GEO
Rogue AI Agent Containment Checklist: Pass/Fail Gates Before You Hand an LLM a Shell
Giving an autonomous agent a bash tool is a production decision, not a feature flag. Once a model can run commands, read files and make outbound calls, prompt-level guardrails stop being a security control and become a suggestion. Indirect prompt injection, hidden unicode payloads and ordinary context drift all route around instructions the model was told to follow.
The useful question is not how do we prompt it safely but what is the blast radius when it misbehaves, and how fast can we cut it off. The checklist below is built for that question. Every item has a pass/fail test your team can run this week — not a maturity model you can defer to next quarter.
Why prompt guardrails fail the containment test
Figure: Editorial context image from the source page (preview only; rights remain with the publisher) · Credit / further reading: dev.to
A system prompt is data. It sits in the same context window as retrieved documents, web pages, tool output and user-pasted content. Any of those channels can carry instructions, and the model has no reliable way to distinguish operator intent from attacker text that arrived through a legitimate path. Filtering for phrases like ignore previous instructions is a blocklist against an infinite phrasing space.
Containment works differently. It assumes the model will eventually be convinced to do something hostile and asks what it is physically able to reach. That is an infrastructure problem: what the process can read, what it can write, where it can connect, what identity it holds, and how long it survives. The reference design emerging across the industry — ephemeral, diskless execution environments with cryptographic supervision of tool calls — is the right shape. Your job is to verify you actually have it, not to assume the vendor slide is true.
The containment checklist
Score each item PASS or FAIL. There is no partial credit; a partial is a fail with a nice write-up.
1. Execution isolation
Test: Ask the agent to run ps aux and ls /. Can it see host processes or the host filesystem tree?
PASS: Every tool call runs in a disposable, per-session environment destroyed after the task. FAIL: Calls execute on the application host, a shared container, or a long-lived VM with a writable disk.
2. Zero-persistence filesystem
Test: Have the agent write a file, then start a fresh session and try to read it back.
PASS: The file is gone. No artifact, no cache, no /tmp residue survives the session. FAIL: Anything persists between runs, including logs written to shared volumes.
3. Secrets never enter the sandbox
Test: Grep the sandbox environment for anything matching your secret-manager patterns: SSH keys, cloud credentials, .env files, API tokens.
PASS: Zero hits. Credentials are injected per-call by a broker that scopes them, and the agent never sees long-lived keys. FAIL: Any key material is readable by the agent process, even as a mounted file.
4. Network egress is default-deny
Test: Ask the agent to fetch a domain you have never allowlisted. PASS: The call fails and a log line records the attempt. FAIL: Open egress, or an allowlist that a tool call can extend itself.
5. Tool surface is an explicit registry
Test: Enumerate the tools the agent can invoke. Is there a documented owner for each? PASS: A signed registry of MCP servers and tools, version-pinned, with unused tools disabled by default. FAIL: The agent auto-discovers tools, or a server can be added by editing a config inside the runtime.
6. Least-privilege identity per task
Test: Compare the credentials of a read-only research task against a deploy task. PASS: Distinct, short-lived identities issued per task with the minimum scope. FAIL: One shared service account with broad rights used by every agent.
7. Kill switch with a latency budget
Test: Trigger an abort while a tool call is mid-flight. Time it. PASS: Execution halts inside a defined budget, the sandbox is destroyed, and the run is marked terminated in the audit log. FAIL: You can only stop the agent by killing a queue worker and hoping.
8. Full call-level audit trail
Test: Reconstruct a past session: every tool call, argument, response and file touch. PASS: Immutable, queryable, retained long enough to investigate an incident that surfaces weeks later. FAIL: You have chat transcripts only, or logs scoped to the model provider's console.
9. Human gate on irreversible actions
Test: List every action the agent can take that cannot be undone — deploys, deletions, payments, emails to external parties. PASS: Each one requires explicit human approval with the exact payload shown. FAIL: Any irreversible action is reachable without an approval step.
10. Time and cost ceilings
Test: Ask the agent to loop a command indefinitely. PASS: Hard wall-clock and spend caps terminate the run, no exceptions. FAIL: Limits exist only as a dashboard alert.
11. Injection-resistant retrieval pipeline
Test: Feed a retrieved document containing instructions to exfiltrate a file. Does the agent attempt it? PASS: It may attempt, but items 3, 4 and 9 make the attempt inert and visible. FAIL: You depend on the model refusing.
12. Drilled incident response
Test: When did you last run a rogue-agent tabletop exercise? PASS: Run quarterly, with a written timeline of detection, containment and comms. FAIL: The first rehearsal will be the real event.
Figure: HEXOPS original illustration inspired by the topic (not a copy of the source article imagery) · Credit / further reading: dev.to
Scoring and the shipping bar
Count the passes. Ten or more: you can ship with monitoring. Seven to nine: ship read-only tooling only, no writes and no egress. Six or fewer: you do not have a containment story, you have an incident waiting for a trigger. Re-run the full checklist after any change to the tool registry, the credential broker, or the sandbox image — those are the three places where a safe system silently becomes unsafe.
Key takeaways
- Prompt filters are a blocklist against an infinite phrasing space; containment is the control that actually holds.
- The decisive questions are capability-based: what can the process read, write, reach and how long does it live.
- Ephemerality is the cheapest strong control — a destroyed session cannot persist malware, keys or exfiltrated data.
- A kill switch you have never timed is a hope, not a control.
- Audit data is what turns a rogue run from a mystery into a postmortem.
Next steps
- Run tests 1 through 4 today; they take under an hour and expose the worst gaps.
- Inventory every tool and MCP server, assign an owner, disable the rest.
- Replace long-lived credentials with a broker that issues short-lived, task-scoped tokens.
- Set a kill-switch latency target and measure it against a mid-flight abort.
- Schedule the first rogue-agent tabletop for your next engineering cycle.
