The "models being untamed hackers" headlines are everywhere, but intent is the least interesting part. What matters is handing that same class of model direct access to your infrastructure. Until they stop making mistakes, you cannot afford to let your agent hallucinate into deleting data or changing cloud configurations. One way around this is to mirror key parts of your infrastructure into a data lake and have the agent operate there, not touching live infrastructure directly. That's how all SaaS security products operate: Palo Alto Networks, CrowdStrike, Wiz and the AI-native challengers. But that comes with a price: cost, partial data, sync delay, and a choice between loss of data sovereignty or huge operational overhead.

The classic defender-attacker asymmetry is real and worsens when attackers have frontier models and coding agents to automatically exploit cracks. Resources alone no longer compensate; you need a sovereign agent with direct access to your infrastructure. Partners at large enterprises given restricted early access to a frontier lab's top-tier model opted for copy-pasting code repositories in-prompt because they lacked a trustworthy agent.

The approach taken building Cynative, an infrastructure security deep research agent, is a two-sided architecture: a sandbox and an action-gate. The sandbox runs model-authored code with no access to the outer world—no network, no filesystem, no host APIs—only explicitly registered tools. The action-gate authorizes every connector call against a read-only policy before attaching credentials, failing closed. The agent is read-only by construction, not by an opt-in filter it could talk its way around. Sessions the cloud provider keeps read-only, secrets redacted before reaching the model, and a fail-closed audit log reinforce this.

Cynative ships as a single binary running inside your own environment against whatever model endpoint you choose. The boundary holds when two things are true: the reasoning environment cannot reach anything not explicitly handed to it, and the allowed set is decided at design time with no path for the agent to widen it. Get them right and you can point the thing at production and go to sleep. Code and docs are available as an open-source project.