SPEC: OWASP AGENTIC / NIST AI 600-1System prompts are probabilistic instructions, not security boundaries. When tool-calling agents ingest untrusted external text, hold write credentials, and execute generated code, AppSec and platform teams need deterministic taint separation, scoped OAuth 2.0 On-Behalf-Of tokens, and hardware-isolated sandboxes.
Toggle runtime capabilities and host enforcement rings, then fire an attack vector to inspect the exact CAD interception gate and exportable policy YAML.
Hidden instructions embedded inside retrieved HTML, support tickets, or MCP resources attempt to hijack tool selection and exfiltrate context.
Breach: Tainted Prompt Reaches Unchecked Execution Core
Untrusted retrieval co-exists with write or code tools without both OBO scoping and a mandatory human approval gate.
Exposed: Shared worker API key grants tenant-wide permissions regardless of which user initiated the prompt.
# Generated Agent Containment Policy (Autonomy Risk Score: 100/100)
version: "2026.11"
containment_profile:
ring_1_taint_and_schema:
allow_untrusted_retrieval: true
strict_json_schema_additional_properties: false
max_tool_turns_per_run: 8
ring_2_identity_and_hitl:
credential_mode: "WARNING_static_service_key"
require_human_approval_on_write: false
mutating_api_tools_enabled: true
ring_3_sandbox_and_network:
code_interpreter_enabled: true
runtime_isolation: "WARNING_unrestricted_egress"
deny_egress_cidrs:
- "169.254.0.0/16" # Cloud IMDSv1/v2 credential endpoint
- "10.0.0.0/8" # RFC 1918 private network
- "172.16.0.0/12" # RFC 1918 private network
- "192.168.0.0/16" # RFC 1918 private network
- "127.0.0.0/8" # Host loopback
PLATE A-01 // HOST MIDDLEWARE ENFORCEMENT
High-severity autonomous agent incidents combine three conditions in the same loop: untrusted external data ingestion, access to privileged tools or credentials, and an outbound exfiltration or mutation path. Gating at least one leg in host middleware neutralizes the exploit chain even when the model is jailbroken.
Upstream SRE availability coupling: Sandbox timeouts and retry budgets must coordinate with provider HTTP 429/529 spikes. Monitor 5-minute polled AI provider status feeds and compound multi-agent SLA math at our sister workbench, agentoutages.com.
Compare syscall exposure and cold-start overhead before allowing any agent to run synthesized code or untrusted MCP plugins.
| Runtime | Kernel / Syscall Boundary | Cold Start | AppSec Verdict |
|---|---|---|---|
| Firecracker MicroVM (KVM) | Dedicated guest Linux kernel via hardware KVM; minimal VirtIO model | ~125 ms | Recommended (Untrusted Code) |
| Open-Source gVisor (runsc) | User-space Sentry intercepts guest syscalls; ~70 allowlisted host syscalls | ~50 to 100 ms | Recommended (K8s Pods) |
| Wasmtime (WASI 0.2) | Capability-zero linear memory; zero ambient filesystem or socket access | < 5 ms | Recommended (MCP Tools) |
| Shared-Kernel Docker | Namespaces + cgroups directly exposing 300+ host Linux kernel syscalls | ~200 ms | Unsafe Anti-Pattern |
tool-schema.json
Monotonic taint tags on retrieved chunks, closed JSON Schemas, and an 8-turn recursion ceiling.
rfc8693-obo-jwt
10-minute OAuth 2.0 On-Behalf-Of tokens narrowed to caller RBAC plus out-of-band HITL sign-off.
sandbox-egress.nft
Ephemeral KVM MicroVMs paired with nftables default-deny egress blocking 169.254.169.254 IMDS.
Map Indirect Prompt Injection, Sensitive Information Disclosure, Excessive Agency, System Prompt Leakage, and Unbounded Consumption to typed JSON tool schemas, dual-channel taint tracking, and OAuth 2.0 RFC 8693 Token Exchange.
Compare hardware KVM MicroVMs, user-space syscall interception, and capability-zero WebAssembly runtimes against unconfined shared-kernel Docker, complete with copyable nftables rules blocking 169.254.169.254 IMDS.
Run our 10-point human-in-the-loop deployment gate checklist with client-side Markdown export covering sub-5-second kill-switches, automation-bias diff previews, immutable JSONL audit trails, and token-spend circuit breakers.
Open-source controls (`nftables`, Firecracker, RFC 8693 OAuth exchange, and JSON Schema validators) require zero vendor spend and always take priority in our blueprints. Teams seeking managed cloud sandboxes or low-latency prompt-injection classifiers can evaluate the commercial options below.
Reviewed by Dr. Henrik Solberg, Principal AI Security & Runtime Containment Editor
Reviews OWASP GenAI Agentic security controls, Firecracker/gVisor/Wasm isolation architectures, and NIST AI RMF governance gates.
Last reviewed:
Reviewed every 3 months
AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.
Store your email for quarterly technical notes on OWASP Agentic threat mitigations, RFC 8693 OBO token patterns, and kernel sandbox benchmarks once dispatches begin. No emails are sent yet.