[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwJ5xREiiu8nkpgQ4EFyZACuogiT85F8p5e0NiGlfYwI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"254e6f9a-84a3-4d26-aa94-6f8353f672b4","self-hosted-ai-agents-demand-rigorous-credential-and-configuration-controls","71f32003-dddd-4058-a636-16a6b9cac038","Self-Hosted AI Agents Demand Rigorous Credential and Configuration Controls","Anthropic's self-hosted Claude Managed Agents offering highlights a critical shift in responsibility: when agent harnesses, sandboxes, and credentials move into a customer's own environment, that customer now owns the security of those assets. If credentials stored in internal secrets managers are misconfigured, over-permissioned, or inadequately audited, unattended agents can become a high-value attack vector with little human oversight. The architecture's emphasis on separating harnesses from sandboxes and using host allowlists reflects sound design principles, but those controls only work if operators implement and maintain them correctly. This matters because agentic AI systems often act autonomously over extended periods, meaning a compromised credential can cause significant damage before anyone notices.","**Immediate actions:**\n- Inventory all credentials used by agent workloads and store them exclusively in an approved secrets manager with least-privilege policies.\n- Enable and validate host allowlists for every agent sandbox so outbound connections are restricted to explicitly approved endpoints.\n- Configure OpenTelemetry log export to a centralised SIEM immediately upon deployment so agent activity is visible from day one.\n\n**Configuration hardening:**\n- Enforce strict separation between the agent harness and sandbox environments, ensuring neither can directly access the other's secrets or file system.\n- Apply short-lived, automatically rotated credentials for all unattended agent sessions to limit the blast radius of any compromise.\n- Review and enforce network segmentation so agent sandboxes cannot reach internal systems beyond their defined scope.\n\n**Long-term improvements:**\n- Establish a periodic access review cadence specifically for non-human agent identities, treating them with the same rigour as privileged human accounts.\n- Define and test an incident response playbook for agent credential compromise, including automated session termination triggers.\n- Integrate agent deployment pipelines into your existing configuration management and change-control processes to prevent drift.",[12,13,14,15,16],"NIST SP 800-53 IA-2: Identification and Authentication (Organizational Users)","NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management","CIS Control 5: Account Management","NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":18,"CIS Control 5: Account Management":19,"NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management":20,"NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations":21,"NIST SP 800-53 IA-2: Identification and Authentication (Organizational Users)":22},"This point covers access control and asset management, requiring organisations to properly govern non-human identities such as agent credentials that operate within their own infrastructure.","Unattended agent credentials are privileged non-human accounts that must be inventoried, least-privilege scoped, and regularly reviewed under a formal account management process.","Credentials and secrets stored in customer-managed secrets managers must follow established key management practices to ensure they are generated, stored, and rotated securely.","This category requires that permissions for automated agents be granted at minimum-necessary levels and regularly reviewed, directly addressing the risk of over-permissioned agent credentials.","Agent credentials are non-human identities that still require strong identification and authentication controls, which this control mandates for all system access including automated processes.","published","2026-11-12T19:21:17.73327+00:00","2026-11-12T19:21:17.711+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F12\u002Fanthropic-self-hosted-claude-managed-agents\u002F","self-hosted-claude-managed-agents-keeps-agent-credentials-in-your-environment-a53dac","Self-hosted Claude Managed Agents keeps agent credentials in your environment",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[45,49,53],{"slug":46,"name":47,"problem":48},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees."]