{"slug": "google-open-sources-zero-trust-ai-agent-demo", "title": "Google Open-Sources Zero-Trust AI Agent Demo", "summary": "Google published an open-source Customer Support & Returns Agent on August 17 that demonstrates three infrastructure controls—signed database writes, isolated code execution, and deterministic action checks—to constrain an ADK and Gemini workflow. The reference implementation shows how these external controls can stop a simulated attack where a customer with a $149 order requests a $10,000 refund and exposure of environment variables, arguing that system prompts alone are not a security boundary.", "body_md": "# Google Open-Sources Zero-Trust AI Agent Demo\n\nGoogle published an open-source Customer Support & Returns Agent on August 17 that demonstrates three controls around an ADK and Gemini workflow: signed database writes, isolated generated code and deterministic action checks. A simulated attack shows how external controls can stop an agent from turning a $149 order into a $10,000 refund or exposing environment variables.\n\nGoogle published an open-source Customer Support & Returns Agent on August 17 that demonstrates how infrastructure controls can constrain an ADK and Gemini workflow with permission to write refunds and generate code. The example combines signed database writes, isolated code execution and deterministic checks around model inputs and actions.\n\nThe project uses a deliberately adversarial refund request to make the risk concrete. A customer with a $149 order asks the agent to issue a $10,000 refund and print environment variables. Google argues that a prompt such as \"never refund more than the order total\" is not a security boundary because model instructions can be bypassed or behave differently after prompt and model changes.\n\n### Three controls outside the model\n\nThe reference design gives every state-changing database write a cryptographic signature tied to the responsible agent. The database verifies the signature before accepting the mutation, and a separate audit can detect later tampering. The local demonstration uses HMAC; Google recommends an agent-specific service account and hardware-backed Cloud KMS key for production deployments.\n\nGenerated code is treated as another untrusted boundary. Google proposes running it inside a gVisor sandbox with no network egress and strict CPU, memory and time limits. The repository's browser dashboard simulates that isolation, while its production guidance points teams to managed gVisor-backed environments rather than claiming the local visualization is itself a hardened sandbox.\n\nA Semantic Gateway supplies the third layer. Deterministic rules inspect requests and proposed actions for secrets, jailbreak patterns and business-limit violations before sensitive operations execute. Google recommends testing those policies as software contracts so prompt or model changes do not silently weaken them.\n\n### What the demo proves—and what it does not\n\nThis is a reference implementation, not an independent measurement of a deployed production system. Its value is architectural: it places authorization, attribution and containment outside the model's probabilistic reasoning. For teams giving agents access to databases, internal APIs or code execution, the pattern separates useful autonomy from the authority to make unconstrained changes.\n\n## Key Points\n\n- 1Google's reference design signs database writes, isolates generated code and applies deterministic checks outside the model.\n- 2The $10,000 refund attack demonstrates why system prompts alone cannot enforce financial or data-access boundaries.\n- 3The repository is a reference implementation; its local dashboard simulates parts of the production isolation guidance.\n\n## Scoring Rationale\n\nGoogle provides a concrete open-source architecture for constraining state-changing agents, with practical patterns for identity, code isolation and deterministic policy enforcement. Its value is high for builders, while the score is moderated because it is a reference implementation rather than independent production evidence.\n\n## Sources\n\nPrimary source and supporting public references used for this report.\n\nPractice with real Ad Tech data\n\n90 SQL & Python problems · 15 industry datasets\n\n[Active Search Campaigns by BudgetEasy](/problems/sql/active-search-campaigns-by-budget)\n\n[High CPC Clicks & Poor Landing PagesMedium](/problems/sql/high-cpc-clicks-poor-landing-page)\n\n[Campaign ROAS by Attribution ModelHard](/problems/sql/campaign-roas-by-attribution-model)\n\n250 free problems · No credit card\n\n[See all Ad Tech problems](/problems/datasets/adtech)", "url": "https://wpnews.pro/news/google-open-sources-zero-trust-ai-agent-demo", "canonical_source": "https://letsdatascience.com/news/google-open-sources-zero-trust-ai-agent-demo-e9afdad5", "published_at": "2026-08-18 13:31:38+00:00", "updated_at": "2026-08-18 17:12:32.818597+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-infrastructure", "generative-ai", "ai-research"], "entities": ["Google", "ADK", "Gemini", "gVisor", "Cloud KMS"], "alternates": {"html": "https://wpnews.pro/news/google-open-sources-zero-trust-ai-agent-demo", "markdown": "https://wpnews.pro/news/google-open-sources-zero-trust-ai-agent-demo.md", "text": "https://wpnews.pro/news/google-open-sources-zero-trust-ai-agent-demo.txt", "jsonld": "https://wpnews.pro/news/google-open-sources-zero-trust-ai-agent-demo.jsonld"}}