Kai ChenCrowdStrike put the average time for an attacker to break out from an initial foothold at 29 minutes in 2025. In Xcode 26.3, Apple put Claude Agent and OpenAI Codex inside a trusted developer environment, where software can choose tools and act on a developer’s behalf. The 29-minute clock starts after an attacker gets in. An agent’s authority also begins after login, then branches into actions the checkpoint never judged.
Key takeaways
- Agentic software turns authentication into a sequence of runtime authorization decisions because one login can lead to file writes, terminal commands, repository queries and external calls.
- Each supervised agent should operate as a temporary machine principal with task-scoped credentials, limited tools and resources, an expiration rule and an auditable identity.
- Sandboxing alone is insufficient when an agent can modify artifacts later consumed by trusted, credentialed tools; authorization must cover the entire execution chain.
- Runtime enforcement creates its own systemic risk, so vendors must stage and bound policy changes while customers retain an independent way to disable the enforcer.
Xcode turns one login into many machine decisions
A developer authenticates once in Xcode. Claude Agent or Codex can then choose tools and act through the development environment. Each file write, terminal command, repository query or external call creates another decision about inherited authority.
Microsoft responded with its open-source Agent Control Specification, which gives developers a granular and consistent way to define what agents may do. Apple placed agents inside Xcode; Microsoft began specifying the controls around their actions.
A team that requires human approval for every tool call gives up much of the automation. A team that lends an agent the user’s standing authority enlarges the damage one task can cause. Teams can avoid both extremes by treating each supervised agent as a temporary principal. They create a machine identity for the task, limit its tools and resources, set an expiration rule and destroy its authority when the task ends.
A sandbox fails when a trusted tool carries authority across it
A sandbox contains an agent only when it covers every consequential path out. The model does not need to escape directly if it can alter an artifact that a more privileged tool later consumes.
Researchers demonstrated that failure mode in Cursor, Codex, Gemini CLI and Antigravity. They found sandbox escapes or boundary bypasses involving files later used by trusted tools. Most reported issues were patched, establishing a concrete failure mode without showing that vendors have settled on a common runtime architecture.
Teams can patch each path and still leave the execution chain exposed. An agent writes a file; the file becomes an instruction; a tool carrying credentials consumes it. Prompt compliance and nominal containment do not answer whether the resulting action was authorized.
Microsoft’s specification gives developers one place to encode the missing checks: whether an agent may invoke a tool, whether that tool may touch production, whether network egress is permitted and whether a credential belongs to the current task. An independent mechanism must also be able to revoke the credential and terminate execution even if the agent or policy engine keeps running.
A 65% acceleration puts response inside the action path
CrowdStrike reported that attackers moved laterally 65% faster in 2025 than a year earlier. At that measured pace, a security team that waits for an alert to enter a triage queue may act after the attacker has already taken the next step.
Coding agents tighten the constraint from the other side. They can alter the economics of exploit development by automating zero-day discovery, making repeated testing cheaper while attack automation compresses the interval between entry and movement.
An enforcement layer can convert a detection into an immediate constraint. It can narrow a credential, reject a tool call, isolate an environment or terminate a task before the next step. A security team that connects detection to those controls no longer has to route every consequential signal through another review queue.
Anthropic’s partners show security moving upstream
Anthropic’s Project Glasswing launch partners included AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, Microsoft, Nvidia and Palo Alto Networks. Those companies span models, clouds, hardware, operating environments and enforcement systems.
Anthropic limited the rollout of Claude Mythos while testing it through Glasswing partners. Palo Alto Networks said Mythos found more than 24 critical bugs using over $1 million in tokens. Security teams still had to validate, prioritize and remediate the findings, turning model output into a downstream operational workload.
The Glasswing announcement named a partner network rather than a unified control plane. Each vendor still has to connect model actions with its own identity, telemetry and enforcement systems, while sandbox patches reveal gaps one failure at a time.
That integration carries its own operational risk. A CrowdStrike update in July 2024 affected an estimated 8.5 million Windows devices. The reach that helps a security vendor enforce policy can also spread a faulty policy or update across millions of endpoints.
Vendors operating this layer must stage changes, bound their scope, preserve audit trails and make authority reversible. Customers also need an independent path to disable the enforcer so its kill switch cannot become a single point of systemic failure.
Buyers will price reach and blast radius together
CrowdStrike reported fiscal first-quarter revenue of $1.39 billion, up 26% year over year, while its shares fell more than 10%. Revenue growth did not prevent the selloff. Investors still weighed valuation, competition and the operational memory of 2024 alongside demand for AI security.
A buyer evaluating agent-runtime security should ask each vendor to demonstrate one sequence: identify a task-scoped machine actor, reject a forbidden tool call, revoke its credential, preserve the audit record and roll back a faulty enforcement update. That test makes runtime control a product requirement rather than an AI label.
Glasswing places security vendors beside model, cloud and hardware companies; CrowdStrike’s 2024 outage shows the operational reach an enforcement vendor may already have. Procurement teams should score the blast radius of the agent and the enforcer in the same review.
Twenty-nine minutes began as a breach metric. Inside an agent runtime, it exposes the flaw in a login-time decision: the agent keeps acting while the defender’s clock runs. The agent needs a badge for each action, and the badge issuer needs an independent circuit breaker.
CrowdStrike’s reach, blast radius and market repricing
- 2024-07-19 — A defect in a CrowdStrike update caused Windows failures that took banks, airlines and other businesses offline.
- 2024-07-21 — Microsoft estimated that the update affected 8.5 million Windows devices, representing less than 1% of all Windows machines.
- 2026-06-04 — CrowdStrike reported fiscal Q1 revenue of $1.39 billion, up 26% year over year; its shares fell roughly 9%–10% after hours.
- 2026-07-15 — CrowdStrike shares jumped about 12% amid a cybersecurity-stock rally following IBM CEO comments.
Frequently asked questions
Why are conventional perimeter controls too slow for agentic AI?
CrowdStrike put average attacker breakout time at 29 minutes in 2025 and said lateral movement accelerated 65%. Agent actions occur after login and can chain rapidly, so consequential detections need to trigger immediate constraints rather than wait in a triage queue.
Does runtime governance require human approval for every agent action?
No. The piece proposes task-scoped machine identities and granular policies that permit approved tools and resources while rejecting forbidden calls, production access, network egress or unrelated credentials.
How can an agent bypass a sandbox without directly escaping it?
It can alter a file or artifact that a more privileged tool later consumes as an instruction. Researchers reported variants of this trusted-tool boundary failure in Cursor, Codex, Gemini CLI and Antigravity, with most reported issues subsequently patched.
What should buyers require in an agent-runtime security demonstration?
The vendor should identify a task-scoped machine actor, reject a forbidden tool call, revoke its credential, preserve the audit record and roll back a faulty enforcement update. Procurement should assess the potential blast radius of both the agent and the enforcement platform.
Does Project Glasswing provide a unified runtime control plane?
No. Its launch partners span models, clouds, hardware and security systems, but each vendor still must connect model actions to its own identity, telemetry and enforcement infrastructure.