🛡️Docker Lays Out Five Security Risks Hitting AI Agents Right Now

Your AI agents can now be hijacked by a sentence

Docker just published a guide to five security risks that show up when AI agents browse, run code, and call tools with little human oversight. The headline: smarter models won't save you. Isolation and governance are the real defenses. If you're shipping agents, this hits your stack directly. Agents pick tools at runtime, chain actions together, and usually run with the permissions of whoever started them. That means a single hijacked agent can reach far more than a normal service ever could. Your existing AppSec controls weren't designed for something that decides its own next step. The five risks are prompt injection, tool misuse and poisoning, excessive autonomy, credential exposure, and data exfiltration. Prompt injection is the defining one: an attacker hides instructions in content the agent reads, and the agent can't reliably tell them apart from real instructions. Docker's preferred fix is limiting what a hijacked agent can reach, not hoping it behaves. Its Sandboxes run each agent in a disposable microVM with defined filesystem and network controls, and AI Governance defines which actions, tools, and credentials are allowed. Community debate suggests isolation alone won't settle the design question, so expect more back-and-forth.