About this site

Agent Security Explained is about building agents that stay safe: where the trust boundaries are, how labels flow, why untrusted input cannot be trusted to stay data, the lethal trifecta, least privilege and scoped credentials, and sandboxing. It covers defences only: threats appear as the categories their papers name, in a sentence or two, with no example attacks. It is the sixth of a family of agent sites, after Agent Harnesses Explained, Agent Protocols Explained, Agent Context Explained, Agent Orchestration Explained and Agent Evals Explained, next to the LLM-systems sites (the Transformer Decoder Explainer, LLM Inference Explained and others, all in the header's menu). Chapters 6 to 10 weigh the defences: why detection never reaches zero, designs that make safety structural, humans in the loop, what each defence costs on a suite of 120 benign tasks against what it leaves (the security–utility frontier), and a checklist that audits a design against every chapter.

Labels, not content

No model runs, and no text is modelled. Each value carries a label: a source (the user, a trusted tool, or untrusted) and a sensitivity (public or private), 6 labels in all, ordered as a lattice. The engine runs small task plans over 8 abstract tools, propagates labels, and applies a policy whose every decision lists the rules that fired. It assumes the worst about the model: once it has read untrusted data, any choice it makes may be that data's choice. The published measurements the chapters quote (for example InjecAgent's 24%, Zhan et al. 2024) are quoted from their papers, each checked at export.arxiv.org.

The engine, and how it is tested

The engine is Agent_Loop_Sim's policy module (engine 1.11.0): a Python reference with a TypeScript port, vendored here at commit bc41598 with every file's SHA-256 recorded. In the engine's CI:

• every lattice law (order, least upper and greatest lower bounds, commutativity, associativity, absorption) is checked on all 6 labels;
• on every plan of up to three calls, under several grants, in both kinds of agent and with approvals granted or refused, each call's label equals an independent computation from the reads it depends on, and no call that ran carried private data out under untrusted control; decisions never relax when a label rises or a grant shrinks;
• the trifecta check equals an exhaustive search for a flow out on every one of the 256 subsets of the tools; the sandbox layers only ever stop more as layers are added; the defence-in-depth formulas match a seeded simulation;
• the cost and risk of every defence on the benign suite match a seeded simulation; least privilege never adds risk or blocks a benign task; an adaptive attacker never lowers risk; each approval threshold asks at least as often as the one before; the frontier matches its definition on random point sets; a plan that branches on a value is never stricter once the branch is dropped;
• the TS port reproduces every fixture exactly, with no tolerance.

• In this site's CI, the Python reference installed from the vendored commit regenerates this site's fixtures (everything each chapter animates), and the unit tests require the vendored TS engine to reproduce them exactly.
• Every number in the prose is computed by the engine when the page is built, never typed in. The recorded run is on the data page.
• Every code block in a chapter is cut from the vendored engine, and every equation compiles; end-to-end tests play, step, scrub and reset every animation in light and dark mode at desktop and phone widths, and check its captions at key steps against the Python reference's frames.

What is illustrative

• The 8 tools, 3 destinations, 6 tasks, the grants, scopes and servers, and the sandbox's 8 actions and 3 layers are abstract placeholders, not products.
• The rules are one reasonable policy, not a standard: real systems choose their own rules, and their own trade-off between asking the user and refusing.
• The published rates hold for their papers' models and test suites; they are not the rate for any other agent.
• Part two: the suite of benign tasks, two of the three detector layers' miss and false-positive rates, the approval miss rates and fatigue, one steering attempt per task, the planner's one extra call, the checklist's thresholds and 5% risk budget, and the adaptive attacker's “every detector passed” (a bound read from Zhan et al. 2025). Threats are only ever an abstract event: an attempt, a route, a label.

Accessibility

Every animation has keyboard controls (Space plays or pauses, the arrow keys step), a live caption read out by screen readers, and starts paused when the reader prefers reduced motion. Colours come from Okabe and Ito's colour-blind-safe palette, and nothing is told by colour alone: every label is also written out, private values are hatched with a heavier outline, and a denial is marked ✕ and hatched.

Source

The site's source is on GitHub (MIT). The design patterns behind chapter 7 are surveyed by Beurer-Kellner et al. (2025).