Phase 10 · Months 9 to 10

Secure agents and the code they write

Build a threat model for the whole loop

Prompt injection is one threat among many. Learn direct and indirect prompt injection, tool poisoning, retrieval poisoning, data exfiltration, confused-deputy attacks, credential leaks, privilege escalation, data leaks between tenants, and sandbox escape. List which inputs are untrusted and what an attacker would want. Any product that ingests content it does not control, such as web pages, emails, uploaded documents, or tickets, faces indirect prompt injection as a real risk.

Grant least privilege in the architecture

Give the model no broad standing credentials. Run tools under narrow service identities. Keep read access separate from write access. Use short-lived credentials. Require a policy check for sensitive actions, and often a human approval too.

Secure the coding agents

Coding agents run with a developer's privileges on the developer's machine. Learn permission modes, allow and deny rules, and sandboxed execution. Learn how to keep secrets out of agent context. Learn the supply-chain risks, such as agents that install packages which do not exist or which imitate real ones. Check which of your Phase 1 tools sandbox agents and which do not. A multiplexer organises agents. It does not contain them.

Sandbox generated code

If agents run code or shell commands, isolate them. Use container boundaries, limit filesystem access, control outbound network traffic, set CPU, memory, and time limits, and throw each environment away after use. Treat generated code as untrusted code.

Learn the managed sandbox services built for this job: E2B, Modal, Daytona, Vercel Sandbox, and Cloudflare's sandboxes. Compare them on how they isolate code, with microVMs or containers, and on start-up time, maximum session length, network controls, and cost. Then build a sandbox yourself once on AWS, with Firecracker microVMs or gVisor containers, so you understand what the services sell.

Study the LiteLLM supply-chain attack

On 24 March 2026, two LiteLLM releases on PyPI shipped malicious code that collected environment variables, SSH keys, and cloud credentials. Attackers had stolen a maintainer's publishing token, and the releases were live for about 40 minutes. A model gateway holds every provider key by design, which makes it an obvious target. Write a short postmortem for your own stack. Say which of these would have limited the damage: pinned dependencies, hash verification, outbound network controls, and narrower credentials. List which of your agents install packages without supervision.

Keep instructions and data apart

Label external content, keep instructions separate from data, and do not rely on the prompt alone to stop data leaving the system. Check access before retrieval and again before each tool call. Show every policy denial in the traces.

Build an adversarial test suite

Write malicious documents, web pages, PR comments, and tool responses that try to override instructions, ask for secrets, or trigger privileged tools. Add tests for access across tenants and for malformed arguments. Run the suite on every significant change to an agent.

You are done when

You can present a threat model for your agent platform and show the control for each major risk. You can show that a prompt injection cannot give an agent any capability the caller did not already have.

Exit checklist