WorkFebruary 24, 2026via Vercel Blog
Security boundaries in agentic architectures
Why it matters
As coding agents become standard infrastructure, security boundaries between agent harness, generated code, and credentials are becoming critical governance questions for any company deploying agents to production. This is an emerging risk class that boards and CTOs need to understand now.
Key signals
- Prompt injection + code execution = arbitrary infrastructure access risk
- Four distinct actors in agentic systems: agent, harness, secrets, generated code
- Default tooling runs all components in single security context (zero-boundary architecture)
- Secret injection proxy prevents exfiltration but not runtime misuse
- Separate VM/sandbox approach isolates agent harness from generated code execution
- Vercel Sandbox + secret injection recommended as production standard
- Most teams haven't adopted boundary separation yet due to default tooling constraints
- Agent-generated code can steal credentials, delete data, or compromise reachable services
The hook
Most agents today run with full access to your secrets. Here's why that's catastrophic—and how to fix it.
Most agents today run generated code with full access to your secrets.
As more agents adopt coding agent patterns, where they read filesystems, run shell commands, and generate code, they're becoming multi-component systems that each need a different level of trust.
While most teams run all of these…