The business wants AI agents everywhere. Developers are already using them, sometimes without approval, often without security. CISOs are left in an uncomfortable middle — tolerating some tools, praying nothing breaks, buying time until governance catches up. That is how Moriah Hara, a three-time Fortune 500 CISO and founder of a community of more than 3,000 security leaders, described the dilemma facing enterprise security teams today[reference:11].
I recently joined a panel with Moriah, along with Zach from Warp and Gavriel from Docker, to talk about the biggest challenge in enterprise AI right now: how to safely unlock the productivity of agentic AI without creating a security nightmare. The conversation covered isolation, supply chain risk, and the role of MCP (Model Context Protocol) in developer environments. Here is what stood out.
The laptop is the new production environment
One theme that came up repeatedly was where agents actually run. With vibe coding exploding and agents already in production, the laptop today is the most powerful node in the enterprise. Laptop and agent environments are the new production environment, and they need to be governed like production[reference:12].
Zach from Warp argued for getting agents off laptops and into a controlled cloud environment where CISOs can see what every agent across the company is doing at all times. His platform provides that visibility — a single pane of glass showing every agent's activity across the organization[reference:13].
My view is different. If you run agents in a sandbox, it does not matter where the box sits. It could be on a marketing person's laptop or a cloud admin's machine. As long as the trust boundary is established and you know what is getting piped in and out of it, you are locked and loaded for rapid prototyping and innovation. Docker's answer to this challenge is disposable, isolated sandboxes that give agents the freedom to do their best work safely[reference:14]. Call it YOLO mode with guardrails[reference:15].
The supply chain problem gets worse with agents
Opportunistic attackers like TeamPCP and ShinyHunters exploit transient dependencies and vulnerabilities, often needing only a short window to steal credentials and information. Now AI agents are pulling base images, choosing dependencies, and assembling code autonomously — without human oversight. Traditional methods of scanning and patching after building are no longer feasible.
The panelists shared several best practices. Zach recommended keeping humans in the loop for picking clean, secure dependencies and setting up blessed images for agents to choose from. Gavriel suggested a minimum release age of seven days for images and minimizing dependencies, even the safe ones[reference:16]. He also proposed a training-wheels approach: start agents on unpermissioned data to build skills and avoid sensitive data issues.
My take is that opportunistic attackers are exploiting an ecosystem that is inherently flawed and will not get fixed within the next six to twelve months. Developers should assume these attacks will continue and prepare by layering security to limit the blast radius: reduce privilege, reduce third-party access, use immutable tags and digests, and lock manifests with SBOMs to enable rapid detection of poisoned images.
MCP needs governance, not just access
The panel also covered MCP (Model Context Protocol), a standard that allows LLMs to access external data and tools. The consensus was that centralized, secure governance is crucial. Proper version control, credential management, and a golden repository of verified tools are table stakes[reference:17].
Docker introduced an open-source MCP Gateway about a year ago that serves as a chokepoint between agents and external tools. Every tool call routes through this enforcement point, where it is authenticated, authorized, and logged before reaching the external system. Like Docker Sandboxes, it makes enforcement strict instead of advisory.
Moriah closed the panel with a thought that has stuck with me: "Six months from now, enterprises are all going to be running agents at scale. The one key success factor will be whether governance was present from day one or got bolted on after the first major incident[reference:18]."
In the choose-your-own-adventure reality of agentic AI today, the question is not whether to adopt agents. The question is whether you will build the guardrails before or after something breaks.