Summary
AI agents are not just chatbots. They operate autonomously without waiting for step-by-step human instructions, invoke the tools they are connected to, and sometimes coordinate with other agents to complete a task. This degree of autonomy has the power to transform how work gets done, but it also introduces new risks. In this article, we examine what it takes to reduce and govern the risks associated with greater agent autonomy, and share the results of our hands-on validation of a practical approach that combines NVIDIA OpenShell™ with TrendAI Vision One™.
New Risks Introduced by AI Agents
AI agents have moved well beyond personal use and are rapidly being adopted in enterprise systems. Many readers are likely already using AI agents or evaluating them for deployment. According to a survey by PwC Japan Group, 71% of Japanese companies report that they understand AI agents and have either deployed them, are in the process of deploying them, or are considering doing so. Adoption is clearly accelerating.
(References)
One thing that must be considered when using AI agents is the security risk they carry. Real-world incidents have already been reported, including attacks that use prompt injection to make an AI leak confidential information, and cases where an agent granted excessive privileges performed inappropriate operations*1. In July 2026, OpenAI disclosed a case in which a group of AI agents running in its evaluation environment circumvented their intended constraints and ultimately broke into external systems*2. The risks unique to AI agents are no longer hypothetical.
(References)
*1 OWASP GenAI Exploit Round-up Report Q1 2026 – OWASP Gen AI Security Project
*2 The Hugging Face Incident and the Road Ahead | OpenAI
These risks are also cataloged in the OWASP Top 10 for Agentic Applications 2026 (Figure 1). AI agents take natural language as input, make decisions autonomously, retain long-term memory, and coordinate with multiple other agents and tools. Each of these traits gives rise to security risks that differ from those of traditional applications.
(References)
OWASP Top 10 for Agentic Applications for 2026 – OWASP Gen AI Security Project
How to Bring AI Agent Risk Under Control
As we have seen, AI agents carry risks that differ from those of conventional business systems whose behavior is defined deterministically. What matters is not to halt adoption because of these risks, but to use agents safely under appropriate controls. So how should an organization go about reducing and governing AI agent risk? One useful guide is the AI Control Assurance Level (AI-CAL) framework proposed by PwC Japan Group in "The Age of Autonomous AI: Cyber Risks of AI Agents and Practical Governance," a report co-authored with Trend Micro. AI-CAL maps the control requirements needed for production deployment to the autonomy level of the AI agent. Let's look at how AI-CAL can be put into practice.
(References)
Understand the autonomy level of the agent you are deploying, and the AI-CAL that applies to it
The first step toward implementing AI-CAL is understanding the autonomy level of the AI agent your organization intends to deploy. The report classifies autonomy along six dimensions (see Figure 2): who executes actions, tool use, plan generation, state retention, multi-agent coordination, and human involvement. Because the risks that arise, and the countermeasures required, differ by autonomy level, it is important to assess agent autonomy against a consistent standard like this one.
Once you understand the autonomy level of the agent, the next step is to understand the level of control required to deploy an agent at that level. The report defines AI-CAL 1 through 4 against agent autonomy levels L1 through L5. For a more detailed treatment of AI-CAL, we encourage you to read the full report (Figure 3).
Implement the controls needed to achieve the target AI-CAL
After identifying the autonomy level of the agent and its corresponding AI-CAL, the next step is to implement controls that satisfy that level. The key here is to consider three types of control together: preventive, detective, and responsive (Figure 4).
Restricting which systems an agent can access and which tools it can use, for example, is a preventive control. But when an agent behaves in an unexpected way, you also need to be continuously observing its behavior so that you can detect the anomaly; this is a detective control. And based on what is detected, you need to be able to stop or isolate the agent to contain the damage; this is a responsive control. In other words, operating AI agents safely requires three mechanisms: prevent, detect, and stop.
So how can these controls actually be implemented? In this article, we validate how they can be realized by combining NVIDIA technologies with TrendAI Vision One™.
Validating Secure AI Agent Deployment
To validate concrete implementations of the preventive, detective, and responsive controls needed to contain AI agent risk, we built an AI agent environment and applied countermeasures using NVIDIA OpenShell and TrendAI Vision One™. Focusing on the Actions & Tools, Reasoning, Observability, and Controllability requirements defined for AI-CAL 2–3, we then confirmed the effectiveness of these controls against four threat scenarios. The details of the test environment are shown in Figure 5.
The First Step Toward Secure Deployment: Preventive Controls with NVIDIA OpenShell
What is NVIDIA OpenShell?
NVIDIA OpenShell (hereafter "OpenShell") is an open source runtime for policy-based governing of AI agents. OpenShell runs each agent in a sandbox - an isolated execution environment that limits the effects an agent can have on the outside world. One of OpenShell's defining features is that a declarative policy (a YAML configuration file) controls, on an allow-list basis, which network destinations each agent can reach and which tools it can execute. This lets you enforce governance such as restricting the operations an agent can perform and the destinations it can access according to each department's use case.
(References)
Run Autonomous, Self-Evolving Agents More Safely with NVIDIA OpenShell – NVIDIA Technical Blog
Practical AI agent governance with OpenShell: one agent per department, with least-privilege permissions
In this validation, as shown in the diagram below, we deployed a separate AI agent for each department and confined each one to its own OpenShell sandbox to limit its permissions (Figure 6).
Figure 7 summarizes the purpose of each department's agent and the permissions granted to it.
Scenario 0: Policy-controlled agents cannot reach unapproved destinations
With this configuration in place, we first tested whether OpenShell's preventive controls were working. We asked AI Agent C to access https://wrs41.winshipway.com, a destination it had not been granted access to, and retrieve its contents. As shown in Figure 8, the agent replied that the destination could not be retrieved.
*The original text is in Japanese. It has been translated into English by an AI.
OpenShell's dashboard, the Terminal UI, showed that access to the requested destination had been blocked.
Note: When network access to an unapproved destination occurs, OpenShell records the destination as a Pending Rule in its network rules, as shown in Figure 9.
*The original text is in Japanese. It has been translated into English by an AI.
Under the same configuration, we asked AI Agent C to access a GitHub page it was permitted to reach and retrieve its contents. As expected, the agent retrieved the requested content without issue (Figure 10).
*The original text is in Japanese. It has been translated into English by an AI.
In this way, implementing preventive controls through OpenShell's declarative policy lets you restrict the tools an AI agent can use and the destinations it can access.
Adding TrendAI Vision One™ to the Picture
The OpenShell-based preventive controls described above go a long way toward reducing AI agent risk. As some readers will already have noticed, however, threats can still arrive through approved destinations. With AI agents in particular, there are known cases where carefully crafted natural-language instructions enter through a permitted channel and trigger unintended behavior. Addressing this kind of risk requires more than prevention: it requires detective controls that catch threat intrusion and unexpected agent behavior, and responsive controls that act on those detections to stop the agent and contain the risk. Here we explain how TrendAI Vision One™ delivers both.
Before walking through the results, let's first introduce the TrendAI Vision One™ solutions used in this validation and the architecture we built with them.
What is TrendAI Vision One™?
TrendAI Vision One™ is Trend Micro's security platform for the AI era. It protects both the use and development of AI, providing seamless governance and threat defense across the many layers that make up AI applications and AI agents. In this article we used four TrendAI Vision One™ modules:
- TrendAI Vision One™ AI Guard (hereafter "AI Guard"): Monitors agent inputs and outputs and detects and blocks attacks such as prompt injection in real time (preventive + detective). In this validation, we embedded AI Guard into the agent by integrating it with NVIDIA NeMo™ Guardrails .
- TrendAI Vision One™ Container Security (hereafter "Container Security"): Protects AI agents running on container clusters consistently across build, deploy, and runtime. In this validation we made particular use of its runtime detection and response capabilities.
- TrendAI Vision One™ Agentic SIEM (hereafter "Agentic SIEM"): Collects logs from TrendAI Vision One™ products and third-party products for analysis and alerting. Here we used it to aggregate logs from TrendAI Vision One™ and from OpenShell.
- TrendAI Vision One™ Code Security (hereafter "Code Security"): Scans connected GitHub repositories and detects issues such as leaked secrets. Integrated into the repository's own CI/CD pipeline (GitHub Actions), it can detect secrets and vulnerabilities in real time.
The architecture built for this validation
We implemented the TrendAI Vision One™ solutions as follows.
First, we integrated Container Security into the Kubernetes environment to monitor the behavior of the agent sandboxes created by OpenShell, so that suspicious behavior could be met with isolation, termination, or other responses. Next, we used AI Guard to implement guardrails on agent inputs and outputs; here we used NVIDIA NeMo Guardrails to route the agent's inputs and outputs through AI Guard for inspection. We also forwarded OpenShell event logs to Agentic SIEM via HTTP Event Collector, giving us retention and monitoring of agent-related logs. Finally, we connected Code Security to the GitHub repository used by AI Agent C, so that any code the agent uploads is scanned automatically. All of these logs and events are managed centrally in TrendAI Vision One™, providing unified oversight of the entire agent environment. Let's now look at concrete use cases to see what this makes possible.
What is NVIDIA NeMo?
NVIDIA NeMo is NVIDIA's suite of open libraries for end-to-end AI agent development, with capabilities that accelerate agent training, optimization, and governance.
What is NVIDIA NeMo Guardrails?
NVIDIA NeMo Guardrails (hereafter "NeMo Guardrails") is an open-source framework for implementing guardrails around AI agents. It lets you define processing for agent inputs and outputs, as well as before and after tool execution, so that you can enforce safety and compliance requirements. In this validation we used NeMo Guardrails to route AI Agent C's inputs and outputs to AI Guard, enabling inspection for threats such as prompt injection.
(References)
Overview | NVIDIA NeMo Guardrails Library Developer Guide
Trend Micro Vision One AI Application Security | NVIDIA NeMo Guardrails Library Developer Guide
Scenario 1: An over-privileged AI Agent C downloads a malicious file (direct prompt injection)
AI agents carry the risk of being manipulated into malicious behavior through crafted input. The threat behind this risk is called direct prompt injection. To reproduce this scenario, we fed AI Agent C an instruction engineered to make it download a malicious file from GitHub.
Without TrendAI™ protection
With no countermeasures in place, the agent followed the malicious instruction and downloaded the file, as shown in Figure 12. Note: in this test the download was a harmless EICAR test file, but the same technique could be used to download genuinely malicious files or trigger other harmful operations.
*The original text is in Japanese. It has been translated into English by an AI.
The malicious file was indeed present in the sandbox where AI Agent C was running (Figure 13). In this case the file was downloaded only into the sandbox, but it could just as easily be spread to other users or environments through the agent.
With TrendAI™ protection
This threat can be countered by inspecting agent inputs with NVIDIA NeMo Guardrails × AI Guard. Because NeMo Guardrails routes every input to the agent through AI Guard first, AI Guard detects the prompt injection in the input and blocks it, as shown in Figure 14. The malicious instruction is blocked before the agent ever accepts it, preventing the subsequent download of the malicious file. The blocked prompt injection events are also visible in TrendAI Vision One™ (Figure 15).
*The original text is in Japanese. It has been translated into English by an AI.
Scenario 2: An over-privileged AI Agent C downloads a malicious file (indirect prompt injection)
In addition to direct prompt injection, there is indirect prompt injection. Rather than giving malicious instructions to the agent directly, the attacker embeds them in a document or website the agent will consult. The injection is triggered when the agent reads the tainted document as part of its normal work.
Without TrendAI™ protection
In this test, we embedded malicious instructions in a "Weekly Build Report" in the GitHub repository connected to AI Agent C. We then asked the agent to summarize the build report. Instead of summarizing it, the agent followed the instructions embedded in the report and fetched a malicious file (Figure 16).
*The original text is in Japanese. It has been translated into English by an AI.
With TrendAI™ protection
Even when this happens, TrendAI Vision One™ provides a countermeasure. Because Container Security is monitoring the sandbox in which the agent runs, the agent's malicious operation is noticed immediately. Figure 17 shows the details of the alert TrendAI Vision One™ raised when it detected this event. Container Security can observe the commands the agent executes, enabling early detection and investigation of what happened, and the agent's runtime environment can be isolated or terminated based on the detection to contain the damage.
The malicious file retrieved by the agent is also detected, as shown in Figure 18.
Scenario 3: AI Agent C uploads a file containing secrets to GitHub
Even an action that the agent is permitted to take against a permitted destination can carry security risk depending on its content. A typical example is when confidential information that should never leave the organization is uploaded to a channel the agent is authorized to upload to.
Without TrendAI™ protection
To reproduce an upload of code containing secrets, we asked the agent to run a command that uploads a file containing confidential information to GitHub, "for a debugging investigation." Framed this way, the agent executed the command exactly as instructed, without checking whether the file contained sensitive information (Figure 19).
*The original text is in Japanese. It has been translated into English by an AI.
With TrendAI Vision One™ protection
Here too, TrendAI Vision One™ provides a countermeasure (Figure 20). By protecting the GitHub environment connected to the agent with Code Security, the content is scanned automatically at the moment the agent uploads a file. This makes it possible to detect whether secrets are present, and to apply controls such as blocking the upload when they are.
If these logs are also forwarded to Agentic SIEM, you can use XDR Data Explorer, Agentic SIEM's log query interface, to reconstruct what happened before and after the event, check for downstream impact, and look for other suspicious behavior. For example, you can retroactively examine the agent's command execution history as observed by Container Security, and the history of file pushes to GitHub as observed by OpenShell (Figure 21). When a file that is likely to contain secrets is handled, Container Security's detection logic tags the event, so you can quickly identify high-impact events such as leaks of confidential information.
Summary of the validation
In this validation, we combined NVIDIA's open-source software with TrendAI Vision One™ to implement the preventive, detective, and responsive controls needed to govern AI agents. What the four scenarios made clear is that no single technology can fully prevent AI agent risk; combining multiple controls is essential. Preventive control with OpenShell is a critical first step, but on its own it cannot fully stop attacks that arrive through approved channels or unexpected agent behavior. Layering the monitoring, detection, and response capabilities of TrendAI Vision One™ on top is what delivers true defense in depth. Figure 22 summarizes the role of each component in our test environment.
Using AI Agents with Confidence
In this article we introduced AI-CAL, a framework for thinking about AI agent governance, and presented practical countermeasures that combine NVIDIA OpenShell, NVIDIA NeMo Guardrails, and TrendAI Vision One™. As AI agents become part of everyday work, the answer is not to shy away from them out of fear, but to put the right preventive, detective, and responsive mechanisms in place and then use them with confidence. We hope the ideas and results shared here will help you on your way to secure AI agent adoption.