The three layers of AI agent security: from sandboxes to network proxies
How the industry is shifting from prompt engineering to systems engineering to secure the autonomous stack.
- Securing AI agents requires defense-in-depth across three layers — infrastructure, architecture/runtime, and network — because semantic guardrails like system prompt instructions can be bypassed by prompt injections or hallucinations.
- Real-world failures illustrate the stakes: a Meta OpenClaw agent deleted 200+ emails, a Claude Code agent wiped a production database and 2.5 years of work, and another coding agent caused a major outage, all by executing what they determined was the correct action.
- NemoClaw (NVIDIA) secures the infrastructure layer by sandboxing agents in Docker containers restricted via Linux Landlock, seccomp, and network namespaces, with API keys never exposed inside the agent environment and injected only by a gateway proxy after approval.
- NanoClaw addresses the runtime layer through a minimal, auditable codebase and ephemeral per-session containers, partnering with Echo to continuously rebuild the agent's software environment and strip known CVEs before they can be exploited.
- CrabTrap (Brex) enforces network-layer security as an HTTP/HTTPS proxy that passes low-risk requests through static rules instantly while routing high-risk requests to an LLM-as-a-judge, with blocked requests triggering a human-in-the-loop approval workflow.
AI agents need tools, APIs, and autonomy to become useful. However, granting AI agents privileges and unmonitored execution environments creates a massive liability.
If an autonomous agent has system access, a prompt injection hidden in an incoming email or a standard LLM hallucination can cause the agent to wipe a production database or leak AWS credentials to a public server.
The challenge for engineering teams is deploying AI agents without compromising internal systems.
Semantic guardrails, like system prompt instructions, can be circumvented. True security requires defense-in-depth across three distinct planes:
- Infrastructure layer: Host-level sandboxing that prevents a compromised agent from leaking data from the host operating system.
- Architecture and runtime layer: Single-purpose, ephemeral containers running vulnerability-free software instead of massive, unauditable codebases.
- The network layer: A zero-trust boundary that intercepts, inspects, and evaluates every outbound API call.
The security threats of AI agents
The paradox of AI agents is that the more capable you make them, the more dangerous they become. And securing them often comes at the cost of usefulness.
Instruction-based boundaries fail because agents given tools are bound by their context windows and execution environments, not their initial instructions.
This structural failure became clear during an incident at Meta. An OpenClaw agent, deployed by Meta's own alignment director, went rogue and mass-deleted over 200 emails from her primary inbox.
Another devastating infrastructure failure occurred when a developer used Claude Code to manage a cloud migration. The agent autonomously wiped a production database and 2.5 years of work.
Similarly, a coding agent using Claude Opus recently caused a major outage while cleaning up staging data.