Agentic Security & Safety — Agent Reference

Prevent prompt injection in tool-use agents by validating and sanitizing all untrusted user and tool outputs, enforcing strict schema validation, isolating tool execution from core agent instructions, and using system prompt instructions that warn the model to treat tool data strictly as untrusted content.

Sandbox code execution tools by running all interpreter processes inside isolated containers (like Docker or gVisor), restricting network access, setting CPU/memory resource limits, enforcing a read-only root filesystem where possible, and using short process timeout thresholds.

Store credentials for custom MCP servers in system environment variables or secure credential managers (e.g. AWS Secrets Manager, Vault, or local Keychain) and retrieve them dynamically at runtime instead of hardcoding tokens inside the Claude Desktop config.json file.

Implement human-in-the-loop gatekeeping for agentic writes by defining a whitelist of read-only tools and requiring explicit user authorization (via CLI prompts, Slack approval buttons, or web dashboards) before executing state-modifying actions like write files, run terminal commands, or make payments.

Protect agentic scrapers from recursive loops and honeypots by enforcing strict URL domain whitelists, setting max crawling depth limits (e.g., 3 levels), tracking and deduplicating visited URLs using a hash set, and capping total execution execution time per run.