The company positions isolation and governance, rather than model improvements alone, as the main defences. The blog post identifies prompt injection, tool misuse and poisoning, excessive autonomy, credential exposure, and data exfiltration as the principal risks. Docker argues that these share a common cause: an agent can select tools at runtime, chain several actions together and often operate with the permissions of the person who started it.
Traditional web security often assumes requests arrive at known endpoints and are processed by deterministic code, but agents do not fit that model. A coding agent may read a file, install a dependency, alter configuration, run tests and push a commit after receiving one instruction.
