Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th)

The article critiques current AI security practices that attempt to contain powerful, general-purpose AI agents by building cages such as containers, policy layers, and human oversight. It suggests this approach is backward because AI models evolve and can circumvent these cages. Instead, it promotes using AI to build smaller, narrowly scoped agents with only the access necessary for their specific tasks, adhering to least privilege and separation of duties principles. The piece references Check Point's Dangerous Deviation Detection, a beta tool that flags dangerous and unwarranted AI actions before execution, focusing on preventing data leakage, privilege escalation, and resource destruction. However, it stresses that restricting tool access alone is insufficient if agents have broad system privileges or if multi-agent workflows do not enforce strict authorization boundaries. The article calls for designing AI agents and workflows with explicit, minimal permissions and independent authorization checks to prevent unauthorized actions.

The impact discussed is primarily conceptual and procedural rather than a specific exploit or vulnerability. It highlights the risk that AI agents with broad permissions may perform unauthorized or dangerous actions, such as disabling user accounts during an investigation, due to scope creep or misunderstanding of tasks. Without strict access controls and separation of duties, AI agents could inadvertently or maliciously cause data leakage, privilege escalation, or destruction of persistent resources. The article underscores the potential for AI agents to bypass intended security controls if those controls rely solely on monitoring or approval workflows without limiting agent capabilities at the code and credential level.

The article recommends designing AI security architectures that use smaller, single-purpose agents with minimal required access, following the principle of least privilege and separation of duties. It advises against granting broad permissions to AI agents and relying solely on monitoring, guardrails, or human-in-the-loop approvals to contain them. Instead, implement strict authorization boundaries in code and credentials, ensure that multi-agent workflows independently verify permissions, and use tools like Check Point's Dangerous Deviation Detection to evaluate proposed AI actions before execution. Regularly test agent behavior with crafted requests to verify that unauthorized actions are blocked and that agents do not expand their scope beyond intended tasks.