Original subtitles

I gave an AI agent production access, then I added the most powerful security

feature known to man.

Make no mistakes.

The ship is now on fire.

A chatbot returns text, an agent can use tools, observe results, and take another

step. Connect a terminal, and those words can become commands.

Permissions decide the blast radius.

Then it reads a web page, some of that page's information, some might be

instructions planted by an attacker.

That is indirect prompt injection, your documentation has entered management.

Writing please be safe in the prompt does not revoke a database credential.

Give the agent a disposable workspace, scoped credentials, and only the tools

its task needs.

Enforce those limits outside the model.

Let it propose a patch, run independent checks, review the change before a

production deploy.

Log tool calls, cap retrace and spending, otherwise your retry loop

becomes a subscription to failure.

Keep recoverable backups, a rollback button cannot resurrect data you never

saved. Can agents ship useful software?

Yes. Should your entire security model be a sentence ending in three

exclamation marks?

No.

Automate the work, contain the blast radius.

And when somebody says ship it, specify the temperature.