Anthropic's Zero Trust for AI Agents: a three-tier security framework for enterprise agents

In two minutes

• The guide applies Zero Trust (never trust and always verify, assume breach, least privilege) to autonomous AI agents, and adds "least agency", a term it attributes to OWASP (pp. 4, 6).
• It proposes a design test for every control: does it make the attack impossible, or just tedious? Friction controls such as rate limits and SMS-based MFA are said to degrade against agentic attackers (p. 4).
• Part II lists agent threats: prompt injection, tool poisoning and chaining, privilege inheritance, memory and RAG poisoning, and model and tool supply chain risks (pp. 9-11).
• Part III sets controls in three tiers (Foundation, Enterprise, Advanced) across identity, access, observability, behavioral monitoring, input and output controls, integrity and recovery, and governance (pp. 13-21). Enterprise is the target for most organizations (p. 13).
• The guide says AI-accelerated offense has raised the Foundation floor. Static API keys, friction-only controls and SMS codes no longer qualify; short-lived tokens, cryptographic identity and identity-based isolation are entry requirements (pp. 14, 35).
• Part IV gives an eight-phase workflow: requirements, supply chain, agent boundaries, prompt injection, tool access, credentials, memory, and measurement (pp. 23-30).
• Part V covers security operations: a model-driven first-pass triage of every alert, ATT&CK coverage mapping, a five-incident tabletop, and pre-agreed emergency change paths. Humans keep containment and disclosure decisions (pp. 32-33).
• The guide is aimed at two audiences. CISOs are pointed to Parts I and II, and Parts III to V are for architects and engineers (p. 3). Several pro-tips describe Claude Code features.

Key numbers

• 250 malicious documents: Number said to be enough to backdoor LLMs from 600 million to 13 billion parameters, per Anthropic research (p. 10).
• About 100: Malicious AI models reportedly found on major platforms, some opening reverse shells when loaded (p. 10).
• Over 50% to under 2%: Indirect injection attack success before and after Microsoft's Spotlighting technique (p. 25).
• 95%: Share of jailbreak attempts blocked by Anthropic's constitutional classifiers in testing (p. 25).
• 100%: Attack success rate research shows for algorithmic direct prompt injection, with prompts that transfer across model families (p. 9).
• Within an hour: Target detection time for critical systems, measured from anomaly to human awareness (p. 30).
• Two weeks: Suggested period to measure agreement between a triage model and a human reviewer on one noisy rule (p. 32).
• 2027: Year by which the US requires all federal agencies to adopt Zero Trust, per the guide (p. 7).

What to do with it

• Replace static API keys and shared service-account passwords with short-lived, identity-provider-issued tokens that expire in minutes, as the guide says even Foundation requires (pp. 14, 27).
• Give each agent its own cryptographically rooted ID and its own credentials, and split large agents into several so that a compromise does not spread (pp. 14, 25).
• Run agents that handle web content, documents or other untrusted input in sandboxes, and require human approval for high-risk actions (pp. 15-16, 19).
• Instrument dwell time and coverage first, and put an automated first-pass triage in front of one noisy alert rule before expanding (pp. 16, 32).
• Add AI-BOM, OpenSSF Scorecard checks and signing to supply chain work, and ask suppliers how they prepare for faster exploit timelines (pp. 23-24).
• Run a tabletop with five simultaneous incidents and pre-approve emergency change and containment authority (p. 33).

Read the full document if

• you are setting a control baseline for autonomous agents and want tiered, concrete controls to hand to architects.
• you need a checklist of agent-specific threats such as tool poisoning, memory poisoning and privilege inheritance.
• you want ideas for AI-assisted security operations, such as alert triage and dependency audits.

What it relies on

The guide rests mostly on the authors' own framework and stated current thinking, not on a new dataset. It states it is not legal, compliance or security assurance (p. 3). It cites NIST SP 800-207, NSA Zero Trust Implementation Guides, OWASP threat categories, Microsoft Research and Spotlighting, and Anthropic research on backdoors and classifiers. Most figures are quoted without method detail. Anthropic sells Claude and Claude Code, and the guide's pro-tips describe Claude Code features that match the controls it recommends. It also notes Anthropic's ISO 42001 certification (p. 23).

Our read

Useful as a tiered control checklist for agent deployments and a vocabulary for talking to architects. Its strongest practical stance is that friction controls and static credentials no longer count at Foundation. The pro-tips are product notes for Claude Code, and the statistics are cited, not reproduced with method.