AI Agent Autonomy

Practical strategies for building trustworthy AI agents amid rising risks from their growing autonomy.

Agents consist of four key parts: the AI model for intelligence, a harness for instructions and guardrails, tools for actions like email or calendars, and an environment defining access. Each layer offers capabilities but also oversight needs to prevent issues like mis-actions.

Anthropic recommends a layered defense model built around four layers: the model, the tools, the harness, and the execution environment. They argue that model robustness matters, but the biggest real-world security gains come from least-privilege tool access, logging and observability in the harness, and hard boundaries like sandboxing and network restrictions in the execution environment. They also suggest user-facing controls such as plan review, uncertainty surfacing, and warnings for irreversible actions.

Users control agents by setting tool permissions (allow, approve, block) and using Plan Mode in Claude Code, where agents present full plans for review before execution. This balances autonomy with oversight, especially for subagents in complex tasks. Claude’s training encourages pausing for clarification on ambiguities.

Training helps agents recognize uncertainty and seek user input, reducing misinterpretations, while defenses against prompt injection include model training, traffic monitoring, and red-teaming. No single defense suffices; users must limit tools and permissions carefully.

Anthropic calls for shared benchmarks (e.g., via NIST), evidence sharing on agent usage, and open standards like the Model Context Protocol to enhance security across the industry.

Multi-agent systems introduce additional risks around trust escalation, delegation, and false consensus between agents. A compromised sub-agent can spread bad information through the system because agents often communicate in natural language and may treat each other’s outputs as trusted input. At the same time, multi-agent designs can improve security if they isolate untrusted work and reduce blast radius.

Using a multi agent architecture where Opus does the planning and Codex does the low level coding (screenshot below)

I discovered this funny translator tool that translates English to Linkedin Speak and vice-versa translate.kagi.com