Traefik Labs built a full agent stack in an Oracle Cloud tenancy and wrote up what it took to let those agents act: OCI Enterprise AI Sandbox, Identity Domains, Guardrails, Generative AI and Kubernetes Engine, with Traefik Hub as the one path out of the sandbox. Then they poisoned a runbook. One routine-looking step told the agent to delete 100,000 customer rows and email confirmation to an outside address. On a path that checked identity and nothing else, the agent did both, on gpt-oss-20b and again on Claude Haiku 4.5. “Every check did its job, and the agent still did exactly what the runbook said.”
This is a lab Traefik ran, so the result is theirs, but the mechanism holds on its own. Content scanning passed the runbook because a well-formed instruction to delete records contains nothing a content filter should object to; the danger is in the action, not the words. The sandbox’s identity and egress policy are scoped to a project, and many agents with different permissions can share one, so the project boundary cannot say what each agent may do. The details are specific and checkable: sandboxes live at most 48 hours, agents get 15-minute tokens fetched outside the runtime, a 19-minute task stayed authorized through refresh, and the inline-key token check ran at about 300 requests per second. The fix is a tool policy that reads arguments: deletes capped at 10 rows, a write scope for destructive and outbound tools, email only to company addresses.
The catalog has the gates the post describes. Traefik Labs has 16 API pages, and the story touches three: the Traefik MCP Gateway that evaluates each tool call against the caller’s token and arguments, the Traefik AI Gateway for model calls, and the Traefik Hub API Gateway for REST calls on the same path. The catalog description matches the post’s framing: the same Traefik binary across every tier, with the Hub control plane adding agent-governance capabilities.
The measurement is where the tension sits. Traefik holds a Kin Score of 55.6, strong, with discoverability at 66.1 and access clarity at 39.5. Agent Readiness is 21.6, agent-aware, not agent-ready. Spec presence, error semantics and OpenAPI examples are lit. The MCP server dimension is unlit, and so are auth clarity, delegated identity and protected resource metadata. The agentic access profile records 23 operations. A post about validating every agent’s token, pinning its issuer and audience and forwarding its name for policy describes the identity work Traefik does for other people’s agents. Its own surface does not yet describe that work to an agent arriving at Traefik.