--- title: Security boundaries in agentic architectures | daily.dev description: Most coding agents today run generated code in the same security context as the agent harness and its secrets, creating serious risks from prompt injection... canonical: https://daily.dev/posts/security-boundaries-in-agentic-architectures-obz9fuh7a twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security boundaries in agentic architectures | daily.dev og:description: Most coding agents today run generated code in the same security context as the agent harness and its secrets, creating serious risks from prompt injection... og:url: https://daily.dev/posts/security-boundaries-in-agentic-architectures-obz9fuh7a og:image: https://api.daily.dev/og/posts/OBZ9FuH7A.png og:image:alt: Security boundaries in agentic architectures og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security boundaries in agentic architectures **[Vercel](https://daily.dev/sources/vercel)** · 9 min read · 1 upvotes · 0 comments ## Summary Most coding agents today run generated code in the same security context as the agent harness and its secrets, creating serious risks from prompt injection attacks. A framework for thinking about security boundaries in agentic systems identifies four distinct actors—the agent, agent secrets, generated code execution, and the filesystem—each deserving different trust levels. Three architectures are compared: zero boundaries (today's default), secret injection without sandboxing, and full separation of agent compute from sandbox compute. The strongest approach combines ephemeral isolated VMs for generated code with a secret injection proxy that injects credentials at the network level, preventing generated code from ever reading or exfiltrating raw secrets. Vercel's Fluid compute and Vercel Sandbox are presented as concrete implementations of this pattern. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [The Security Architecture of GitHub Agentic Workflow](https://daily.dev/posts/the-security-architecture-of-github-agentic-workflow-6pggsl2hu) · ByteByteGo · 43 upvotes · 0 comments - [Under the hood: Security architecture of GitHub Agentic Workflows](https://daily.dev/posts/under-the-hood-security-architecture-of-github-agentic-workflows-kh101sjwp) · GitHub Blog · 1 upvotes · 0 comments - [How GitHub Is Securing Agentic Workflows in Modern CI CD Systems](https://daily.dev/posts/how-github-is-securing-agentic-workflows-in-modern-ci-cd-systems-hmvfef9s3) · InfoQ · 0 upvotes · 0 comments --- Tags: [#agentic-ai](https://daily.dev/tags/agentic-ai), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#security](https://daily.dev/tags/security), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/security-boundaries-in-agentic-architectures-obz9fuh7a) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security boundaries in agentic architectures","url":"https://daily.dev/posts/security-boundaries-in-agentic-architectures-obz9fuh7a","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-boundaries-in-agentic-architectures-obz9fuh7a"},"datePublished":"2026-02-24T19:07:14.786Z","dateModified":"2026-03-15T03:44:17.418Z","description":"Most coding agents today run generated code in the same security context as the agent harness and its secrets, creating serious risks from prompt injection...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c4648550bae371cc94fcd743073a8327?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c4648550bae371cc94fcd743073a8327?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Vercel","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Vercel","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/04cca7235cf84db092f24b7ba427b3e1","url":"https://daily.dev/sources/vercel"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-boundaries-in-agentic-architectures-obz9fuh7a","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"agentic-ai,prompt-injection,security,vercel","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Vercel","item":"https://daily.dev/sources/vercel"},{"@type":"ListItem","position":3,"name":"Security boundaries in agentic architectures"}]} ```