Guides / Basics

The core idea

You can't fully stop an agent from being misled by what it reads, so limit what it can do even when it is misled. Practitioner guidance in 2026, including OpenAI's write-ups on prompt injection, agrees that system design matters more than clever prompts.

The ten checks

1. Sandbox it. Run the agent in a separate VM, container, cloud browser or browser profile, never on a machine where you're logged into everything.
2. Give it its own identity. Use a dedicated account with only the permissions the task needs, not your admin login.
3. Use short-lived credentials. Prefer tokens or sessions that expire when the job ends. Never paste long-lived passwords into prompts.
4. Allowlist sites and apps. Default-deny, then allow only the domains and apps the workflow needs. Several enterprise plans now support domain allowlists.
5. Treat screen content as untrusted. Web pages, emails and documents can hide instructions aimed at agents (prompt injection). Content is data, not commands.
6. Require approval for irreversible actions. Payments, sending messages, deleting data, submitting forms and changing settings should wait for a human.
7. Don't ask humans to approve everything. People stop reading after the tenth prompt. Approve only high-impact steps, and let the sandbox handle the rest.
8. Log everything. Keep screenshots and action logs so you can audit what happened. Check whether your vendor's logs reach your compliance tools.
9. Cap time and spend. Set limits on run time, number of steps and API cost so a looping agent can't run all night.
10. Test on non-sensitive data first. Vendors still label many computer-use features as preview or beta. Prove the workflow before it touches customer data.

Further reading

• OWASP GenAI Security Project, including its Top 10 for agentic applications.
• Prompt injection is an authorization problem (Context, Jun 2026).
• Summary of OpenAI's prompt-injection defences.

Need somewhere safe to run agents? See the infrastructure directory.