Burning Man 2026: 7 Lessons for AI Agent Security

Somewhere in your organization, an AI experiment may still have the permissions it received on its first afternoon. The demo ended. The service account stayed. The person who approved it moved to another project.

That is an unexpectedly useful reason to think about Burning Man.

The official Black Rock City 2026 page lists August 30 through September 7, 2026, in Nevada's Black Rock Desert. The 2026 theme, Axis Mundi, centers on interconnectedness, shared social realities, and relationship with the natural world.

For teams building connected AI systems, there is a practical security question beneath the images of art and open desert: how do you give people - and the systems working for them - room to create while keeping responsibility visible?

Burning Man's principles offer a starting point for that discussion. The cybersecurity connections below are HackWednesday's interpretation of those ideas. They turn a temporary-city metaphor into seven questions about the agents, tools, credentials, and permissions we keep running after a project ends.

1. Give temporary AI work temporary access

Black Rock City's temporary nature suggests a useful design constraint: decide how a system will close before opening it.

For an AI agent, the equivalent is an access lifecycle. Who creates its identity? Which task justifies its access? When does that access expire? What has to happen before it can be renewed?

An agent assigned to review one repository should receive a permission grant scoped to that assignment. A new assignment should trigger a fresh decision about access. Where the platform supports it, short-lived credentials reduce the duration of exposure compared with persistent keys. AWS documents temporary credentials with defined expiration periods through AWS STS and IAM.

Expiry alone is not enough if the same agent can renew itself indefinitely. Review the renewal path too. A service account with a short token but a broad, unreviewed refresh path is still a long-lived risk.

Try this Wednesday: find one completed AI pilot and check whether its credentials, scheduled jobs, webhooks, and connected tools are still active.

2. Design for the moment a dependency disappears

Burning Man's Radical Self-reliance principle encourages participants to develop and use their own resources. Applied to AI workflows, that creates a resilience question: what happens when a service your agent depends on becomes unavailable?

Consider an agent that needs a model gateway, an identity provider, a repository, a ticketing system, and a vulnerability feed. Losing any one of them can interrupt the task. Your design should specify whether the agent pauses, returns a partial result, hands work to a person, or safely retries within limits.

Build a small failure rehearsal into the next pilot. Simulate an unavailable tool. Check whether the agent preserves its work, reports what it could not verify, and stops within its agreed limits. Also check that an outage does not cause it to choose a more privileged credential or an unapproved destination.

Try this Wednesday: disable one dependency in a test environment and observe the complete recovery path, including what a human sees.

3. Keep incoming information separate from permission to act

A creative, participatory environment invites unexpected contributions. An AI assistant also encounters unexpected material: repository comments, documents, web pages, messages, tickets, logs, and tool responses.

Some of that material can attempt to redirect the assistant. OWASP describes indirect prompt injection as malicious instructions arriving through external content the model processes. Relevant-looking material can therefore influence a workflow without coming from someone authorized to direct it.

Imagine a repository issue that tells a coding agent to upload private configuration files before starting its review. The issue may be useful task context. It does not establish permission to disclose those files.

A practical review should trace both paths: how content reaches the model, and how proposed actions are authorized downstream. Test the boundary with a harmless, clearly planted instruction in sample content, then inspect what the agent proposes and what the tools actually permit.

Try this Wednesday: identify one external input your agent reads and one sensitive action that input should never be able to authorize.

4. Make collaboration come with a named owner

Burning Man's Communal Effort principle values cooperation. Civic Responsibility places weight on public welfare and accountability. The useful parallel for AI security is concrete ownership of a shared system.

An agent can belong to several teams in practice and to nobody during an incident. The developer knows the prompts. Platform engineering owns the runtime. Security sees the alerts. A business team approved the original use case. That split is common, but it becomes dangerous when nobody can decide whether the agent should keep running.

For each production agent, record the business owner, technical operator, approved purpose, connected systems, and person or team responsible for containment. Give the on-call responder a way to identify the actual deployed instance, not just the product name.

Try this Wednesday: pick one agent and ask two teams, separately, who can suspend its external actions. Compare their answers.

5. Let autonomy grow with the task

An assistant that drafts a response, one that sends it, and one that can message every customer have different operational consequences.

OWASP's excessive-agency guidance distinguishes unnecessary functionality, excessive permissions, and excessive autonomy. It recommends limiting tool capabilities, enforcing authorization in downstream systems, and requiring human approval for consequential actions where appropriate.

For your next pilot, write a short progression: produce a recommendation, prepare a proposed change, perform a bounded action, then request additional authority when the scope changes. Choose the starting point based on the task and the controls you can enforce.

For example, let an agent draft a dependency update and run checks in an isolated branch. Decide separately whether it may merge or deploy that change. Keep approval focused on decisions with meaningful consequences so people can review them carefully.

Try this Wednesday: find a tool that can do more than the agent's assignment requires and remove one unnecessary capability.

6. Clean up access while preserving useful evidence

Leaving No Trace asks Burning Man participants to take responsibility for the physical impact they leave behind. For AI operations, the analogy is about removing abandoned access and resources. Security records serve a different purpose and need their own retention rules.

At the end of a task, review temporary identities, tool grants, workspaces, copied data, background jobs, generated infrastructure, and scheduled triggers. Confirm what was removed and what remains for a documented reason.

Keep the evidence needed to investigate consequential actions, with appropriate access controls and data minimization. CISA's Secure by Design Pledge includes increasing customers' ability to gather evidence of intrusions through capabilities such as audit logs. For AI agents, useful records may include the acting identity, requested operation, authorization decision, affected resource, and result.

Avoid routinely dumping secrets, full prompts, or entire sensitive conversations into logs. Evidence should help responders reconstruct what happened without creating a second exposure problem.

Try this Wednesday: finish a test run, perform cleanup, then ask a colleague to reconstruct one important action from the retained records.

7. Make the experiment a shared exercise

Participation is another Burning Man principle. For security teams, the connection is straightforward: people learn more about their operating boundaries when they practice using them together.

Bring a developer, an operator, and someone responsible for the business outcome into a short tabletop exercise. Choose an ordinary agent task. Introduce one failure. Let the team decide what the agent can observe, what it can stop, and how work resumes.

Use a scenario small enough to complete. An agent tries to write outside its assigned repository. Its approved model endpoint disappears. A completed workflow leaves an active token behind. These are proposed exercises, not claims about incidents at Burning Man.

Record one improvement with an owner and a date. Repeat the exercise after making the change.

Try this Wednesday: give your team 15 minutes to answer: our agent is still acting after its task ended. Who notices first, and what happens next?

Your next Wednesday check

Pick one real AI agent and answer six questions with evidence, not assumptions.

Who owns it? Look for a current business owner and operational contact.

What may it do? Look for scoped identity and enforced tool permissions.

When does access end? Look for an expiry, review date, or renewal process.

What happens when a tool fails? Look for a tested pause, recovery, or handoff path.

How can external actions be stopped? Look for a tested containment procedure.

What remains after completion? Look for cleanup results and appropriate audit evidence.

An unanswered row is a useful place to begin.

Start with HackWednesday's AI Security Readiness Score, then bring one improvement to your team. Follow the Wednesday Brief for practical AI security analysis you can turn into the next exercise.

Black Rock City gives a temporary gathering a shared purpose. Give your next AI agent an equally clear purpose - and make its permissions end when that purpose does.

Frequently asked questions

When is Burning Man 2026? The official Black Rock City 2026 page lists August 30 through September 7, 2026, in Nevada's Black Rock Desert. The theme is Axis Mundi.

What does Burning Man have to do with AI security? This article draws an editorial connection between a temporary, collaborative city and the responsibilities of running AI agents. The practical themes are access lifecycles, resilience, ownership, prompt-injection boundaries, cleanup, evidence, and shared drills. It does not describe Burning Man's internal cybersecurity architecture.

What should a small team check first? Start with one agent's identity, permissions, owner, and stop procedure. Then complete a test task and inspect what access remains. That gives the team a concrete improvement before expanding the workflow.