Google’s $10,000 refund test shows why AI agents need zero trust
Google released an open-source zero-trust reference architecture for AI agents defending against prompt injection via signed database writes, gVisor sandboxing, and deterministic gating.
Google's demonstration, built on the Agent Development Kit (ADK) and Gemini, shows a customer support agent that could be manipulated into issuing a $10,000 refund on a $149 order and exposing environment variables via AI-generated Python. The architecture adds three security layers outside the model: cryptographic signatures on database writes verified via Cloud KMS backed by Cloud HSM, gVisor sandboxing of generated code with network egress disabled, and a Semantic Gateway applying deterministic checks to prompts and tool calls. It treats system prompts as insufficient boundaries because prompt injection, prompt tuning, or model updates can change agent behavior.
- Each state-changing database write is signed; background audits detect tampering like a $149-to-$10,000 change
- Generated code runs in a gVisor sandbox with network disabled and a five-second timeout
- Semantic Gateway blocks secrets in inputs, jailbreak patterns, and excessive transaction amounts
- Production guidance assigns each agent a service account with asymmetric signing keys in Cloud HSM
From the original article
3 min read at helpnetsecurity.com
Google’s open-source autonomous Customer Support & Returns Agent, built using the Agent Development Kit (ADK) and Gemini , demonstrates how developers can apply zero-trust security principles to AI agents that interact with sensitive systems and take real-world actions.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.