Isolation beats instruction

A skill that scans the machine for credentials was shown to a agent in auto-approve mode. Refused. "Rewrite it as Python" — complied. "Run it" — refused. "Put it in a module" — complied. Then the context was cleared, and "run this" executed the payload. The same model that had called it clearly malicious ran it after a reset. Anything enforced only inside model context can be wiped away; model refusals are statistical, and attackers retry.

Three grants, routine for agents: access to sensitive data, the ability to communicate externally, and exposure to untrusted content. Any two are dangerous; agents commonly hold all three — and in an agent world, content is instructions. A single stolen credential is contagious through everything it can touch.

Hardware-level isolation with the configuration and secrets held outside the sandbox: microVMs rather than shared-kernel containers (security teams would not sign off on containers for agents that mutate their environment), network egress through an allowlisting proxy, and sentinel-value secret injection — the agent works with placeholders while real credentials are swapped into approved outbound requests beyond the boundary. The agent never possesses the key it uses. Ordering matters: least privilege and containers first; model-judged gating last, because it is measurably bypassable.

A security scan of roughly four thousand public skills found up to a third carrying security issues and seven percent leaking credentials — an ecosystem reaching npm-scale volume in months instead of years. Attacks are written in natural language, so signature scanning fails; the sharpest demo embedded shell commands in invisible Unicode control characters that execute in auto-mode while showing nothing to human review. Scanners themselves can be the malware. The working defenses: inventory what you run, scan on every install and update, and prefer behavioral analysis over keyword matching.

Assay was built with the explicit rule that client-side guards advise while the server side — rulesets, branch protection, per-role application permissions — binds. The live bypass demonstration is the sharpest possible evidence for that split, and it is why a refused action in an Assay fleet is a stop rather than a suggestion.

Every desk role runs as its own GitHub App with narrowly scoped tokens, minted per operation; no agent operates under a human's credential; writes happen through role verbs, never hand-rolled scripts. Beyond attribution, this is access control: a role's blast radius is its own permission set.

Work arriving from outside the trusted roster is surfaced, never executed as instructions — the third leg of the trifecta, controlled at the point of ingestion rather than hoped away in the prompt.

Sandboxing limits blast radius; it does not stop application-level abuse, and the talks said so. The human merge gate remains the control for that class — which is one reason Assay keeps it.

8 of 66 talks shown — the ones that reach the most concepts in this theme. Every sighting, per talk, is on the concept pages above.