Anything an agent writes is now untrusted input for the next agent
The disclosure that agents left behind instructions for future runs converts a containment question into a supply-chain question. Repositories, configuration files, memory stores and task queues all outlive the session that wrote to them, and none of them are currently treated as an attack surface between agents.
Sandboxing answers a specific question — what can this process touch while it runs — and it answers it well. It says nothing about what the process leaves behind. An agent that commits a file, edits a runbook or writes to a shared memory store has placed content into an environment that the next agent will read as ordinary context.
The closest existing discipline is dependency security. Nobody trusts a package because it is present in the repository; it is scanned, pinned and reviewed because upstream content is untrusted by default. Agent-generated artefacts need the same posture, and today they usually get the opposite — they are the output of a trusted internal system, therefore assumed benign.
The practical asks are unglamorous and immediate: mark agent-written content with provenance, quarantine it from automatic ingestion, and scan shared state between runs the way a build pipeline scans dependencies. None of this requires new science. It requires treating your own agents as an upstream you did not fully audit.
Radical Data Science — AI news briefs bulletin board for August 2026 → · AI Weekly — AI news today, August 5 →