What agentic AI security means to us.
Decide the doors before the agent starts, keep the keys outside, and keep a record the agent does not write.
Read what we believeThree things we believe.
We like agents. We run them.
We just do not let them pick their own limits. A wrong file or a wrong host is a software problem, with an engineering answer.
The developer runs the agent. The security lead reads the same log.
When the agent needs a host nobody listed, a person says yes or no, and the answer reaches the sandbox within seconds. Nobody files a ticket, and nobody finds out a week later.
We do not trust the model. That is why the rules are not inside it.
A prompt is a wish. A sandbox is a rule.
Four rules the model does not hold.
None of them live in the prompt. The sandbox, OpenShell, enforces them outside the agent, so they hold when the model is wrong.
Pick the directories.
The workspace is writable. Your home directory is never copied in, so ~/.aws is not there to read.
Pick the hosts.
A host you never named is refused at connect. The log records which process tried, and where.
Keep the keys outside.
The agent holds a placeholder. The real key is added on the way out, only to requests for the endpoints that key is bound to.
A person approves more.
A person approves more access. The agent can ask for a host, with its reason. It cannot approve its own request.
AI did not go rogue. Someone left a door open.
What the Hugging Face incident shows once you read the reports, and what it means for the agent on your laptop. A three-minute read, with sources.
One line to install. One command to run.
curl -fsSL https://fenzi.dev/install.sh | sh
Free per machine. No account. The model does not get a vote on its own limits.