The ZERO-TRUST LOOP: Sandboxing Multi-Agent Tool Execution
Traditional application security relies on input sanitization at the boundary. However, in an agentic ecosystem, the threat is inverted: the LLM is the boundary, and the data it consumes from external tools (web scrapers, database connectors, file parsers) acts as an unverified execution vector. If an agent processes an Indirect Prompt Injection (IPI) hidden in a public web page, it can be manipulated into executing malicious host-level commands via its own file-system or shell tools. We require an infrastructure model where agent tool execution is decoupled from the host and strictly containerized.