Watch: An Agent Contained by Its Controls

You have the agentic threat model and the containment mindset. This video shows both on one assistant. An agent is given an ordinary-sounding task, but a planted instruction — indirect injection through a document it reads mid-task — steers it toward a harmful tool chain: pull sensitive data, then send it outside the company. First you watch it happen on an over-privileged agent. Then the same attack runs against the contained version, and you watch each control do its job in sequence.

Pay attention to which control stops it, because there isn't one hero — there's a stack. A sandboxed, narrowly-scoped tool means the agent can't reach as much as the attacker hoped. A human-approval gate on the external send means the exfiltration never fires without a person. A loop and cost limit means a runaway plan halts and alerts instead of spiralling. That layering is the whole lesson: you assume an injection or a bad plan will happen, and you make sure the agent simply cannot do serious harm when it does.

Invalid YouTube ID or URL: PLACEHOLDER_AGENTIC_CONTAINMENT

No environment needed

Conceptual walkthrough — nothing to run. The value is seeing a multi-step agent attack succeed, then be contained, and being able to name each control that caught it: tool scope, human gate, loop limit. In an assessment that is precisely the question — not "is the agent smart enough to refuse," but "what stops it, and what evidence proves each control operates."

What to carry forward

An agent's safety is the safety of its least-contained action. A single high-risk capability left autonomous — one over-scoped tool, one ungated send — undoes a dozen careful controls elsewhere. So the design job is capability by capability: for each thing the agent can do, set the posture (autonomous, logged, human-gated, or denied) and the guardrails around it. That is exactly the exercise next, and the synthesis of everything in Phase 7.