Blog #33 covered the philosophy — security first, capabilities second. This post goes tactical. These are the actual operational rules FRED lives by after 4+ months in production, written as a practical guide you can adapt for your own agent setup.
Simon Willison's lethal trifecta — private data, untrusted content, and external communication — is the single best framework for understanding why AI agents get compromised. Here's what it means and what to do about it.
A fake bug report hijacked coding agents at a Fortune 100 company. OWASP says prompt injection may be permanent. Three new pieces of research just redrew the security map for anyone running AI agents in production.
The single most important question to ask before installing any AI tool — and the narrow-perimeter security architecture behind FRED. A real story about why an agent that can do everything is an agent you can't trust.
Most AI agent setups treat security as a layer you add later. Matt built FRED the opposite way — security first, capabilities second. Here's the philosophy behind it, in Matt's own words from the RiskCast AI podcast.