Every CIO and CISO I talk to is asking the same thing right now: how do we secure our enterprise use of AI agents, at scale, consistently, across every deployment, anywhere?
My answer is that you don’t secure the agent, you secure where it runs, and you make that a policy applied and enforced centrally. Trusting each team to get it right on its own is how you end up with no specific standards.
An agent chasing a goal will go to whatever lengths it can to complete that goal, including routes that you may not have considered it taking. Rick and Morty summed it up perfectly with their portrayal of “Meeseeks”, where the Meeseeks would go to any length to achieve their goal. Even the frontier labs have issues constraining their agents, albeit with significantly more advanced models, but it goes to show the complications you have to deal with.
While most people think that they control their agent through only their instructions, an agent that reads a document, email or web page can easily obtain new (hidden) instructions (prompt injection). Prompt injection has no reliable fix today, so assume a hijacked agent, and make sure it can do almost nothing. The risk cuts both ways, too: an agent can damage your platform from the inside, or just as easily attack someone else from your network, and “we didn’t tell it to” is a weak line to use with their lawyers. A simple prompt to analyze your top competitor’s pricing tactics and market position could in fact see the agent attempting to exploit their network to gain access to files to get the answer it needs.
The only way you can get comfort in knowing what the agent can do/reach is by correctly sandboxing it.
Here is what I’d standardize, in order.
Pick a platform that can self-enforce rules and run agents only there. I’d choose Kubernetes; a plain Docker host doesn’t give you the controls this needs. Give agents their own namespaces with the strictest pod security profile, enforced by the cluster.
No admin credentials anywhere near an agent, no inadvertent access to the platform’s own API. Be sure no service account tokens are mounted to the agent pods, and make sure the agents cannot read any secrets in the namespaces they are in.
Agents should reach the outside only through destinations you named (network whitelist), and everything else should fail. An agent that can’t reach the internet can’t attack a third party from your address space.
Run agents with images pulled from your own registry, scan the registry and the runtime continuously.
Alerting tells you that something is wrong and has to wake someone up; your authentication and activity logs go to the SIEM and tell you afterwards who changed what. Keep them as two separate jobs. Don’t find out an agent did something it shouldn’t, two weeks after the damage was done.
Everything above is standard practice. Define these as an enterprise-wide baseline. Apply it to every cluster, in every location, from one place. Ensure that any local “drift” (local changes made that weaken the policy) is immediately reverted. No one should be able to override a baseline policy.
As a simple check, have your platform team deploy an agent and then try forbidden things and report which are successful. If any succeed, you have a problem.
If you have no tooling / mechanism to globally apply policy across every single environment in which you run agents, then you need to solve that problem, today. There are dozens of Kubernetes fleet management solutions out there (Portainer is one), but be sure they have a policy engine, that the engine has the settings you need to provide the security boundaries, and that the policy is always enforced. Without this you really are flying blind.
So, back to the very beginning and the question asked of me “how do we secure our enterprise use of AI agents, at scale, consistently, across every deployment, anywhere”, the answer is simple.. “By running your agents on a Kubernetes platform, with a central policy engine, and running the agents in a heavily constrained, sandboxed environment.. that is the only way.” Don’t let the Meeseeks run wild.
Neil