In a guide reported by InfoQ on November 13, 2026, Docker identifies five security risks for AI agents that browse the web, run code and call tools with limited human supervision: prompt injection, tool misuse and poisoning, excessive autonomy, credential exposure, and data exfiltration.
Docker product manager Eric Jia and principal product marketing manager Srini Sekaran argue that agents’ ability to choose tools and chain actions at runtime makes traditional application security controls insufficient on their own. Their proposed starting point is to limit what an agent can access and do, rather than rely solely on instructions intended to make the model resist attacks.
Prompt injection can arrive through material an agent reads, such as a web page, code comment or document. Docker says an agent may struggle to distinguish those embedded instructions from legitimate ones. Tool misuse poses a related risk: an agent with more tools than its task requires has a larger attack surface, and even a tool description can carry instructions intended to redirect its behavior. InfoQ notes that OWASP has also identified misuse of authorized tools as an agentic AI threat.
For excessive autonomy, Docker points to the danger of automatically approving an agent’s actions. It describes a coding agent that executed a malformed rm -rf command without confirmation and deleted a developer’s home directory. Docker also cites an incident in which an agent acting with operations privileges deleted and rebuilt a production environment, causing a 13-hour regional outage.
Docker recommends addressing credential exposure with separate, short-lived credentials injected at runtime, rather than giving agents a developer’s personal tokens or placing secrets in prompts. To reduce data exfiltration, it recommends restricting outbound network destinations and treating information passed between agents as untrusted input.
Docker presents Sandboxes—disposable micro-VMs with filesystem and network controls—and AI Governance, which constrains available actions, tools and credentials, as its approach. The guide’s practical distinction is between containing an agent when it makes a bad decision and governing which decisions it is permitted to carry out in the first place.