Teams now ask an agent to "look through the staging app and file tickets". That sentence hides a permission model. If the process can read the repo, call the browser, and hit internal APIs with the engineer's SSO cookie, you did not hire a reviewer. You opened a shell.
This piece is about isolation for agents you own, on work you already authorized. Not about giving a model a target on the public internet.
The failure is the missing grant
A helpful default — "the agent can use whatever the human can" — copies the human's blast radius and removes the human's judgment. The model will retry. It will follow a link in its own scratchpad. It will paste a secret into a prompt because the stack trace sat next to it.
A security review makes this worse, not better: the agent is supposed to touch auth flows, admin routes, exported dumps. Without a capability boundary, "review staging" and "read ~/.ssh" are the same syscall class.
What we actually built
AGI Core is our Rust runtime for agents — not a wrapper around someone else's framework. Tool calls go through a capability sandbox we wrote: each call is isolated; APIs, filesystem and external services exist only inside the grants you attached. The planner splits work, replans on failure, and streams every step on our WebSocket protocol so a human can see the grant get used.
Memory is a graph that survives the session, with our indexing — so the agent can remember this app's notes without sucking in the whole home directory.
In Forge IDE the reusable behaviours live as JSON skills in UIDE. The skill file is the grant list in human form: what page, what screenshot, what it must not open. The editor drives the browser; the core runs the agent. Different processes, same rule — no capability, no call.
A review that does not become the incident
- Write the job (assessment or a narrow authorized pass — the distinction).
- Attach grants: this repo, this staging host, this browser profile. Nothing else.
- Watch the stream. If the agent asks for a tool you did not grant, the answer is no.
That is the whole product claim. Not "autonomous pentest". A kernel that refuses the extra syscall.
What we refuse to claim
AGI Core is not a button that "does a pentest by itself". It will not invent a scope or bless a host you did not grant. The engagement is still a human contract — the kernel only refuses the extra syscall. If the stream shows a tool you do not recognise, you stop the run — the same way you stop a script that started writing outside the repo.
What you can order from us
Zero Day Labs takes authorized security work — we use the same products described in this series, not a rented scanner PDF.
You can write to [email protected] or the contact form and ask for:
- a security assessment (map of assets, controls, residual risk);
- an authorized pentest on a written scope;
- a web application review (from the editor: DOM, network, evidence);
- a review of agent and tool isolation (what the agent is allowed to call);
- help making test fixtures honest (locale, timezone, exit address) so the report describes your system, not the tester's laptop.
Say which job you want, the scope, and what "done" looks like. We reply with a concrete proposal — same rule as the rest of the site.