Part III · The agent loop

A model answers. An agent acts, repeatedly, on its own output. The loop is what turns a bad completion into a bad action, and then into a bad action taken a hundred times. Memory is what turns a single successful injection into a persistent one.

Each part of this book splits the same three ways: how it works, how it breaks, and how you hold it. The attack and the control for one layer sit together, because that is how you actually meet them.

How it works

III.1 Anatomy of an agent - model, tools, memory, loop The four moving parts of an agent and where security lives in each: the model that decides, the tools that act, the memory that persists, and the loop that repeats. concept · 7 min read

How it breaks

III.2 Coding agents & Codex security Why coding agents are the highest-stakes agents in the enterprise, their threat surface, and the Codex sandbox/approval model as a defense template. attack · 6 min read III.3 Browser & computer-use agents Agents that drive a real browser or OS, why the live attacker-controlled web becomes an instruction channel, and how to test and contain them. attack · 9 min read III.4 Persistence & propagation - memory poisoning, worms Where model APIs, MCP, and A2A converge, the OWASP Top 10 for Agentic Applications, and worm-class self-propagating prompts like Morris II. attack · 5 min read

How you hold it

III.5 Consent & containment - sandboxes, approvals, blast radius Sizing what a hijacked agent can reach: the containment ladder, the two isolation layers, and when an approval dialog is an authorization control rather than theater. defense · 12 min read