Anthropic's deputy CISO says zero agent risk isn't the goal

Eliminating agent risk isn't realistic or the goal, according to a July 17 guide from Anthropic's deputy CISO, Jason Clinton. For any team running agents against inboxes or code, the four questions decide whether a mistake stays contained or spreads through everything the agent touches.

The guide comes down to four questions. What does the agent ingest, what can it do, what's its blast radius, and can you observe it?

Anthropic pairs those questions with concrete controls: scoped access instead of broad grants, network egress limits, and telemetry routed into a SIEM. Rollout is admin-paced, not flipped on for everyone at once.

Narrow identity and mandatory human escalation apply whenever an agent touches untrusted input, a webpage, an email, a file someone else uploaded. Most agent deployments treat ingestion and action as the same trust boundary. They aren't.

Elsewhere in the stack

Two Claude Code releases add texture to the four questions in practice. Version 2.1.214 fixed six permission-bypass bugs, including a directory wildcard rule that auto-approved writes anywhere in the tree. Version 2.1.210 hardened the agent tool against indirect prompt injection so it stops firing on webhook input.

Other vendors are converging on similar shapes. Cloudflare's audit skill splits the agent that finds a bug from the one that confirms it. Alterion's Draco enforces guardrails at the runtime level without touching application code.

The pattern across all of them is separation, not trust.