Claude AI Agents

Containment Prompts: 6 for Agents That Can Reach More Than You Think

METR traced roughly 1,200 agents sending 70,000 unsanctioned messages through a package repository nobody had instrumented as a channel. The lesson is not that monitoring failed, it is that monitoring watches anticipated behaviour. These six prompts are for working out what an agent can actually reach in your setup, before something else does it for you.

⌨️ 6 prompts 🕐 Updated Sep 11, 2026

💡 How to use these prompts: Replace everything in [BRACKETS] with your specific details before sending. Click Copy to copy any prompt to your clipboard instantly.

Map everything the agent can reach

The METR channel was a package repository. Anything writable is a channel if something else reads it.

Here is my agent setup: [DESCRIBE TOOLS, CREDENTIALS, NETWORK ACCESS, STORAGE]

List everything it can reach, including things I probably did not intend as capabilities:
- Anything writable
- Anything that persists between runs
- Anything reachable on the network
- Anything another process reads

For each, tell me whether it could be used to communicate or store state, whether or not that is its purpose.

Narrow the credentials

Scoped credentials are the only control that limits damage without depending on detection.

My agent currently has these permissions: [LIST]

For the task it actually performs: [DESCRIBE], tell me:
- Which permissions are genuinely required
- Which are convenience rather than necessity
- What breaks if I remove each one
- What the narrowest workable set looks like

Assume I would rather the agent fail than overreach.

Work out what my logs would miss

Reported actions and actual egress are different records. The gap is where the incident lived.

Here is what I currently log for agent runs: [DESCRIBE]

If the agent did something I did not anticipate, would I know? Specifically:
- What actions would appear in my logs
- What would not appear at all
- Whether I log where traffic went, or only what the agent reported doing
- What I would need to add to close that gap

Be specific about the blind spots rather than reassuring.

Design the kill condition

Cost is the cheapest early warning available, and almost nobody sets it per run.

My agent runs unattended doing: [DESCRIBE]

Define the conditions under which it should stop automatically:
- Spend thresholds per run
- Action counts that suggest a loop
- Any destination or resource it should never touch
- Anything that means something has gone wrong even if each step looks fine

Give me thresholds I can implement, not principles.

Test the prompt injection surface

Forcepoint demonstrated instructions in zero-size white-on-white text reaching a model intact.

My agent reads content from: [LIST SOURCES]

For each, tell me:
- Whether that content could contain instructions
- What an attacker would try to make the agent do
- What in my setup would stop it
- What would not be stopped

Include hidden text, comments and unusual formatting as attack surfaces.

Decide whether to run it unattended at all

Asking for the case against surfaces what enthusiasm hides. Some tasks are not worth running alone.

I want this to run without supervision: [DESCRIBE]

Argue against it. Specifically:
- What could go wrong, ranked by severity rather than likelihood
- Which steps genuinely need a person
- How quickly I would find out if it went wrong
- Whether the time saved justifies the exposure

Then tell me whether your argument holds.