AI Agent Security
Agents are powerful because they read wide and act autonomously. That combination is also the root of every real security risk. This is a practical, balanced guide — not fear-mongering, not vendor boosterism. Eight deep-dive topics, a 9-platform posture comparison, and a 15-minute hardening checklist you can actually complete.
Platform security posture at a glance
Rough posture rating based on default-deny vs. default-allow, sandbox enforcement, and managed-vs-self-hosted trade-offs. "Medium" is not bad — it means you need to do the work; the defaults won't save you.
| Platform | Posture | Security model |
|---|---|---|
| OpenClaw | 🟡 Medium | Self-hosted, with conservative defaults: the Gateway binds to loopback and unknown senders get a pairing code. It assumes one trust boundary per Gateway, not a hostile multi-tenant one, and the skills you add are the biggest risk. `openclaw security audit` checks your config. |
| NemoClaw | 🟢 Strong | Runs the agent inside an NVIDIA OpenShell sandbox where network access is denied by default. Policy tiers and presets open it up, and provider keys stay with the OpenShell gateway, outside the sandbox. |
| IronClaw | 🟢 Strong | Defence in depth as IronClaw documents it (written for 0.29.x; the 1.x extension host was rebuilt): encrypted secrets that never enter the sandbox, WASM tools limited to allowlisted hosts, and leak detection on everything sent to the model. |
| Kilo Code | 🟡 Medium | Permission rules (allow, ask, deny) decide what runs automatically. An optional OS sandbox, off by default, limits writes and outbound network on macOS and Linux but does not limit reads. Free models may log prompts. |
| Hermes | 🟡 Medium | Self-hosted. The gateway denies unknown users by default and flagged commands go through approval modes, but several important guards, such as running commands in a container and your own deny rules, are opt-in. |
| Claude Cowork | 🟡 Medium | Anthropic-hosted. Tasks run in an isolated environment on Anthropic's servers by default; Manual approval is the default mode and Claude always asks before permanently deleting files. Local files, browser use and computer use go through Claude Desktop. |
| ChatGPT | 🟡 Medium | OpenAI-hosted. Agent mode stops at irreversible actions and asks for confirmation. Memory persists across conversations unless you use Temporary Chat, and ChatGPT Enterprise offers a custom data processing agreement (Plus and Pro do not). |
| Grok Bot | 🟡 Medium | Hosted. Every Bot on an account shares one persistent cloud computer, with its files and logins, and xAI's docs say not to use separate Bots as a security boundary. Auto-review, approval rules and network policy add control; computers run in the United States. |
| Meta Muse | 🟡 Medium | Hosted. Each person gets a dedicated Secure VM, and a separate Sentinel agent gates connector actions and network traffic. Muse asks before sensitive actions; until Meta's planned Confidential VM ships, Meta can in principle access what is in your VM. |
Deep-dive topics
Prompt Injection — why agents can be hijacked by what they read
Malicious content embedded in web pages, emails, or documents tricks your agent into executing attacker instructions. How to recognize it and design around it.
🔴 Critical · Applies to 9 platforms
Skill & Tool Allowlisting — default-deny is not optional
Skills (or tools, MCP servers, Actions) are the agent's hands. Controlling which skills are available — and for which projects — is the single highest-impact security control.
🟠 High · Applies to 5 platforms
Secrets & Credentials — never in prompts, never in memory
API keys, OAuth tokens, passwords. Where they live, how they leak, and how to rotate them when (not if) they do.
🟠 High · Applies to 9 platforms
Sandboxing — contain the blast radius
Assume the agent will eventually do something wrong. Sandboxing is how you make that a small mistake instead of a catastrophic one.
🟠 High · Applies to 5 platforms
MCP Server Supply Chain — the new npm attack surface
MCP servers are the agent equivalent of npm packages. Same trust problem, new ecosystem, much less mature tooling.
🟠 High · Applies to 6 platforms
Email & Calendar Scopes — the read-write boundary matters
Giving an agent access to email is the fastest way to unlock high-value use cases — and the fastest way to cause a catastrophe. Scope discipline is the whole game.
🟠 High · Applies to 6 platforms
Incident Response — what to do when the agent goes wrong
Playbook for the inevitable day your agent does something it shouldn't. Speed matters — the first hour is everything.
🔴 Critical · Applies to 9 platforms
The Agent Security Checklist
The 15-minute hardening pass you should do for every new agent setup. Print it, work through it, sign off.
ℹ️ Baseline · Applies to 9 platforms
The non-negotiables
If you skip everything else, do these four:
- Default-deny on skills. Never enable a skill globally. Scope per project.
- Draft-only for irreversible actions. Email send, git push, file delete, payments. Always a human confirmation gate.
- Secrets in .env, never in prompts. SOUL.md, CLAUDE.md, and system prompts get sent to the model on every turn.
- Read-only OAuth scopes by default. Grant write access only for the specific action that needs it, and prefer draft/label over send/delete.
Need the shortest possible version? Go to the 15-minute checklist. Building something new? Start with prompt injection — it's the attack class every agent is exposed to.