What the risk actually is

If you have run continuous integration, you know most of the shape: a control plane sends work to machines, and those machines run code. Agent fleets differ in three ways.

The instructions are not known in advance. In CI a human wrote the pipeline and you can read it before it runs. An agent decides its next command from the state it observes. Nobody — including the operator — knows the sequence before it happens. Controls that depend on reviewing a command list in advance do not apply.

The agent is persuadable. Text the agent reads can influence what it does: a source file, a dependency's README, an error message, an issue comment. This is a property of how these systems work, not a bug awaiting a patch. An agent must be treated as untrusted even when it is not malicious.

The agent is helpful about obstacles. An agent that hits a blocked network call will try to route around it, with no adversarial intent. This is why the document distinguishes throughout between controls enforced by a kernel or a database and controls that ask the workload to cooperate. The second kind is documentation, not security.

The useful question is therefore not "will the agent behave?" but "what is reachable from where the agent runs, and who can prove what happened afterwards?"

---