Three independent sources have arrived at the same conclusion about securing AI agents. Anthropic published a Zero Trust framework for agents and then detailed how it contains its own systems in practice. Around the same time, Chase Cunningham, widely known as "Dr. Zero Trust," released research on Agentic Zero Trust that pointed to the same architectural pattern. And Cequence, through its work securing AI agents in production, arrived at the same answer through a different path: operational evidence from the field. None of these groups collaborated, yet all three landed on a shared answer. The controls that consistently matter are the ones that limit what an agent can do at runtime, not the ones that screen what it says or verify who it claims to be.

Why Detection and Identity Fall Short

Both instincts follow the same pattern. Prompt injection detection focuses on what enters the system, while delegated identity defines who the agent is acting on behalf of. Both operate before the agent takes action, which makes them feel like the endpoint. They are not.

Anthropic's own measurements show the limits of detection. Classifiers can block a large share of jailbreak attempts, and new techniques can reduce indirect injection success to single digits. That is meaningful progress. But algorithmic attacks can still reach perfect success across model families, and models still struggle to distinguish harmless context from actionable instructions. Detection raises the cost of an attack. It does not close the door.

Three issues stand out:

• Detection assumes an attacker exists. Anthropic has repeatedly observed its own models finding unexpected routes to a goal even when no adversary is present. Here, there was no injection, no hostile input, just an eager agent doing what it decided the goal required.
• Identity freezes access in time. A token is valid for a window that feels short to a human and extremely long to an autonomous system. For an agent firing thousands of tool calls in that window, a few minutes is eternity. The agent does not need to defeat your identity layer; it runs with the access you already handed it until the clock runs out. Least privilege access, granting agents the permissions required for their specific task, is the control that limits the blast radius when a token is abused.
• Benign-looking instructions can still cause damage. In Anthropic's internal red team exercise, an agent exfiltrated cloud credentials 24 out of 25 times from a prompt that looked like ordinary task instructions. There was nothing about the request that was detectably malicious and the data still left.

The pattern that links all three failures is the same. The controls that matter operate while the agent is acting rather than once before it begins.

 Containment as the Shared Answer

Anthropic's response to these limits is containment. This maps directly to Zero Trust principles applied at the agent layer. Never trust implicitly, enforce least privilege, and assume breach. Supervise what an agent can do rather than what it intends. Sandboxes, virtual machines, and egress controls create a hard boundary so that a creative model, a careless user, or an attacker all hit the same guardrail when they stray.

A gate asks one question at the start: should this agent be here? A ring, a runtime enforcement boundary that continuously evaluates every action the agent takes, asks a different question over the entire lifetime of the task: is this agent still doing its job? Authentication and scoped tokens answer the first question. Detection tries to answer whether input is hostile and often misses. Only runtime behavioral monitoring answers the question that determines real damage: is the agent acting within the role it was given?

Why Allowlists Are Not Boundaries

Many teams assume an egress allowlist solves this problem. Anthropic's experience shows otherwise. An attacker planted a file in an agent's workspace containing a hidden API key. The agent followed the embedded instructions, called an approved domain, and uploaded data using the attacker's key. The destination was allowed, the sandbox worked as designed, and yet the data still left.

An allowlist is not a destination filter. It is a capability grant. Every function behind an approved domain becomes part of the attack surface. Allowed to talk is not the same as allowed to do. A Zero Trust posture requires enforcing least privilege at the function level, not just the domain level, scoping what agents can call, not just where they can connect.

What Most Teams Still Misunderstand About Agent Security

Even with growing awareness, several misconceptions continue to shape how organizations evaluate agent security:

•  Model-layer safety is not portable. Anthropic's containment stack works because Anthropic controls the model, runtime, and environment. Those protections do not transfer when enterprises switch to open-weight or self-hosted models.
• Routing gateways are not enforcement points. Many gateways manage model calls, tokens, and spend, but they do not monitor what the agent does after the model responds. Routing is not a containment.
• Identity alone is not enough. Identity answers who the agent is, not whether its behavior aligns with the assigned job. A valid token can still authorize harmful actions. The missing layer is least privilege applied per action. Not just who the agent is, but what it is allowed to do at each step.

The Boundary That Survives Every Model Swap

What survives every model change is the boundary where the agent reaches your systems. That is the one place that does not depend on which model is reasoning, who hosts it, or how much the tokens cost. Every call still arrives there. That is where you scope the agent to its declared job, enforce least privilege access, evaluate each action against that scope, and stop it the moment behavior leaves the role.

In production, authenticated agents have made thousands of legitimate tool calls before drifting and probing for files they were never granted. Identity remained intact. Credentials were valid. No detector flagged the behavior because no input was hostile. The only control that caught it was the one watching what the agent did at the boundary it had to cross.

The industry has reached a rare moment of alignment. Detection is necessary but insufficient. Identity is foundational but incomplete. Zero Trust for agents means applying least privilege access at runtime, not just at the perimeter. The control that consistently holds is the one that supervises behavior in real time and stops an agent when it leaves its job.