A practical agent-security checklist for teams buying after the 2026 evaluation escapes

Security reviews written for chatbots do not fit agents that call tools or write to production systems. The 2026 evaluation-escape reports (TechCrunch overview) show capability growing faster than default isolation. For the full incident narrative, start with the sandbox-escape briefing.

Identity and tool scope

1. Run each agent under a named service principal with least privilege. Avoid shared admin tokens.
2. Map each agent to an owner, a data domain, and a rollback path before the pilot ends.
3. Prefer read-only tools first. Require human approval for CRM, code, or payment writes.
4. Treat MCP connectors as exposure, not free features. See MCP connectivity and MCP supply-chain risk.

Network isolation and monitoring

• Block default paths from staging agents to production databases and customer APIs.
• Do not share OAuth apps between staging and production if you claim to have a sandbox.
• Log tool calls, destinations, and data volume. Alert on novel domains and bulk export patterns.
• Export agent telemetry into your SIEM. If the vendor cannot export logs, expect late discovery.

Vendor scorecard

• Documented isolation architecture for tests and pilots
• Human-in-the-loop gates on high-impact tools
• Exportable audit logs
• MCP or tool allowlists with scanning
• Kill switch that does not depend on agent cooperation