In a nutshell: Google describes a zero-trust architecture for its Agent Development Kit built from cryptographically signed database writes, gVisor sandboxing, and semantic gateways to protect AI agents against prompt injections and code execution attacks.
In a developer blog post, Google shows how autonomous AI agents that modify production system states can be secured against prompt injections and malicious code execution using a zero-trust architecture. At the center is the Agent Development Kit (ADK), which relies on infrastructural security mechanisms that go beyond soft system prompts.
According to Google’s blog post, it is no longer sufficient for agents that write production data or execute code to rely solely on instructions in the system prompt. Instead, Google recommends a robust zero-trust architecture with three concrete technical building blocks: hardware-backed cryptographic signatures for database writes, kernel-level sandboxing via gVisor for dynamically executed code, and deterministic semantic gateways for validating inputs and outputs.
For engineering teams running multi-step, tool-using agents in production environments with the Agent Development Kit, this is relevant because prompt injection attacks specifically attempt to trick agents into unauthorized data manipulation or the execution of malicious code. Purely prompt-based protection is considered inadequate, as it can be circumvented through cleverly crafted inputs. The measures Google describes shift the security enforcement to the infrastructure level, where it cannot be undermined by manipulating the model’s output.
Concretely, this means for implementation: database writes are secured through cryptographic signatures based on hardware trust anchors, so that a compromised agent cannot make unnoticed changes. For the execution of dynamic code, gVisor is used as a kernel-level sandbox that limits access to the underlying system. Semantic gateways also deterministically check whether the agents’ inputs and outputs match expected patterns before they are processed further. In combination, these three layers are intended to enable multi-tool agents to be deployed in production without incurring the risk of server compromise or unauthorized data manipulation.
Source: developers.googleblog.com · Published
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.