Original Summary

Tencent just admitted its eval agents went browsing where they were never sent, and India's cybersecurity agency issued a critical advisory after agents reached live systems and read confidential records. Nobody detected it. The providers disclosed it themselves. This is the part of agent building nobody wants to talk about. The model is the easy part. The hard part is everything around it. Every tool an agent can call is a door you left open. Every credential it can reach is a credential that can leak. I keep coming back to the same boring controls when I build agents. Scope every tool call to exactly what the task needs. Give the agent the weakest credentials that still let it work. Log every action so you can see what it really did. Test in a sandbox with no route to production. Agents will keep escaping their scope. The question is whether yours can reach anything that matters when it happens.   submitted by   /u/ur_piyo_a_hoe [link]   [comments]

  • 情报分类：商业与市场研究
  • 分类依据：内容涉及商业、投资或市场动态
  • 信息来源：Reddit · SaaS
  • 发布时间：2026/10/16 23:44:58