There is a quiet contradiction running through almost every company shipping AI right now. They are racing to give agents the keys — to inboxes, to codebases, to customer data, to the ability to act — and almost none of them have asked the only question that matters once an agent can act: what happens when someone turns it against you.
On May 27, 2026, Anthropic — the company that builds Claude — published a 36-page guide called Zero Trust for AI Agents. Read the subtext and it is remarkable: the firm with the most to gain from agents being trusted spent 36 pages explaining why they should not be. Not as a warning about some distant future. As a description of attacks happening in production today.
We read it the way we read everything: as operators who have to put this into the field, not admire it from a distance. And it confirmed, in heavier language than we use, something we say constantly: An agent isn't an agent. It's an organized file structure.
That one sentence is the whole security story. Strip away the mystique and an "agent" is not a being with intent. It is instructions, context, memory, and tool definitions — text, organized into a structure the model reads top to bottom and then acts on. There is no ghost in it. There is a file structure, and the model does what the structure tells it to do. Hold that picture and Anthropic's entire 36 pages snap into focus. Every threat they name is an attack on the file structure. Every defense they prescribe is discipline imposed on that same structure. Secure the structure and you secure the agent.