Agent Baseline: Securing Autonomous AI Software Factories
A strategic framework for securing autonomous AI agents in software factories. Learn how to implement sandboxing, least privilege, and supply chain controls to mitigate risks from probabilistic AI actors.
The Rise of the Autonomous Software Factory
The transition from human-directed coding to autonomous agentic systems introduces a new class of security risks. As organizations adopt AI agents to produce code, test, and deploy software, they face the challenge of managing probabilistic actors that can escape intended boundaries. The "Agent Baseline" framework, developed by Docker, Keycard, and Snyk, provides a structured approach to securing these systems through six core controls.
Core Security Controls
The primary risk in agentic coding is the agent's ability to perform unintended actions, such as accessing production databases or leaking secrets. To mitigate this, organizations must implement strict runtime sandboxing. Agents should never hold static credentials; instead, secrets must be injected at the egress point with scoped, least-privilege access. This prevents agents from discovering or exfiltrating keys they do not need for their current task.
Supply Chain and Skill Security
A critical, often overlooked risk is the dynamic supply chain. Agents that clone third-party repositories may inadvertently load malicious skills or MCP (Model Context Protocol) servers. These components can execute arbitrary code or spawn local servers for data exfiltration. Security teams must treat all external skills and connectors as untrusted inputs, requiring rigorous validation before execution.
Maturity and Oversight
Organizations should assess their "software factory" maturity across three levels: developer-directed, predefined workflows, and fully autonomous. Most companies are currently in the first two stages. To move toward autonomy, teams must deploy "decision models"—lightweight, specialized AI systems that monitor primary agents for alignment and prompt injection. This oversight layer ensures that agents remain within their intended scope without requiring human approval for every action, which leads to approval fatigue.
Strategic Action
The immediate priority for engineering leaders is consolidation. Fragmented agent tooling increases risk and reduces value. By standardizing on a common agent infrastructure and implementing the Agent Baseline controls, organizations can safely scale agentic capabilities. The framework is open-source and community-driven, inviting feedback to refine these security standards as the technology evolves.
Key insights
-
AI agents are fundamentally probabilistic and may deviate from intended tasks, requiring strict runtime boundaries to contain potential damage. The risk is not just malicious intent but also good-faith errors that lead to destructive actions.
Impact: Prevents catastrophic production incidents caused by agent misalignment or sandbox escapes, protecting core business operations.
-
Static credential storage within agent environments is a critical vulnerability. Agents should never hold persistent secrets; instead, credentials must be injected dynamically at egress points with scoped permissions.
Impact: Reduces the attack surface for data exfiltration and ensures agents only have access to the minimum necessary resources for specific tasks.
-
The agentic supply chain is dynamic and includes third-party repositories, skills, and MCP servers. These components can contain hidden malicious code that executes when the agent loads them.
Impact: Mitigates risks from compromised open-source dependencies and untrusted plugins that can compromise the entire agent environment.
-
Human approval for every agent action leads to fatigue and blind acceptance. Organizations need automated oversight using specialized decision models to verify agent alignment with intent.
Impact: Enables higher levels of autonomy without sacrificing security, allowing for faster software delivery and reduced human bottleneck.
-
Fragmented agent tooling across an organization increases security risk and reduces value. Consolidation on common workflows and shared context is essential for effective security and usability.
Impact: Improves overall security posture and developer productivity by standardizing agent infrastructure and reducing configuration drift.
Action items
-
Implement strict sandboxing for all AI agents, ensuring no access to production networks or secrets. Use egress-based injection for any required credentials.
Impact: Prevents agents from accessing unauthorized resources and limits the blast radius of potential agent misbehavior.
-
Audit all third-party repositories and MCP servers used by agents for hidden skills or malicious code. Treat all external inputs as untrusted.
Impact: Reduces the risk of supply chain attacks and data exfiltration through compromised dependencies or plugins.
-
Map your organization's agentic maturity to the three levels of the software factory model. Identify gaps in security controls for your current level.
Impact: Provides a clear roadmap for improving security and autonomy, ensuring controls are appropriate for the level of agent decision-making.
-
Deploy decision models to monitor primary agents for alignment and prompt injection. Use these models to automate oversight and reduce human approval fatigue.
Impact: Enables safer, higher-autonomy agent operations by providing real-time verification of agent actions against intended goals.
-
Consolidate agent tooling and workflows across the organization. Standardize on a common agent infrastructure to improve security and usability.
Impact: Reduces configuration drift and security gaps, while improving developer productivity and the overall value of agentic systems.
Quotes
“While in most scenarios, and the wide majority of scenarios, an agent will do exactly what you ask it to do, In some percentage of use cases, it will do things that are not your intended action.”
“You're basically trying to take an actor that could potentially be malicious and could do it at very high speed and do it in swarms and you're trying to give predictable things that this actor can and cannot do.”
“The fact that you've put an agent inside of a sandbox does not mean that it can't consume things that would make it do things that are very bad.”