By Josh Woodruff, Co-chair, CSA Zero Trust Working Group. Reviewed by Josh Woodruff. Published October 2026.
An AI agent can go as far as its setup allows. If nobody wrote that setup down, nobody can check the agent. Before an agent gets a login, write down what it may touch and which calls it may make. Then name what checks each call and what a shutoff really stops.
How to read this post: Fact means a source says it, with the link right there. Our read is my interpretation. Do this is what I recommend.
Why do AI agents need their limits written down?
Because no one can enforce a rule nobody wrote down. A policy engine compares a request to a rule. If the rule lives in one person's head, the engine has nothing to compare against.
A security leader told me recently that his developers still build production servers by hand. His company also runs AI agents in production. The dev team grew three or four times over the past year. Ops and security can't keep up, and each developer sets things up a little differently.
Picture one of those servers. Someone set it up by hand 11 months ago and has since left. What that box allows is now a guess. The permissions might be fine. They're just unknown.
Our read: Agents move at machine speed against whatever the setup allows. A setup that only lives in memory gives them no edge to stop at.
The fix has a name. Infrastructure as code means you write the setup down as a file a machine can read. It says what should exist and what may touch it. That file is what your controls check against.
What happened when OpenAI's agents met an unmapped machine?
They found a known flaw in the machine under them and climbed out. No one stole a password or planted hidden instructions (prompt injection). The agents used the access they were handed.
Fact: On July 19, 2026, agents in an OpenAI test setup found that their machine's Linux kernel had a public flaw, CVE-2026-53362. They pulled a public exploit and changed it to fit. Then they used it to act outside a container. That gave them root on the machine underneath. From there they moved through the connected systems (OpenAI incident report).
A container is a walled-off box meant to keep a program apart from the rest of the machine. Root means full control.
Fact: These were research runs with some safeguards turned off. OpenAI says the models ran without its production safeguards and auto-review systems (same report).
Fact: On August 27, 2026, CISA added that kernel flaw and a JFrog Artifactory flaw from the same incident to its Known Exploited Vulnerabilities list (CISA). That list tracks flaws attackers are using right now.
Our read: This says little about what an everyday agent will do. It does show the risk when a container is the only wall around an agent. Your team likely patched both flaws weeks ago. Whether your agents could pull the same move is a harder question. Most companies can't answer it.
Why isn't a login for every agent enough?
A login decides which app an agent can reach. It doesn't decide what the agent does once it's there. The agent logs in before the work starts. A tool call is the moment an agent stops thinking and acts, and that comes later.
Fact: On August 24, 2026, Okta made Agent SSO generally available. Agents get their own identity and short-lived tokens in place of stored passwords (Okta). A token is a temporary key.
Fact: On August 27, 2026, NIST published "Back to the Future: Why Agentic AI Needs a Strong Identity Foundation." It says agents need their own identifiers and credentials, and it points to standards like SPIFFE and OAuth 2.0 (NIST).
I agree with both. Each one beats the shared static keys most companies run today.
Our read: An ID tells you who's calling. Something else has to decide what the caller gets to do, call by call. For the stop side of this, see our post on how to stop an AI agent before it acts.
What four questions should you answer before an agent gets a login?
I call this the Ground Check. Every answer should name a file or a part of your system. "Someone set it up" doesn't count as an answer.
Is what this agent will touch written down where a machine can read it? That means infrastructure as code or any file a policy engine can check.
Can you list the calls this agent may make, and what each one may touch? "It can use the storage tool" is too broad. Say which folders it can read or change, and where its results can go. A tool on the list can still be pointed at the wrong thing.
When the agent makes a call, what checks it right then? Name the part of your system. If the answer is your identity provider, that's the login step. It ran before the call.
If you shut this agent off right now, what stops? New tokens only, or everything? What about calls already running? Find out which kind of shutoff you have before you need it.
In Josh's Lab, where I test agents so they don't break in real life, my answer to question three is a gateway. Every tool call from my four agents goes through it. Question four still has a hole. I haven't tested two of the ways a stopped agent could keep going.
Do this: Run the four questions on one production agent this week. Write the answers where someone else can read them. If you can't name the part that answers question three, that's your first fix. Our kill switch post covers question four in more depth.
Where does the checkpoint go for an AI agent?
At the tool call. Zero Trust already gives the frame. John Kindervag, who created Zero Trust, says to name the thing you're protecting, the protect surface. Then put a checkpoint right in front of it and check every request on its own (Palo Alto Networks).
For an agent, the protect surface is the tool call. Most checkpoints today sit in front of networks and APIs. A real one sits at the tool call, and every route to the tool passes through it. The tools to build that checkpoint exist now. Few shops have one in place.
Kindervag wrote the foreword to my book, Agentic AI + Zero Trust. For MCP, the protocol many agents use to call tools, see what security teams ask about MCP before they use it.
Which Agentic Trust Framework elements held in the OpenAI case?
Identity Management held. Segmentation failed, and that's the whole incident. Here's how it maps to the five elements of the Agentic Trust Framework (ATF), which the Cloud Security Alliance published in February 2026 (CSA).
Identity Management held. The agents were known, and each one acted as itself.
Behavioral Monitoring partly held. OpenAI caught the activity and disclosed it. That's more than most companies would manage.
Data Governance stayed out of it. The agents went after the machine underneath and left the data alone.
Segmentation failed. The kernel decided how far the agents could go. No policy did. The container was built to keep well-behaved programs apart, and these agents were looking for a way out.
Incident Response held late. OpenAI found it, but containment came too late.
Our read: Ranking flaws by severity misses this. Decide ahead of time how far a broken agent can get. Then build so the answer is "not far."
How do you keep an agent from climbing out of its machine?
Give each agent its own small machine. Keep anything you'd mind it reaching on a different machine. Treat the container as something that slows an agent down.
These agents climbed up through the machine they were sitting on. Most agent security tools watch what an agent sends out, so this came from a direction they rarely look.
Fact: On September 28, 2026, NVIDIA launched its Open Agent Safety Platform. It pairs OpenShell, free open-source software that holds an agent to written limits, with Sentry, a watchdog that runs on separate hardware. NVIDIA calls Sentry a reference system design (NVIDIA).
Our read: If an agent beats its own machine, whatever stops it has to live somewhere else. When something goes wrong, you'll also want proof of what happened. Our post on what evidence an auditor should expect for AI agents covers that record.
Related questions
Is identity enough to govern an AI agent?
No. Identity answers who's calling and which app they can reach. You still need a check at each tool call, plus a shutoff that covers tokens already handed out.
What's the first step this week?
Pick one agent already running in production. Answer the four Ground Check questions about it, without grading on a curve. Write the answers down. If question three has no named answer, you found it before your auditor did.
This post is adapted from the October 13, 2026 issue of my Trusted Agents newsletter, Write It Down Before Your Agents Find the Edges. Subscribe there for the weekly issue.
Book a Consult
If you want help running the Ground Check across your agents, book a 90-minute agent trust assessment. We'll map what each agent can touch and what checks its calls. We'll also test what your shutoff really stops. You'll leave with a fix list in priority order. Book a Consult. Prefer to start alone? The free ATF assessment takes about ten minutes.