Agent security / evidence checklist
Check twelve controls across goal integrity, tool access, isolation, untrusted content, credentials, auditability, shutdown, and recovery before an agent can touch production systems.
Run the free security check →Inspect one agent path
This is a triage worksheet, not a penetration test or compliance certification. Verify each answer against configuration, tests, and logs.
Exposure model
0–3: open.
Authority can escape the intended task with little resistance.
4–7: partial.
Individual controls exist, but a chained failure can still cross boundaries.
8–12: guarded.
Defense-in-depth is visible; prove it with adversarial tests and incident drills.
Primary-source guide
OWASP's agentic guidance separates risks such as goal hijacking, tool misuse, identity abuse, supply-chain compromise, code execution, and memory poisoning. Anthropic's current Claude Code guidance adds concrete controls: permission gates, filesystem and network sandboxing, trust verification, fail-closed command matching, scoped credentials, audit logging, and project-specific settings.
No single control is sufficient. A sandbox cannot decide whether an instruction is trustworthy, and a permission prompt cannot repair leaked credentials or poisoned memory.
OWASP Top 10 for Agentic Applications 2026 → OWASP guide to securing agentic applications → Anthropic Claude Code security guidance → NIST AI Resource Center →Review goal integrity, identity and least privilege, irreversible-action approvals, isolation, untrusted input, tool provenance, credentials, validation, resource limits, logs, shutdown, and recovery. Tie every checked control to configuration, a test, or a trace.
Begin with no authority, then allow the smallest action and resource set required by the task. Keep high-impact actions behind a separate gate and use narrowly scoped, short-lived credentials.
No. Isolation limits what a compromised action can reach. It still needs trusted-instruction boundaries, permission checks, output validation, resource caps, and monitoring around it.
Record initiating identity, instructions, retrieved context, permission decisions, tool inputs and outputs, state changes, validation results, resource use, and the final stop reason. Protect the trail so an incident can be reconstructed.
Agent evidence, not security theatre
ResearchAudio turns primary sources, attack paths, permissions, and operational limits into practical decisions for engineers and builders.