The Problem: Your AI Agent Has Root


A few months back I was helping a team set up a self-hosted AI coding agent. Standard setup — an LLM with tool access, running on a shared dev server, able to read files, execute commands, hit APIs. The usual.

Then someone ran a prompt that included pasted output from an untrusted webpage. The agent dutifully...