Security boundaries in agentic architectures
Most agents today run with full access to your secrets. Here's why that's catastrophic—and how to fix it.
Why it matters
As coding agents become standard infrastructure, security boundaries between agent harness, generated code, and credentials are becoming critical governance questions for any company deploying agents to production. This is an emerging risk class that boards and CTOs need to understand now.
The key facts
8 to knowPrompt injection + code execution = arbitrary infrastructure access risk
Four distinct actors in agentic systems: agent, harness, secrets, generated code
Default tooling runs all components in single security context (zero-boundary architecture)
Secret injection proxy prevents exfiltration but not runtime misuse
Separate VM/sandbox approach isolates agent harness from generated code execution
Vercel Sandbox + secret injection recommended as production standard
Most teams haven't adopted boundary separation yet due to default tooling constraints
Agent-generated code can steal credentials, delete data, or compromise reachable services
Go to the source
Vercel Blogvercel.com
Publisher excerpt: Most agents today run generated code with full access to your secrets. As more agents adopt coding agent patterns, where they read filesystems, run shell commands, and generate code, they're becoming multi-component systems that each need a different level of trust. While most teams run all of…