The agent sounds like the perfect attack target - it has rights to upload arbitrary code everywhere without setting off alarms.