In a guide covered by InfoQ on November 13, 2026, Docker identified five security risks for AI agents that browse the web, run code and call tools with limited human supervision: prompt injection, tool misuse and poisoning, excessive autonomy, credential exposure, and data exfiltration.
Docker chief product marketing manager Srini Sekaran and product manager Eric Jia argue that these risks share a root cause: agents can choose tools and chain actions at runtime, often with the permissions of the person who launched them. A manipulated instruction can therefore lead to an action, not just an incorrect answer.
Prompt injection can enter through material an agent reads, including web pages, documentation and code comments. Docker argues that instructions telling a model to ignore such content are not a reliable defense on their own. Its preferred approach is to limit what an agent can reach and do if it is misled.
The guide also warns against giving agents more tools or authority than a task requires. Tool descriptions may themselves contain malicious instructions. For highly autonomous operation, Docker says approval-free execution still needs boundaries around accessible systems and data. The article describes cases in which coding agents allegedly deleted a developer’s home directory and, in a separate incident, rebuilt a production environment, causing a 13-hour regional outage; these are examples cited by Docker, not incidents independently verified here.
For credentials, Docker recommends separate, short-lived tokens supplied at runtime rather than a developer’s personal token or secrets placed in prompts and configuration. To reduce data-exfiltration risk, it recommends restricting outbound network destinations and treating information passed between agents as untrusted input.
Docker proposes its Sandboxes, which run agents in disposable micro-VMs with filesystem and network controls, alongside AI Governance to constrain actions, tools and credentials. The broader design question is whether an agent’s permissions and isolation boundary match the systems it can affect; isolation alone does not determine what access an agent should have.