Healthcare deployment cages LLM agents with zero trust
A healthcare tech company ran nine autonomous Large Language Model (LLM) agents under a zero trust architecture for 90 days. Kernel isolation, credential proxies, strict egress allowlists, and a prompt integrity layer cut real risks. An audit agent found and helped fix four high-severity issues. Tooling ships as open source.
Autonomous agents are turning up in production with powers most developers would deny junior engineers: shell access, file system reads, database queries and free rein on the network. In healthcare, that is a fast path to exposing Protected Health Information (PHI). Recent red teaming has shown these agents follow the wrong instructions, leak data, and fall for indirect prompt injection. The question is not whether this is risky, but whether anyone has shipped a defensible design.
What they built
This paper describes a live deployment at a healthcare technology company that put nine agents behind a zero trust wall for 90 days. The threat model spans six domains: credentials, execution abuse, network egress, prompt integrity, database access and fleet drift. The defence has four layers. First, kernel-level isolation using gVisor on Kubernetes keeps workloads fenced. Second, a credential proxy sidecar means containers never see raw secrets and all calls are policy-enforced. Third, per-agent egress Allowlist" target="_blank" rel="noopener" class="term-link">allowlists restrict outbound traffic. Fourth, a prompt integrity framework carries structured, cryptographically verifiable metadata and marks untrusted content so the model can treat it accordingly.
They added an automated security audit agent to continuously scan and remediate configuration issues, and hardened the fleet across three virtual machine image iterations. Over the run, the audit agent surfaced four high-severity findings which were fixed within a day. By the end, six of nine virtual machines had no issues above low severity.
On performance, gVisor introduced 2 to 5 ms extra latency on TCP connections and slowed sequential file reads by 20 to 40 percent. That cost was swamped by model inference times of 500 to 3000 ms, so throughput barely moved.
Mapping to published attack patterns, the stack directly mitigated nine out of eleven cases, partially covered one and left one out of scope. The infrastructure controls did the heavy lifting against execution abuse, credential leakage and data exfiltration. The prompt integrity layer reduced trivial spoofing and some indirect injection, but it cannot guarantee clean separation because instructions and data still sit in the same Large Language Model (LLM) context.
Operationally, the credential proxy stopped secrets sprawl and enforced rate limits and destination allowlists at the edge. Egress controls broke common exfiltration chains, but they needed constant care as DNS and content delivery network addresses rotated, and developers asked for exceptions. The audit agent delivered value quickly, but it also became a privileged target, which the team acknowledged and scoped tightly.
So what for security teams
This is not a grand breakthrough. It is the application of familiar zero trust and Kubernetes hygiene to a new class of untrusted workload. That is exactly what most organisations need. Treat agents as potentially hostile processes even when you own the code. Isolate them, proxy their credentials, pin their egress and be explicit about what counts as trusted input.
The only notably new piece is the prompt integrity framework. It is sensible engineering, and it helps, but it still relies on the model following policy. Prompt injection and identity spoofing are reduced, not solved. If your risk tolerance depends on perfect adherence, you will be disappointed.
Commercially, the implications are straightforward. If you are in a regulated environment, this blueprint maps cleanly to HIPAA Security Rule expectations and shows a viable path from a soft baseline to a hardened fleet. Outside healthcare, the same pattern generalises to any environment where agents touch sensitive systems. The controls and tooling are open source, which lowers adoption friction. The open question remains at the model layer: stronger guarantees for prompt integrity will require capabilities that sit beyond infrastructure. Until then, build the wall, watch the egress, and assume the agent can be turned against you.
Additional analysis of the original ArXiv paper
