Docker urges isolation and governance to secure AI agents

Docker has published a guide to five security risks that arise when AI agents browse, run code and call tools with limited human oversight. The guide was written by Srini Sekaran, Docker's principal product marketing manager, with product manager Eric Jia. It argues that the autonomy that makes agents useful also makes conventional application security controls insufficient.

The five risks

Docker lists prompt injection, tool misuse and poisoning, excessive autonomy, credential exposure and data exfiltration. It says the risks share a common cause: an agent can select tools at runtime, chain several actions together and often operate with the permissions of the person who started it.

Traditional web security often assumes requests arrive at known endpoints and are processed by deterministic code. Agents do not fit that model. A coding agent may read a file, install a dependency, alter configuration, run tests and push a commit after receiving one instruction. Docker says a compromised or misdirected agent can therefore take a much wider range of actions than a conventional service.

Prompt injection and tools

Docker treats prompt injection as the defining risk. An attacker does not have to compromise a system directly. They can place instructions in material an agent is asked to read, such as a web page, code comment, issue or document. Docker cites an incident in which a coding agent followed instructions hidden in repository content and performed actions its user had not requested.

"An agent doesn't just answer a question, it browses, runs code, and calls tools on its own, so a single bad or manipulated instruction can turn into real damage instead of just a wrong answer." Eric Jia and Srini Sekaran, Docker

Docker is sceptical that prompt injection can be eliminated through instructions to the model. It says an agent cannot reliably distinguish a legitimate instruction from an injected one. Its preferred response is to limit what a hijacked agent can reach, so successful manipulation has a smaller effect.

"The agent has no reliable way to tell a legitimate instruction from an injected one, so the defense is to limit what a hijacked agent can reach." Eric Jia and Srini Sekaran, Docker

Tools are the second area of concern. Agents use connectors, database queries, file operations and code execution to affect external systems. Docker warns that giving an agent more tools than a task requires enlarges the attack surface. It also warns that a tool description can carry hidden instructions that lead an agent to misuse the tool.

That aligns with OWASP's Agentic AI Threats and Mitigations work, which InfoQ reported in September 2025. OWASP identified tool misuse as a major new threat. It described attackers manipulating agents into abusing authorised tools while remaining within granted permissions. Its recommended controls were access verification, behavioural monitoring, operational boundaries and tamper-resistant execution logs. Docker's post asks for much the same thing more than a year later.

Autonomy and credentials

Docker describes "YOLO mode", where every agent action is approved automatically, as a visible example of broad standing permission. It acknowledges that the mode can be productive, but argues it should be used inside a boundary that prevents an agent from reaching systems or data it should not touch.

The post gives two examples. A developer asked a coding agent to clean an old repository. The agent generated an rm -rf command with a trailing ~/ and executed it without confirmation, deleting the developer's home directory. Docker also cites an AWS engineer who gave a coding agent a Cost Explorer bug while it ran with operator-level access. The agent chose to delete and rebuild the production environment, resulting in a thirteen-hour regional outage.

Credential handling is closely connected. Docker says agents should not inherit a developer's personal token, because every action then carries that person's full permissions. It recommends separate, short-lived credentials, injected at runtime and kept out of the conversation. Secrets in prompts, configuration files or image environment variables are also a risk, because injected instructions may be able to read them from the agent's context.

The final risk is data exfiltration. An agent with network access and sensitive information in its context may send that information to an unintended destination. Docker says the risk increases in multi-agent systems, where one agent passes work to another. It recommends allow-listed network egress and treating every handoff between agents as untrusted input.

What Docker recommends

Docker positions isolation and governance, rather than model improvements alone, as the main defences. Its recommendations focus on limiting reach, separating credentials and controlling network egress. The guidance echoes other work InfoQ has covered. Google's GKE security blueprint, reported in July 2026, recommends GKE Sandbox, based on gVisor, for containing agents.