This article delves into the crucial aspects of implementing Zero Trust security for AI agents within the Cloudflare ecosystem, building upon previous discussions. It focuses on the vital elements of data input and output validation, which are paramount for maintaining the integrity and security of AI operations. The core principle here is that AI agents, by their nature, can struggle to differentiate between legitimate instructions and malicious inputs, a vulnerability categorised by OWASP as Agent Goal Hijack (ASI01). Similarly, output validation is essential to prevent data exfiltration, ensuring that sensitive information does not leave the system, even if an agent is compromised.
The article highlights that while segmentation defines communication pathways, input/output validation governs what traverses those paths. It emphasises that validation must be an external filter, preceding the agent's processing, as an AI agent cannot be its own reliable security filter. Traditional security methods for input validation, like those for SQL injection, are insufficient due to the unpredictable and freeform nature of AI agent inputs. However, validation can still be achieved by checking against expected schemas, imposing length limits, and rejecting known malicious patterns.
Cloudflare offers various integration points for this validation. Custom tools, previously discussed, serve as a natural insertion point, with their declared input schemas rejecting malformed calls. Within these tools, developers can validate inputs, redact sensitive information, or check for authorisation before the agent acts. For command execution, the Sandbox SDK mitigates shell injection by processing user data via standard input rather than command interpolation. On the output side, Cloudflare One provides control over the MCP server channels through which agents invoke external tools. This includes curating exposed tools and subjecting access to corporate identity, thereby controlling and auditing what agents can send through these channels.
Furthermore, the article discusses the importance of observability and behaviour monitoring, stressing that while controls dictate what an agent *can* do, observability reveals what it *is* doing. This involves collecting and analysing telemetry, logs, and events to verify, adjust, and defend other security controls. In the context of AI agents, this means being able to reconstruct the chain of actions leading to an outcome to distinguish legitimate behaviour from injected prompts. Cloudflare's ecosystem offers robust session history, access logs, and tool dispatcher logs for this purpose. The article points out a significant blind spot: the execution of Anthropic's server-side tools, which occurs outside the Cloudflare account and leaves no traceable logs, undermining observability. The proposed maturation of Zero Trust involves centralising and correlating dispersed data, eliminating blind spots by design (e.g., favouring observable navigation variants), and evolving from passiv e logging to active detection through risk profiling and real-time alerting.
Finally, the piece addresses containment and recovery, assuming that defences can fail and agents can be compromised. Containment aims to limit the 'blast radius' of a compromised agent, while recovery restores operations without propagating corruption. Cloudflare provides mechanisms for immediate session termination and automatic session timeouts for containment. Isolation through separate sandboxes and strict output segmentation further limits the reach of a compromised agent. Recovery is supported by preserving and restoring session working directories. A key consideration for maturation includes automating responses to detected anomalous behaviour and hardening the blast radius by combining various controls. It also highlights the need for self-implemented task persistence for critical tasks where the default queue lacks resilience, and governing the retention of recovery data through defined policies.
Fuente Original: http://www.elladodelmal.com/2026/08/como-desplegar-zero-trust-para-agentes.html
Artículos relacionados de LaRebelión:
- OpenAI Discovers Multiple AI Agents Escaped Containment
- Enterprise AI Agents Fixing Agent Talk Trust
- Alerta Exploitan Zero-Day de Cisco FMC Datos Peligran
- AI Agents Why Bad Data Not Context Causes Errors
- Microsoft Corrige 622 Vulnerabilidades Incluyendo Dos Zero-Days
Artículo generado mediante LaRebelionBOT
