The original title is: "Your AI agent is the most over-privileged account you own"

Short summary

AI agents inherit excessive permissions on day one—full shell, API keys, unrestricted network, read access to home directories—creating security gaps through prompt injection and confused deputy vulnerabilities. Secure them with seven controls: explicit allowlists (never wildcards), dedicated service credentials with minimal scopes, read-only home directory mounts, egress allowlists with deny-by-default, human confirmation for irreversible actions, secrets in secure managers not env vars, and monthly access reviews. Treat agents like brilliant contractors with no context in a building where strangers slip notes in their inbox—apply the least privilege you'd use there.

• •Prompt injection is command injection: every input channel (web fetches, README files, issue comments, tool descriptions) is a potential attack vector requiring permission boundaries
• •Seven-point framework: explicit allowlists, dedicated service identities, filesystem/network isolation, egress allowlists with logging, human gates on send/publish/delete/pay/grant, secrets in managers, monthly reviews
• •Assume successful injection will happen—least privilege's job is making incidents annoying, not existential

Generated with AI, which can make mistakes.