Watching Agents for Trouble

Once an agent can touch a database, send email, or deploy something, the interesting question shifts from "is the answer good" to "how much damage can it do, and would anyone notice." And the damage often isn't one forbidden step. It's a few allowed ones that add up.

This talk is about the practices that catch it. The core one is boring on purpose: mark every moment an agent crosses a line, like reading something untrusted, handing off to another agent, or doing something with real permissions. Write those moments down as plain facts and carry them through every hop. Once they're facts, traces turn into something you can actually search. An attack like "read a poisoned input, then leak data" stops being a scary string to hunt for and becomes "this happened, then that happened."

The reassuring takeaway: little of this is new. Most of it is engineering discipline we already have, a lot of it falls straight out of ordinary Go best practices, and it's no accident memory-safe languages are becoming the default choice for building agents.