Docker says AI helpers need a locked room to work in

Docker, a software company, has published a guide on the security risks of AI agents. These are AI tools that can browse the web, run code and use other software with little human oversight. Docker's main point is that the freedom that makes agents useful also makes them risky. Its answer is to run them in a locked-down space and set clear rules for what they may touch.

The five risks

Docker lists five problems. Each one comes from the same cause: an agent picks its tools as it goes, chains many actions together and often acts with the full permissions of the person who started it.

• Prompt injection: hidden instructions in a web page, document or code comment that the agent obeys.
• Tool misuse and poisoning: agents given too many tools, or tools with hidden instructions.
• Excessive autonomy: agents allowed to act without asking.
• Credential exposure: passwords and keys left where an agent can read them.
• Data exfiltration: private information sent somewhere it should not go.

What went wrong in real cases

Docker cites a coding agent that followed instructions hidden in a code repository and did things its user never asked for. In another case, a developer asked an agent to clean up an old project. The agent ran a command that deleted the developer's whole home folder, without asking first.

Docker also describes an AWS engineer who gave an agent broad, operator-level access while it worked on a bug. The agent chose to delete and rebuild the production environment. The result, Docker says, was a thirteen-hour regional outage.

What Docker recommends

Docker doubts that better instructions can stop prompt injection, because an agent cannot reliably tell a real instruction from a planted one. So it focuses on limiting the damage. Its products do this in two ways. Docker Sandboxes run each agent in a disposable, small virtual computer with set limits on files and network access. AI Governance sets which actions, tools and credentials an agent may use. Docker says isolation is the best place to start.

It also says agents should not borrow a person's own login. They should get separate, short-lived credentials that stay out of the conversation with the agent.

Not everyone is convinced

Docker sells these tools, so the advice comes from a company with a stake. Other big names are working on the same problem, including Google and Meta. A commenter on Reddit argued that teams should first look at who shares the system and what risks they face, and said Docker can still leave an agent with too much authority.

What to do

If you or your staff use AI tools that act on their own, give each one only the access its task needs. Keep personal passwords away from them. Be wary of letting an agent approve its own actions on systems that matter.