Small Agents, Smaller Blast Radius: Controlling What AI Can Do
SANS Internet Storm Center, Friday, October 16th, 2026
Instead of caging general-purpose AI agents, build small single-purpose agents with least privilege.
Mark Baggett argues that the industry is approaching AI security backwards by wrapping powerful general-purpose agents in containers, guardrails and human approval prompts.
If model makers struggle to control behavior, he questions whether users can reliably contain them, and he notes that models get retired and replaced, invalidating prior testing.
He recommends using capable agents to build smaller, single-purpose agents that have only the functions a task needs, such as reading logs from one directory.
This approach applies least privilege and separation of duties to agent design to limit the blast radius.