Least privilege: the cage around the agent

In industry, a robot works inside a cage to prevent accidents. Nobody reads that as distrust of the robot. In coding, an agent works with no cage at all. Then we are surprised when something goes wrong.

In 1975 Jerome Saltzer and Michael Schroeder published a paper that still anchors computer security fifty years later: every program and every user should operate with the smallest set of rights that its task requires. Nothing more [1]. They wrote it for operating systems and shared mainframes. It reads like it was written for coding agents.

1. What too many rights actually does

A 2026 study collected 42,447 agent skills from two large marketplaces and examined 31,132 of them in depth. 26.1 percent carried at least one exploitable vulnerability [2]. The sharpest finding was not a number, it was a single case: a skill named only "GIF Creator", approved by users who read exactly that description, held enough system reach to silently download and run a family of ransomware once triggered [2]. Nobody approved that. They approved a GIF tool. The rights came bundled in anyway.

2. The mechanism underneath

The reason least privilege matters specifically for agents was named in 2023: indirect prompt injection [3]. An agent reads a web page, a ticket, a file, a pull request. It cannot always tell the difference between data to process and an instruction to follow. Both arrive as the same kind of text. A malicious instruction hidden in content the agent reads does not need the agent's cooperation. It only needs its rights. An agent with narrow rights can be tricked and still do little damage. An agent with broad rights turns the same trick into a real incident.

3. Not a hypothetical

In 2025 a flaw rated 9.6 out of 10 in severity let attackers pull private source code, API keys and cloud secrets out of GitHub Copilot Chat. No malicious code had to run [6]. The attackers hid their instructions inside a comment syntax that GitHub's own interface never renders. A human reviewer saw a normal pull request. Copilot read the raw text underneath and carried out the hidden command anyway. To move the stolen data out, it encoded each character as an image request and routed the requests through GitHub's own trusted image proxy [6]. Every step of that chain is the mechanism above, aimed at a tool millions of people already run with wide reach into their code.

4. A case of our own

We didn't only read about this research. We found our own case of it. A rule was built specifically to stop an agent from loosening its own limits: certain changes needed a second reviewer, no exceptions for the agent. The rule never fired. The agent's session carried an identity with broad administrative rights. That same identity was the one exception written into the rule. For weeks the control looked intact. Nobody had tested the control against the agent it was meant to constrain [5].

5. What spec coding draws from this

Least privilege is not a checkbox, it is a design stance that runs through every layer of how an agent is built:

1. Treat everything the agent reads as data, never as a command. Structural separation between instructions and content is the direct answer to indirect prompt injection: no text an agent encounters while working earns instruction status just by arriving in the input [3].
2. Scope every tool and every token to the task, not to a role. A credential valid for everything an agent might ever do is a credential valid for everything an attacker might ever want.
3. Put the durable check in code, not in the model's judgment. A function that verifies a precondition cannot be argued with. A prompt that asks an agent to be careful can be talked out of it.
4. Require a human decision before anything leaves the sandbox. Publishing, deleting, spending, sending: the boundary between contained and irreversible is exactly where a person belongs. A robotic arm on a factory floor works inside a fenced cell for the same reason. It reaches past the fence only when a person opens the interlocked gate.
5. Examine what a capability actually touches, not what its description claims. Fine-grained analysis of agent skills, matching declared purpose against real reach, cut triggered over-privileged actions by 88.56 percent in one measured system while keeping legitimate tasks working [4]. A short description is not a rights declaration.

6. An honest limit

A robotic arm on a factory floor works inside a fenced cell. Nobody reads that fence as an accusation. A machine that size and speed simply belongs there. None of this makes an agent trustworthy. It makes the damage small when trust turns out to be misplaced, which research keeps finding it is. A confined agent can still fail. It just fails inside a smaller room. That is not a moral victory, it is an engineering one. It is the only one least privilege was ever built to deliver.

7. Conclusion: the size of the room

Give an agent every right your system has. You have described everything that could go wrong with it. Give it only what today's task needs. You have set a ceiling on how far wrong can go.

Trust is not what keeps an agent safe. The size of what it is allowed to touch is.

8. Sources

[1] J. H. Saltzer and M. D. Schroeder, "The Protection of Information in Computer Systems," Proceedings of the IEEE, vol. 63, no. 9, 1975, pp. 1278-1308.

[2] Y. Liu, W. Wang, R. Feng, Y. Zhang, G. Xu, G. Deng, Y. Li and L. Zhang, "Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale," arXiv:2601.10338, 2026.

[3] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz and M. Fritz, "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection," Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec), 2023, arXiv:2302.12173.

[4] J. Wu, Y. Nan, Y. Lin, H. Wang, Y. Xiao, S. Wang and Z. Zheng, "SkillScope: Toward Fine-Grained Least-Privilege Enforcement for Agent Skills," arXiv:2605.05868, 2026.

[5] Betteryields, "A case of our own," internal incident study, security-gates-field-study, 2026-08-01, finding F5. A rule meant to block an agent from loosening its own limits never fired. The agent's session held the identity listed as that rule's one exception.

[6] O. Mayraz, "CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code," Legit Security, Oct. 8, 2025, CVE-2025-59145.