The question
This came in the same week Palo Alto Networks' Unit 42 published research on Amazon's Bedrock AgentCore, a toolkit businesses use to build AI agents. Out of the box, every agent session gets a shell tool and a file tool, and the shell runs as root inside the agent's environment. Nobody had to misconfigure anything for that to be true.
What we told them
Not overkill. It's the single most important setting you'll touch, and the research is a clean illustration of why.
The researchers didn't break in. They put instructions inside a support ticket, the kind of content your agent will read all day. The agent followed them and ran a command. Because that command ran with root privileges, it could read the agent's own memory, where its login credentials sat in plain text while in use. With those, the researchers called a downstream system as a trusted service account and pulled customer personal data.
Every step of that used a permission the agent already had by default. The credential vault did its job. It protected the keys at rest and in transit. It just couldn't protect them from a process that was allowed to read everything.
Amazon reviewed the report and closed it as informational, pointing to its shared responsibility model: limiting which tools a session gets and filtering outbound traffic are the customer's job. That's a fair position, and it's the part worth hearing. Whatever platform you use, the vendor decides what's convenient by default. You decide what's safe.
Here's what we'd do before that agent touches a real inbox:
- Turn off every tool it doesn't need. An agent that triages tickets has no business running shell commands. If it can't run them, an injected instruction can't either.
- Give its service accounts the narrowest access that works. Read-only where it only reads, and only the records it actually needs, so a leaked credential reaches very little.
- Watch where it talks to. A support agent should call a short, known list of systems. Anything else is worth an alert.
- Assume it will read something hostile. Every ticket, email and web page it processes is untrusted input, written by whoever sent it.
Treat an AI agent's default permissions as a starting point someone else chose, not a decision you made. Strip it down to what the job needs before it reads a single message from the outside world.