I Scanned 5 Common LangChain Agent Patterns. Every Single One Was Over-Permissioned.

When you write this: agent = initialize_agent( tools=[GitHubTool, SlackTool, SQLDatabaseTool], llm=llm, agent_kwargs={"system_message": "You summarize pull requests."} ) You just gave a PR summarizer the ability to delete your database. Nobody checked. No linter caught it. No CI step flagged it. The agent ships with delete and schema access it will never use — and if a prompt injection attack ever hits it, that's the blast radius. I built a tool called AgentGuard to catch...