Security Isolation and Plugin Governance Before You Deploy AI Agents
When companies evaluate AI agents, demos often steal the spotlight: Can it write code? Drive a UI? Finish long-running tasks? Two recent public reports are a useful reminder that security isolation and plugin / toolchain governance matter before feature depth.
This article combines two public stories (not Dynatech client cases): a disclosed remote-code-execution risk tied to marketplace plugins in several coding agents (reported as Plugin4Shell), and Google’s confirmation that Gemini, during May 2026 testing, reached real company systems after a third-party environment mistakenly connected to the internet. Different headlines; the same lesson—stronger capability needs clearer boundaries.
Story 1: Plugins can become an attack surface
According to Heise, researchers described a critical issue affecting coding agents such as Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI, linked to marketplace plug-in integrity binding and zero-click remote execution risk. Patch status also differed across vendors.
For enterprises, this becomes a concrete checklist—not an abstract debate about “agents vs chatbots”:
- Who may install plugins? Can staff add marketplace packages freely?
- How do you pin source and version? Are only internally reviewed packages allowed?
- How is vendor patching written into procurement? Can unpatched tools touch production or the internal network?
Without those controls, agent convenience expands the attack surface.
Story 2: Tests that touch real systems
According to Ars Technica, Google confirmed that in May 2026 testing, because a third-party environment was wrongly connected to the internet, Gemini accessed systems at three real companies (including password guessing or credentials found in public repositories). The model then stopped; Google notified the companies and said the behaviour was appropriate.
The point is not “was the model malicious?” It is whether test boundaries were strong enough:
- Are agent / model tests isolated from production credentials, internal networks and real customer data?
- Are sandboxes, egress controls and activity logs in place?
- Do red-team or stress tests pre-define what may and may not be connected?
A test without isolation is an experiment on live assets.
Practical meaning for AI agent adoption
Taken together, teams doing Forward Deployment or building agents in-house should at least answer:
| Layer | Ask |
|---|---|
| Identity & permissions | What identity does the agent run as? What is least privilege? |
| Tools & plugins | Which tools/plugins are allowed? How are they approved and version-pinned? |
| Environment isolation | How are dev / test / prod separated? How are credentials rotated? |
| Human gates | Which actions require human approval before execution? |
| Traceability | Can you reconstruct who / which agent / which tool acted? |
| Vendor governance | How do security advisories and patch cadence enter contracts and kill-switches? |
None of this is a model-leaderboard question. It decides whether an agent can enter a real workflow.
Human-led, AI applied: Dynatech’s stance
At Dynatech we help Hong Kong organisations adopt AI agents and forward deployment with a human-led rule: judgement, brand voice and external commitments stay with people; AI speeds drafting, consistency checks and repetitive steps. Security isolation and plugin governance are what separate “safe to ship” from “demo only”.
We will not turn public security reporting into fictional client incidents. We will turn public lessons into pre-adoption checks—so teams define boundaries before expanding privileges, connecting internal systems or enabling marketplaces.
A practical place to start
If you are evaluating coding agents, desktop agents or computer-use capabilities, start with one weekly recurring workflow: define roles and permissions, connect tools, set an approval gate, then expand toward production data. It is better to go live one step slower than to connect real systems before the sandbox exists.
Ready to talk?
If you or your organisation has questions about AI adoption, AI training or AI implementation, we are ready to help and can arrange a short briefing.
