How to Restrict the Blast Radius of an Autonomous Agent with High System Privileges

Give an agent root, a cloud account, and a broad toolset, and you haven't built a productivity miracle — you've built a single point of failure with a keyboard. The blast radius is the first thing to design, not the apology you write after the incident.

The uncomfortable truth at the heart of this piece: the model is not a reliable last line of defence. An audit of 33,000 agent trajectories found most failed injection attacks were simply ignored, not refused — and swapping only the system prompt moved attack success from 0.2% to 43% on identical weights. If your safety plan is "the model will know better," you don't have a safety plan.

Least privilege is not a checklist item, it's the whole game

The agent gets its own identity, never yours, never a standing admin role. On AWS that means a task-scoped IAM role with 15–30 minute STS credentials, not AdministratorAccess on a 12-hour session sitting in CI with no monitoring. A compromise of the agent should compromise the agent — not your account and everything you can reach.

Sandboxes narrow damage; they don't remove it

A microVM, a gVisor container, a disposable box — pick the boundary that matches how untrusted the code is, lock the filesystem to one writable workspace, and allowlist egress. But remember: the box still holds the agent's workspace, its credentials, and its permitted destinations. Sandboxing is a seatbelt, not a guarantee.

Tools are hands — control them like it

If the agent never needs to send email, it shouldn't have an email tool. For the tools that remain, approval gates must pause before consequential calls — LangGraph's interrupt, HumanInTheLoopMiddleware, the OpenAI Agents SDK's approval flow — bound to the exact action, with an expiry. And keep the gate list short: irreversible actions, external reach, money, bulk changes. Gate everything and humans start rubber-stamping; gate nothing and you get the Semantic Kernel case, where an indirect injection wrote an attacker script to the Windows Startup folder.

Watch it run, and keep a real kill switch

Trace every model call, tool call, and decision. Alert on new network destinations, bulk deletes, credential access. And the kill switch must revoke the session and its credentials — not politely ask the agent to stop. No single layer here is enough on its own. That's the point: prompt injection beats the model, but a correctly enforced approval gate stops the covered call; the sandbox limits reach; least privilege limits spend. Defence in depth, or don't ship the agent with privileges at all.

Go deeper

Read the full breakdown — including the CamoLeak and ForcedLeak injection cases, the sandbox comparison, and the approval-gate code — here: How to Restrict the Blast Radius of an Autonomous Agent with High System Privileges

Originally published on Agentic Affairs (https://agentic-affairs.com)