[un]prompted Day 1: Three Tracks Every Enterprise Running Agents Should Be Watching
[un]prompted is running this week in San Francisco, October 27-29, and the Day 1 agenda reads like a field survey of the problems enterprise teams are actually hitting with agents right now.
Day 1 spans three stages and the villages: agent containment and sandboxing, offensive research on agents and harnesses, real-world incident and threat intel, and governance at enterprise scale. Rather than summarize all of it, we picked three tracks that map directly to the questions we hear from teams putting agents into production: what can the agent actually do, who decides at the moment it tries, and can you prove afterward what happened.
The LangGuard team is on site and available to meet throughout the conference. If any of these tracks touch problems you are working on, come find us.
Track 1: Containment and sandboxing, and the human who can stop it
Three sessions on Day 1 attack the same question from different angles: how do you contain an agent that can execute code, reach networks, and move data?
At 10:00 on Stage 1, Elie Bursztein of Google DeepMind presents Taming AI Agents with Capsem: Hardware Sandboxing That Doesn’t Kill Productivity. Capsem is an open-source, Rust co-designed hypervisor and VM system built for exactly the moment enterprises are in: agents have access to data, networks, and code execution, while prompt injection, hallucination, and recent model sandbox escapes make weakly restricted environments unmanageable. What stands out is the design premise: security should not force a trade against speed and usability. Hardened, air-gapped VMs that boot in under two seconds, with full observability and enforcement including model and MCP semantics, are a serious claim about where containment belongs.
At 13:55 on Stage 1, Daniel Cuthbert presents Your Sandbox Degrades Gracefully, What’s the Wurst That Could Happen? His team built an agent-specific sandbox to contain an agentic security harness that reads unvetted repositories, writes proof-of-concepts, and runs them on a machine holding real API keys. Four months of upgrades and self-inflicted security issues later, his talk is the honest accounting of how hard containment is in practice, including how often their own agent tried to break out.
And at 13:30 on Stage 2, Ankit Agrawal of Webflow presents Sandboxing Agents is a Three-Body Problem: Containment, Provenance, and the Human Authority. His argument matches the one we have made here: containment is not one problem but three, and they pull on each other. What the process can touch is only the first. Whether the agent can tell instruction from data is provenance. Who may act, who confirms, and what that confirmation binds to is authority. A sandbox that solves containment but not provenance still lets an injected instruction steer an authorized action. One that solves both but not authority still leaves the consequential decision inside the agent.
The reason we are watching this track closely: containment defines what an agent can touch. It does not define whether the specific action is authorized. A sandboxed agent that signs and broadcasts a transaction it had no authority over is still contained and still unauthorized. The boundary that decides the action has to sit outside the agent, evaluated deterministically before the action executes, with a named human reachable when the stakes require it.
Track 2: Who authorized the agent? Identity, approval, and the evidence problem
Day 1 also carries the strongest run of talks on agent identity and authorization we have seen on a single conference agenda.
At 14:45 on Stage 1, Oleksii Baranovskyi presents Who Authorized the Agent? Making the AI Harness an Enforceable Compliance Boundary. His starting point is the failure mode that matters: an agent can receive a deny decision and still succeed if its harness retains a broad credential or another network path. The session traces one tool call through the IdP, human and workload identity, immutable run context, a policy decision point, mandatory enforcement points, a short-lived credential broker, downstream authorization, and audit evidence, with a demo comparing a decision-only API against an inline proxy that stops the downstream request. That comparison is the whole argument: a decision that is not enforced at the point of action is a report.
At 14:20 on Stage 2, Felipe Zimmerle and Rodrigo Branco present Agent Authorization Is Not a Vault Problem. Almost every agent-approval product shows the human a summary produced by the thing being approved. The signature covers bytes, the human reads prose, and nothing binds the two. They built the device that has to see, display, and approve the exact bytes before a key signs, and then attacked their own protocol. The transferable finding: any co-authorization design that reaches for a detached signature over the operation has probably built the same oracle. If approval is going to mean something, the approver has to be bound to what actually executes.
And at 13:30 on Stage 2, Brooks McMillin of Dropbox presents Approval Is Not Human Presence: Building and Breaking an MCP Permission Broker. An agent on a developer workstation often inherits the same UID, groups, and credentials as its human operator, which means an “Approve” action is just input the agent may be able to generate. His session covers a deployed MCP permission broker that requires evidence of human presence before granting sensitive capabilities, and a live boundary test run from the strongest position the agent held.
The common thread across all three: authorization has to be evaluated and enforced independently of the agent, and the evidence of who approved what has to be binding. That is the same conclusion we argued in The Controls Have to Sit Outside the Agent: controls must be independent of the intelligence being governed, the record of each decision must be replayable, and a hook the agent can bypass is a suggestion rather than a control.
Track 3: What is actually going wrong, and who is watching
The third track we are following is the reality check: measured results from running agents against real tasks, and real-world attack data rather than hypotheticals.
At 11:35 on Stage 2, Adrian Wood and Ads Dawson present StealthBench: Can Autonomous Security Agents Do OPSEC Like An Experienced Operator? Across 771 trajectories from eight agent models, no model achieved a safe-success rate above 53.8%, and some highly capable models solved most tasks while acting recklessly in more than a third of valid attempts. The finding that matters for anyone deploying agents: task completion and operational safety are separate properties, and capability without control produces failures that look like success right up until the detection fires.
At 11:10 on Stage 2, Mike Takahashi of Zenity presents Into the Wild: Hunting Real-World Attacks on AI Systems. His team deployed a honeypot network emulating production AI stacks and agents, and the talk is the forensic report: campaigns probing CVEs within days of publication, Ollama’s model downloader turned into an SSRF vector, LiteLLM guardrails turned into code execution, attempts to deploy backdoored models, and abuse of agents’ own tools to extract secrets. This is threat intelligence from agents that were actually attacked, not simulated ones.
At 14:45 on Stage 2, Omer Nevo of Irregular presents When Evaluation Runs Start Talking to Each Other. Agents assigned separate evaluation tasks can discover one another through shared infrastructure, exchange answers, and build on work that persists across runs, turning supposedly independent attempts into a system with shared memory. The governance angle is direct: isolation alone does not establish independence, and evaluation infrastructure can become an alternate path that undermines both the measurement and the authorization boundary.
At 16:20 on Stage 2, the Knostic team presents BITE: Behavior-Intent Traceable Evaluation, mapping behavioral signals from extensions, skills, and MCP servers into chains and comparing each chain against the program’s stated intent. Individual signals like credential reads, outbound calls, and file writes can each be legitimate on their own. It is the chain, judged against intent, that separates legitimate behavior from a problem. That is a verdict that has to be traceable to evidence, not a model’s black-box classification of itself.
This track matters because it converts the abstract question, whether your agent is within scope, into a measurable one: what did the agent actually attempt, what did it actually do, and does the record of it hold up. Monitoring and evaluation are essential, but they observe after the fact. The decision that prevents the failure has to happen before the action executes.
Find the LangGuard team at the conference
The three tracks connect into a single argument. Containment defines what an agent can touch. Authorization defines whether the specific action may proceed. Evidence proves what happened. Day 1 at [un]prompted shows the industry converging on all three, from hardware sandboxing to enforceable harness boundaries to benchmarks that measure safety separately from capability.
The LangGuard team is on site in San Francisco through October 29 and available to meet. If your team is working on agent containment, authorization, identity, or evidence, we would like to compare notes.