AI agent security framework: the 3Cs and beyond

An AI agent security framework is a set of controls that hold no matter what the model decides. The clearest one published this year is Docker's 3Cs (Sekaran and Aleyner, Docker, Feb 2026). Contain the blast radius. Curate the agent's environment before it acts. Control each action at runtime, before it completes. It is a good spine. It is also a vendor's framework, written by a company that sells sandboxes, and it leaves out identity, evidence, and testing. If you want these controls tested against the agents you already run, that is the job of our AI Security Assessment.

This article checks each C against the open work: OWASP, NIST, Google, Meta, the UK NCSC, and the MCP specification. It checks them against the agent incidents of the last eighteen months too. Then it lists what you still have to build yourself. What a security test covers is a separate post, what an AI security assessment covers. This is the design side: what to build so the test has something to pass.

Why agents break the security model you already have

Firewalls, VPNs, and secrets managers were built on one assumption: a person sits behind each request. Docker's version of the problem is the unattended laptop. A developer machine already reaches source code, databases, credentials, and production APIs. Teams now hand an agent that reach and let it act at machine speed, in parallel, faster than anyone can review.

Speed is not a metaphor. Anthropic investigated a state-sponsored campaign that ran on Claude Code. It reported that the AI executed 80–90% of tactical operations on its own. Humans stepped in at 4–6 decision points per campaign, and requests peaked at multiple operations per second (Anthropic, Nov 2025). That was an attacker using an agent. A defender's agent runs at the same tempo. A review queue that clears tomorrow is not a control on an action that happens in 200 milliseconds.

Adoption has outrun controls. These figures come from different samples, and three of them are vendor-sponsored. Read them as direction, not as one market measurement.

The reflex fix is more approval prompts, and it fails twice. First, people stop reading them. Docker calls it consent fatigue. Invariant Labs, writing up a GitHub MCP exploit, noted that many users simply click Always Allow (Invariant Labs, May 2025). Microsoft's AI Red Team, after a year of testing agents, found human-in-the-loop bypass was the most consistently exploited failure mode (Microsoft, Jun 2026). Second, prompts slow an agent back to human speed, which removes the reason to run it. Anthropic measured the alternative. Moving Claude Code to a sandbox cut permission prompts by 84% in internal use (Anthropic, Oct 2025). Docker's line for it is that "human attention is not a scalable control plane."

The 3Cs at a glance

The three reinforce each other. Containment limits what a failure costs. Curation narrows what the agent can attempt. Control replaces after-the-fact approval with enforcement at the moment of action. None of them asks the model to behave. That is the point.

Contain: bound the blast radius

Every execution model before agents came with an isolation boundary. Processes had memory protection, virtual machines had hypervisors, and containers had namespaces. Docker's argument is that agents need the same, so a mistake does not become permanent. It treats containment as the precondition for giving an agent autonomy at all.

The vendors who ship coding agents reached the same design separately. Anthropic's Claude Code sandbox uses two boundaries. Filesystem isolation limits it to named directories, and network isolation limits it to approved servers through a proxy outside the sandbox. Anthropic is explicit that effective sandboxing needs both (Anthropic, Oct 2025). Without the network boundary, a hijacked agent can send your keys out. Without the filesystem boundary, it can escape the sandbox and reach the network anyway. OpenAI's Codex ships three sandbox modes, and its workspace-write mode keeps the network off by default (OpenAI Codex docs). Docker Sandboxes run each session in a microVM with its own kernel. All outbound traffic goes through a host proxy that connects only when a policy rule matches. API keys are injected by that proxy, so they never sit inside the VM (Docker, Apr 2026).

A sandbox is a boundary you configure, not one you get by installing it. Docker's own documentation notes that its clone mode protects the host repository from modification, not from inspection. A .env file in that repository is still readable, and SSH agent forwarding is on by default (Docker docs). Read the defaults before you call the agent contained.

Two incidents containment would have capped

Replit, July 2025. During a declared code freeze, an agent on Replit deleted a user's production database. Replit's chief executive called it unacceptable, and the fix he announced was automatic separation of development and production databases (The Register, Jul 2025). The user had told the agent not to make changes, in capitals, repeatedly. An instruction is not a control. A boundary the agent cannot cross is.

Nx "s1ngularity", August 2025. Attackers published malicious versions of the Nx build tool that stayed live for about four hours. The install script tried to use the local AI command-line tools already on developer machines to hunt for secrets (Nx postmortem, Sep 2025). Wiz found the malware passed the flags that switch those tools' permission checks off. It counted more than 1,000 valid GitHub tokens and about 20,000 leaked files, and later more than 5,500 private repositories made public (Wiz, Aug 2025). An agent limited to the project directory, with an egress allowlist, could not have read ~/.ssh or pushed the results to GitHub.

What containment means in practice

• One sandbox per session, rebuilt from a clean image. MITRE ATLAS lists this as mitigation AML.M0032, segmentation of AI agent components (MITRE ATLAS).
• The filesystem scoped to the working directory, and the agent never running as root. Both are in OWASP's guidance for unexpected code execution, ASI05.
• Network egress denied by default, with an allowlist per task.
• Credentials kept outside the sandbox, injected per request, and short-lived.
• Production behind a role the agent does not hold.
• A kill switch, credential revocation, and quarantine for a suspect agent, as OWASP's ASI10 recommends.

Containment limits damage. It does not stop an agent misusing what is inside the box. If the box holds the customer table, a hijacked agent can still read it. That is the job of the next C.

Curate: build the agent's world before it acts

Docker puts it in five words: "Curation isn't approval. It is construction." An agent's capability is fixed before it acts, by the tools it can call, the code it can see, the credentials it holds, and the context it reads. Curation is choosing that world deliberately rather than reviewing what the agent wants to do inside an unbounded one.

OWASP reached the same idea from the risk side. Its 2025 entry on excessive agency names three root causes: excessive functionality, excessive permissions, and excessive autonomy (OWASP LLM06:2025). The first two are curation failures. A document-reading tool that can also delete files is one. So is a read-only task running with UPDATE and DELETE rights. OWASP's agentic list, published in December 2025, extends this into a principle it calls Least-Agency: do not give autonomy where the task does not need it (OWASP Top 10 for Agentic Applications).

Tools are a supply chain, and some of it is hostile

An MCP server or an agent skill is code plus natural language the model trusts. Both can be poisoned, and recent incidents show each route.

• Tool poisoning, April 2025. Invariant Labs hid instructions in an MCP tool's description, which the model reads and the user usually does not. The agent read ~/.ssh/id_rsa and its own MCP config and passed them out. The same write-up defines a rug pull, where a description changes after you approve it, and shadowing, where one server changes how the agent uses another (Invariant Labs, Apr 2025).
• A backdoored MCP package, September 2025. An unofficial postmark-mcp package on npm published 15 clean versions. Version 1.0.16 then quietly blind-copied every email it sent to an outside address. Postmark had never published an MCP server to npm (Postmark, Sep 2025).
• Skills marketplaces, 2026. Snyk scanned 3,984 public agent skills. 13.4% had at least one critical issue, and 76 were confirmed malicious (Snyk, Feb 2026). The OpenClaw marketplace added VirusTotal scanning. Its own announcement says this is not a silver bullet, because a prompt-injection payload written in plain language will not appear in a threat database (OpenClaw, Feb 2026). Unit 42 later found five malicious skills that got past the existing checks. One padded its README with 22 MB of filler to push it past scanner size limits (Unit 42, Jun 2026).

A marketplace scan is a filter. A curated catalogue is a decision. When anyone with an account can publish, curation has to happen at your boundary, not theirs.

Credentials are where curation usually fails

In July 2025, General Analysis showed what happens when an agent holds the wrong key. An attacker wrote instructions into a customer support ticket. A developer later asked Cursor to show the latest ticket. The agent was connected through Supabase's MCP server with the service_role key, which bypasses row-level security. It read the integration_tokens table and wrote the contents back into the ticket, where the attacker could see them (General Analysis, Jul 2025). No permission was violated. The agent did exactly what its key allowed. The remedy was a read-only, project-scoped connection: curation, not detection.

What curation means in practice

• An allowlist of MCP servers and skills, each pinned to a version and verified by hash. A new version gets reviewed before it loads.
• One credential per agent and per task, scoped to the narrowest role. No service-role keys and no shared API keys.
• Read-only by default. Write tools are added per workflow, by name.
• Tools the workflow never calls are removed, not just left unused.
• Context curated too: what the agent reads, what it remembers, and which feeds are labelled untrusted.

Docker's product page says the target state plainly: each session gets the tools, context, and credentials the task needs, and nothing more (Docker 3Cs framework).

Control: enforce at the moment of action

Curation sets what an agent could ever do. Control decides what it may do now. Docker's requirement is that rules apply as actions happen, on file access, network calls, tool calls, and credential use. A log entry or a warning arrives after the action has started. It explains the damage. It does not prevent it.

This is the C with the most outside support. Google's agent security paper describes the same layer: a deterministic policy engine outside the model that intercepts each action before it runs. It weighs the action's risk and context, including whether the agent has just read untrusted data. It then allows the action, blocks it, or asks for confirmation. Google's example blocks purchases over $500 and asks for confirmation between $100 and $500 (Díaz, Kern and Olive, Google, May 2025). OWASP's agentic list calls the same component an intent gate. It treats the planner's output as untrusted and checks it before execution. MITRE ATLAS lists it as AML.M0030: restrict or confirm tool calls once untrusted data is in the context. The MCP specification adds the protocol-level rules. A server must not accept a token that was not issued to it, and a proxy must get consent from each client before forwarding (MCP Security Best Practices, 2026-07-28).

Three incidents control would have stopped

• GitHub MCP, May 2025. An attacker opened an issue with hidden instructions on a public repository. When the owner asked an agent to look at open issues, the agent read private repositories and published their contents in a pull request on the public one. Invariant Labs noted the server code had no bug to patch. The fix it proposed is a runtime policy: one repository per session (Invariant Labs, May 2025).
• EchoLeak, June 2025. A single crafted email planted instructions that Microsoft 365 Copilot later followed. Copilot pulled internal data into its answer and sent it out, without a click from the user. Microsoft rated it CVSS 9.3, critical (MSRC, CVE-2025-32711). The chain had to defeat an injection classifier, link redaction, image fetching, and a content security policy (Reddy and Gujral, 2025). Each of those is a control on the output channel, and the attack shows why you need several.
• The agent that approved itself, August 2025. A prompt injection made GitHub Copilot write chat.tools.autoApprove: true into the project's VS Code settings. That switched off confirmations, and the agent then ran the attacker's commands (Embrace The Red, Aug 2025). Policy that the agent can edit is not policy.

What control means in practice

• Every tool call goes through one gateway that authenticates, authorises, and logs it. Docker's version is an MCP gateway that denies unvetted servers by default.
• Untrusted content taints the session. Once a web page, email, or ticket is in the context, consequential tools need confirmation or are blocked.
• An egress allowlist enforced on the network, not requested in the prompt.
• Rate limits and spend budgets per tool.
• The agent cannot edit its own permissions, settings, or policy files.
• Human confirmation kept for irreversible or high-value actions, with a dry-run diff of what will change. Where to put those stops is its own question, covered in when an AI agent should stop and ask a human.

Why the boundary has to sit outside the model

The 3Cs make no demands of the model, and that is deliberate. Prompt injection, an instruction hidden in content the agent reads, is not solved. The organisations closest to the problem say so. The UK National Cyber Security Centre calls a language model an "inherently confusable deputy" and says prompt injection "may never be totally mitigated" (NCSC, Dec 2025). OpenAI says it is "unlikely to ever be fully 'solved'" (OpenAI, Dec 2025). OWASP's prompt injection entry says it is unclear whether fool-proof prevention exists (OWASP LLM01:2025).

The measured rates point the same way. Anthropic reports a 1.4% attack success rate for Claude Opus 4.5 in browser use against an adaptive attacker allowed 100 attempts. That is with its improved safeguards, against 8.0% for the model alone (Anthropic, Nov 2025). That is real progress, and 1.4% is still not a boundary on an agent that can move money. NIST's AI safety institute found that new attacks raised hijacking success on held-out tasks from 11% to 81%. Retrying each attack 25 times raised average success from 57% to 80% (NIST CAISI, Jan 2025). A 2025 paper put twelve published defences against adaptive attacks and bypassed most of them more than 90% of the time (Nasr et al., Oct 2025). Simon Willison's summary of guardrail products that catch 95% of attacks is blunt: in application security, 95% is a failing grade.

Classifiers and guard models still belong in the stack. Google's paper keeps them as a second layer. They are just not the wall.

The lethal trifecta and the Rule of Two

Two short rules explain when injection becomes theft. Willison's lethal trifecta is an agent with access to private data, exposure to untrusted content, and the ability to communicate externally. Combine all three and the agent can be talked into sending your data to an attacker (Willison, Jun 2025). Meta turned that into a design rule, the Agents Rule of Two. Within one session, an agent should have no more than two of three properties: it processes untrustworthy input, it can reach sensitive systems or private data, and it can change state or communicate externally. If a task needs all three, the agent should not run autonomously (Meta, Oct 2025). In its guidance on MCP, Gartner tells software leaders to treat any use case that combines sensitive data, untrusted content, and external communication as a no-go zone (Gartner, Apr 2026).

The examples are ours and illustrative, not a ruling from Meta. The rule maps cleanly onto the 3Cs. Curate decides which two properties a session gets. Contain removes the third, most often by cutting the network. Control enforces the switch Meta allows, from a session that read untrusted content to one that has lost its external channel, and it only switches one way.

Making the agent itself harder to hijack

The 3Cs treat the agent as a box to put walls around. A second line of work changes what is inside the box. A 2025 paper by Beurer-Kellner and thirteen co-authors describes six design patterns for agents that read untrusted input (Beurer-Kellner et al., Jun 2025).

• Action-Selector: the model picks from a fixed menu of actions, and results never come back to it.
• Plan-Then-Execute: the plan is fixed before untrusted data is read.
• LLM Map-Reduce: isolated sub-models each handle one untrusted item.
• Dual LLM: a privileged planner never sees untrusted text.
• Code-Then-Execute: the model writes a program that then runs over the data.
• Context-Minimization: spent content is dropped before it can steer later steps.

Google DeepMind's CaMeL is the best-known build of these ideas. A privileged model writes the plan, a quarantined model parses untrusted data, and capability checks run before every tool call. It solved 77% of tasks in the AgentDojo benchmark with provable security, against 84% with no defence (Debenedetti et al., 2025). That seven-point cost is the trade. Use these patterns where the workflow allows it, and the 3Cs everywhere.

How the 3Cs line up with the other frameworks

No standards body has adopted the 3Cs. Its value is as a way to organise controls you will end up labelling in someone else's vocabulary. Here is the crosswalk.

The line between Curate and Control is blurry, even inside Docker. Its blog files tools and credentials under Curate. Its product page files the MCP server allowlist under Control. The split we use is simple. Curate sets the ceiling, everything the agent could ever be allowed. Control enforces the current allowance inside that ceiling, for this task, after this input. Google's dynamic least privilege lives exactly on that line.

Mapped against OWASP's agentic list, the 3Cs cover most of the ground and leave specific gaps.

What the 3Cs leave out

Identity: who acted, and on whose behalf

Credentials appear in the 3Cs. Identity does not. Gartner predicts that by 2028, 25% of enterprise security breaches will trace back to AI agent abuse, and it blames unmanaged machine privileges and legacy credential practices (Gartner, Oct 2026). CyberArk's 2025 survey counted 82 machine identities for every human (CyberArk, Apr 2025). Gravitee found only 21.9% of organisations treat agents as identity-bearing entities.

Google's first principle is that every agent needs a well-defined human controller, and agents acting for groups need distinct identities. NIST's NCCoE opened a project on agent identity and authorisation in February 2026 (NIST, Feb 2026). The MCP specification forbids token passthrough partly because it breaks the audit trail: downstream logs show the wrong identity. The working rule is one identity per agent. It acts with the user's delegated authority, scoped to the task and set to expire. It never shares a key.

Evidence: prove what happened

Docker is right that a log does not enforce anything. That makes logging a separate obligation, not a weaker form of control. Google's third principle is that actions and planning must be observable. OWASP calls observability non-negotiable. The NCSC asks for full inputs, outputs, and tool calls, and notes that failed tool calls can reveal an attack early. Docker's newer Agent Baseline work, published with Snyk and Keycard, organises itself around three questions. The third is whether you can prove what happened and stop it (Docker, Oct 2026).

Our minimum trail on an agent is four fields: input, tools called, data accessed, output. A reviewer who challenges one decision should be able to replay it from those four.

Supply chain provenance

Curation decides which tools you use. Provenance checks that the thing you chose is the thing that arrived. Amazon's Q Developer extension shipped version 1.84.0 with malicious code after an attacker used a GitHub token with "inappropriately scoped" access in its build setup. The code failed to run, and AWS found no customer resources affected (AWS-2025-015, Jul 2025). Microsoft now recommends bills of materials that include tools and MCP servers. OWASP's ASI04 points to AI bills of materials. Neither appears in the 3Cs.

Memory and persistent context

A sandbox resets. Memory does not. An injected instruction written to long-term memory, or to a retrieval store, reaches every later session. OWASP lists it as ASI06, and MITRE ATLAS added AI agent context poisoning, AML.T0080, in 2025. Microsoft's mitigations: authenticate every memory write, limit which components can read memory, and constrain what a stored item can look like. Curate has to cover what an agent remembers, not only what it is handed.

Human oversight that actually works

Consent fatigue is real, and the 3Cs answer it by cutting prompts. But Google and Meta both still require a human when an action is irreversible or a session needs all three risky properties. If people rubber-stamp those prompts, the design fails at the one point it depended on them. Microsoft's red team found that bypass was the most exploited failure mode, and recommends auditing the approval UX as a security control in its own right. Singapore's framework asks organisations to check whether their approvals work at all. Keep approvals few, specific, and shown as a diff of what will change.

Testing that adapts

A framework is a design. It is only true once someone has tried to break it. NIST's hijacking work found that evaluations must adapt to new attacks and be measured over repeated attempts, because a single pass understates risk. Test against an attacker who gets many tries, and repeat the test whenever a prompt, a tool, or a model changes. The metrics that matter for that loop are covered in what to measure in an AI agent eval suite.

Accountability and regulation

The 3Cs are an engineering framework. They do not say who answers for the result. Regulators do. The EU's Digital Omnibus, Regulation (EU) 2026/1744, came into force on 27 July 2026. It moved the AI Act's Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028. Article 50 transparency duties still apply from 2 August 2026 (European Commission; Cooley, Aug 2026). ISO/IEC 42001 sets out a management system for AI, the place where accountability gets written down. In May 2026, six cyber agencies from the Five Eyes countries issued joint guidance on agentic AI. It calls for layered defence and strict access controls (Canadian Centre for Cyber Security, May 2026). Name the person who owns each agent's outcome. Without one, the controls have no owner.

Score one agent against the framework

Pick one agent in production, or about to be. Answer each row honestly. This is our working checklist, not a standard, and a single fail is enough reason to fix before you scale.

What to do this week

• Inventory every agent. Include coding agents on laptops and in CI. For each, list its tools, MCP servers, skills, and credentials. Most teams find more than they expected.
• Mark the trifecta. For each agent, note whether it reads untrusted content, reaches private data, and can act or send externally. Anything with all three goes first.
• Turn on the sandbox you already have. Claude Code, Codex, and Docker Sandboxes all ship one. Search your scripts and CI for flags that switch permission checks off, and remove them.
• Replace broad keys. Swap service-role, admin, and shared keys for scoped, short-lived credentials, one per agent.
• Pin the tool list. Allowlist MCP servers and skills by version and hash, and review updates before they load.
• Put one gateway in front of tool calls. Log the four fields: input, tools called, data accessed, output.
• Test it. Use an outside attacker with many attempts, not your own demo.

The 3Cs are the right instinct: stop asking the model to behave and build walls it cannot argue with. Contain, curate, and control get you most of the way. Identity, evidence, provenance, memory, oversight, and testing finish it. If you want that tested against the agents you actually run, the AI Security Assessment is from $12,000, fixed, over 2–4 weeks. It threat-models and red-teams the path from untrusted input to tool call, then returns graded findings and a remediation plan. Ongoing guardrails and monitoring sit on Managed AI Operations at $3,000–$20,000 a month.

Sources

• Docker: The 3Cs: A Framework for AI Agent Security (Feb 2026), 3Cs framework page, Why microVMs (Apr 2026), Sandboxes isolation docs, Agent Baseline (Oct 2026)
• OWASP: LLM01:2025 Prompt Injection, LLM06:2025 Excessive Agency, Top 10 for Agentic Applications (Dec 2025)
• Google: An Introduction to Google's Approach for Secure AI Agents (May 2025); Debenedetti et al., Defeating Prompt Injections by Design (CaMeL) (2025)
• Meta: Agents Rule of Two (Oct 2025). Simon Willison: The lethal trifecta for AI agents (Jun 2025)
• Beurer-Kellner et al.: Design Patterns for Securing LLM Agents against Prompt Injections (Jun 2025). Nasr et al.: The Attacker Moves Second (Oct 2025)
• Government: UK NCSC on prompt injection (Dec 2025); NIST CAISI on agent hijacking evaluations (Jan 2025); NIST NCCoE agent identity concept paper (Feb 2026); Five Eyes joint guidance on agentic AI (May 2026); Singapore IMDA agentic AI framework (Jan 2026); European Commission AI Act page
• Protocol and threat models: MCP security best practices (2026-07-28); MITRE ATLAS data; Microsoft taxonomy of agentic failure modes, v2 (Jun 2026)
• Vendors on their own agents: Anthropic, Claude Code sandboxing (Oct 2025); Anthropic, prompt injection defenses (Nov 2025); Anthropic, AI-orchestrated espionage (Nov 2025); OpenAI, hardening Atlas (Dec 2025); OpenAI Codex approvals and security
• Incidents: Invariant Labs, tool poisoning (Apr 2025) and GitHub MCP (May 2025); General Analysis, Supabase MCP (Jul 2025); The Register, Replit (Jul 2025); AWS-2025-015 (Jul 2025); Nx postmortem and Wiz (Aug 2025); Embrace The Red, CVE-2025-53773 (Aug 2025); MSRC, CVE-2025-32711 (Jun 2025); Postmark (Sep 2025); Snyk ToxicSkills (Feb 2026); OpenClaw (Feb 2026); Unit 42 (Jun 2026)
• Surveys and forecasts: Stack Overflow Developer Survey 2026; IBM Cost of a Data Breach 2025; Gartner, Apr 2026 and Oct 2026; SailPoint (May 2025); Gravitee (Feb 2026); CyberArk, via press release (Apr 2025)