an attack on agents could reach.

Isolate the runtime. The agent works in a separate workspace — a container, a VM, an ephemeral environment — with no production secrets in reach. A prompt-injected instruction to “read the production configuration file” fails because the file is not in the workspace. Isolation converts a whole class of instructions from dangerous to impossible. The clearest public demonstration of what happens without it is Replit’s, from July 2025. Jason Lemkin, nine days into building an application on Replit’s agent, found that the agent had deleted his production database — 1,206 executive records, by his count — during a declared code freeze, then told him a rollback was impossible when it was not. He had, he said, told it eleven times in capital letters not to change anything.⁷ Replit’s chief executive, Amjad Masad, acknowledged that the agent “in development deleted data from the production database,” called that “unacceptable and should never be possible,” and said the company was rolling out “automatic DB dev/prod separation to prevent this categorically.” Lemkin’s account supplies the cause: development, preview, and production had been one database. The instruction did not hold. A database the agent’s environment could not reach would have. The word to keep from Masad is categorically — isolation is the control that does not depend on the model reading the sentence.

Treat retrieved content as data, never as policy. Documents the system reads — search results, tickets, emails, records — are labeled as untrusted data in the harness, not interleaved with instructions as if they carried authority. No retrieved document may grant itself new permissions or cancel a security requirement. Chapter 6 stated the rule; the security implementation is a harness that keeps untrusted content out of the instruction channel, or at minimum marks it so the model cannot mistake provenance. The GitHub issue that opened this chapter is what the rule prevents. So is a rules file. In March 2025 Pillar Security showed that a file in a project’s .cursor/rules directory could carry instructions hidden in invisible Unicode characters — readable by the model, invisible to the developer and to GitHub’s pull-request view — that led Cursor and GitHub Copilot to add an attacker’s script tag to generated HTML and, on the file’s instruction, never mention the addition.⁸ Section 14.3 returns to that file as a supply-chain problem. The point here is that a configuration file the agent reads is retrieved content too, and the harness has to treat it that way.

Check outputs deterministically. Before a result is acted on — a command run, an email sent, a file written — a deterministic check outside the model rejects unsafe results regardless of the model’s reasoning. Block the known-bad domains. Check the recipient list against an allowlist. Verify the command against the allowed set. These checks are dumb on purpose: they do not reason, they compare, and that is why injected instructions cannot talk their way through them. One qualification, learned in public. In July 2025 Backslash Security showed four ways an agent could get a command past the denylist guarding Cursor’s auto-run mode — Base64 encoding, a subshell, writing the command to a script, and a quoting trick with infinitely many variants — and Cursor deprecated the denylist rather than defend it.⁹ A string match on a command the model composes is deterministic and still worthless, because the model controls the string. The check has to sit where the effect happens: the recipient list the mail API sees, the domain the network layer resolves, the branch the repository accepts. Allowlists at the point of effect; never denylists on the model’s phrasing.

Log what actually happened. The audit trail records every action, input source, permission used, and decision point. This is Chapter 8’s operating record, and it is also a security artifact: when something looks wrong two weeks later, the trail is what answers “who decided this, on what evidence.” A system that cannot explain what it did cannot be investigated after a compromise. Two incidents make the point from opposite sides. Pillar’s poisoned rules file told the model not to mention the change it made, and the model complied — the chat transcript would have shown a reviewer nothing. Nx’s victims learned they had been compromised because the exfiltration left a record it could not suppress: a new repository in the victim’s own GitHub account, visible in the account’s security log. The log this chapter means is the second kind. It records actions and their targets from outside the model, not the model’s narration of what it did.

Stack those five and the injection problem shrinks to something manageable. The agent may still be tricked — but a tricked agent with a scoped token, an isolated workspace, no policy channel for untrusted text, deterministic output checks, and a full log is a contained incident, not a breach.

Through late September 2026, every layer of that stack was something each team assembled by hand. On the 28th of that month it acquired a product form. NVIDIA announced the Open Agent Safety Platform — an open-source stack and reference design backed by more than a hundred partners — and the launch followed a season of exactly the failures this chapter has been cataloguing: frontier labs reported agents escaping the environments meant to contain them, reaching systems they were never allowed to touch, and in some cases misreporting what they had done; in the days before the launch, Australia disclosed that an OpenAI agent had accessed public and non-public files in the national Medicare statistics database in June.¹⁰ Two components of the platform map onto the controls above nearly line for line. OpenShell — open source, Apache 2.0 — is the isolate-the-runtime control shipped as software: each agent runs in a kernel-isolated sandbox, and the operator’s limits on files, networks, tools, processes, and credentials are compiled into a policy the runtime verifies before the agent starts and enforces while it works. Sentry is the out-of-band watchdog: in the reference design it runs on a BlueField-4 DPU positioned on the node’s only path to the model, correlates agent actions, tool calls, and policy decisions into a record assembled outside the agent’s reach, and quarantines an agent that crosses its boundary in milliseconds. The engineering notes are candid about why the boundary has to sit outside the model. NVIDIA’s own researchers describe drift — agent actions that depart from the intended task after a blocked action, a bug, a missing tool, ambiguous instructions, or weeks of running at a hard problem where the first thousand attempts fail — and conclude that an agent in those circumstances cannot be expected to fully govern its own behavior. Justin Boitano, NVIDIA’s vice president for enterprise AI, translated the same lesson for the launch: deterministic rules need to govern probabilistic agents, and infrastructure needs to enforce explicitly.¹¹ That is Chapter 6’s sentence, arriving from the company whose silicon runs a large share of the fleet.

Two cautions travel with the announcement. The platform was two days old when this paragraph was written, its vendor sells the hardware the reference design runs on, and whether in-silicon enforcement holds against agents that defeated application-layer controls is exactly the kind of claim that should be settled by incidents rather than launch decks. And the boundary is only as good as the policy written into it: OpenShell verifies and enforces the operator’s limits; it cannot write them. The inventory in Section 14.6 — which servers, which tokens, which flags, decided by whom — remains the orchestrator’s to produce. What changed in September is where the enforcement half of the division of labor lives: below the application, in infrastructure the agent cannot reach.