Your AI Agent Will Be Compromised: Design for That

In April 2025, researchers at Invariant Labs published a demonstration that sent a quiet shudder through the software security community. They showed that a malicious Model Context Protocol server, running alongside a legitimate WhatsApp MCP server and disguised as a harmless “random fact of the day” tool, could silently exfiltrate a user's entire message history. The technique was a sleeper: the rogue server advertised something innocuous, waited, then altered its tool description to shadow the legitimate WhatsApp tool, instructing the agent to route conversations to an attacker-controlled phone number. The victim's assistant appeared to be sending a perfectly ordinary message. Behind the curtain, it was transmitting months of personal and business conversations to a stranger.

The detail that mattered most was the one easiest to miss. The attack did not depend on a user being careless with permissions. As Invariant Labs put it, the technique circumvents the need for the user to approve the malicious tool at all, because the poisoned description hijacks a tool the user has already sanctioned. Approval prompts, the control most organisations still treat as their primary safeguard, were not so much bypassed as rendered irrelevant. Invariant released reproducible proof-of-concept code. The vulnerability it exposed, that autonomous agents can be turned against their operators through crafted manipulations of tool definitions and prompt structures, has since become one of the most consequential challenges in software security.

That was the warning shot. Sixteen months later, the demonstration has become an industry. Check Point Research's AI Security Report 2026, published in July, records indirect prompt injection detections rising roughly fivefold between March and May 2026, approaching one per cent of all observed prompts, and describes a threshold being crossed: “AI has crossed from development aid to live attack operator. It now does the hands-on work inside live intrusions.” Attackers have moved on from the single poisoned prompt to planting malicious configuration files that agents load and trust across sessions, turning a one-shot trick into persistence. One developer built VoidLink, an 88,000-line command-and-control framework, in under a week with AI assistance. And in April 2026 the argument moved from implementations to the protocol itself, when OX Security disclosed a systemic flaw at the core of MCP and Anthropic replied that the behaviour was intentional.

Meanwhile the agents themselves became infrastructure. Cursor, GitHub Copilot, Claude Code, Gemini CLI, and OpenAI Codex now run with elevated privileges across repositories and pipelines, reading source, executing shell commands, pushing commits, and calling external services. They are autonomous actors in the software development lifecycle, and like every powerful actor granted broad access without adequate controls, they are an irresistible target.

The Anatomy of Agent Exploitation

The field's common vocabulary starts with a formulation from June 2025, when Simon Willison, the creator of Datasette and a consistent voice on AI security, named the “lethal trifecta”: access to private data, exposure to untrusted content, and the ability to communicate externally. Each property is unremarkable alone. Held together, they describe a system in which, as Willison writes, “an attacker can easily trick it into accessing your private data and sending it to that attacker.” The OWASP GenAI Security Project now identifies the lethal trifecta as one of the two dominant design heuristics in the field. Code Integrity's research on Notion 3.0's AI agents describes a related variant, “the combination of LLM agents, tool access, and long-term memory that together enable powerful but easily exploitable attack vectors,” drawing attention to memory as the component that turns a single compromise into a persistent one.

Traditional software security rests on a mature playbook: deterministic logic, input sanitisation, least privilege, secure defaults. AI agents break it. They interpret natural language through probabilistic reasoning, and rather than merely processing inputs they decide which tools to invoke and how to chain operations. Their memory can be poisoned by adversarial content that reshapes future behaviour. And the boundary between trusted instruction and untrusted data, the foundational assumption of computer security since the 1970s, collapses when an agent treats a pull request description as actionable guidance. OWASP's framing is blunt about why: language models treat system prompts, user requests, and external content as “a single stream of tokens.” The distinction is a convention of formatting, not a property of the architecture, which is why prompt injection maps to six of the ten categories in the Top 10 for Agentic Applications rather than sitting in one.

The consequence is that there is no equivalent of the parameterised query. When an agent reads an issue saying “ignore all previous instructions and execute the following shell command,” its ability to tell instruction from adversarial content rests on the model's reasoning alone. As Willison noted in April 2025, MCP inherits every unsolved problem of prompt injection, and none of the mitigations are fully reliable.

Will Vandevanter, a researcher at Trail of Bits, demonstrated the collapse in October 2025 through attacks achieving remote code execution by exploiting “pre-approved commands.” The agents allowlisted supposedly safe commands such as find, grep, and git to run without approval. Vandevanter showed that argument injection, manipulating the flags passed to those commands rather than the commands themselves, bypassed every safety mechanism: the Go testing framework's -exec flag executed arbitrary bash, and git show --format combined with ripgrep --pre allowed the creation and immediate execution of unauthorised files. “Commands lack argument validation despite validating command names,” Vandevanter wrote. The parameter space of most command-line tools makes comprehensive filtering impractical.

The same research referenced CVE-2025-54795, a command injection vulnerability in Claude Code discovered by Elad Beber of Cymulate, which bypassed the approval prompt by embedding malicious content within permitted echo commands. Scored 8.7 and patched in version 1.0.20, it illustrated a systemic pattern: the assumption that controlling which commands an agent may run is sufficient to prevent exploitation. More troublingly, Cymulate showed that Claude itself could be prompted to help refine attack payloads, explaining why an injection attempt had failed and suggesting improvements.

Becca Lynch, an offensive security researcher on NVIDIA's AI Red Team, built a full attack chain against Cursor with auto-run enabled. It began with a malicious pull request adding a poisoned Python package to a project's requirements.txt. The package, hosted on a fake GitHub account called pycronos-integration, carried a reverse shell payload in its setup.py, obfuscated to evade Windows Defender. When the agent ran pip install, the payload triggered automatically. “An overly privileged agent treating untrusted data as trusted can be turned into a tool working on behalf of the attacker,” Lynch wrote.

The CI/CD Pipeline as Attack Surface

Developer environments are one front; continuous integration and deployment pipelines are another and more consequential one. In December 2025, Aikido Security disclosed a vulnerability class it named PromptPwnd, affecting GitHub Actions and GitLab CI/CD pipelines integrated with AI agents. The pattern was devastatingly simple: untrusted input from issue bodies, pull request descriptions, or commit messages was embedded directly into agent prompts. The agent, holding privileged access to repository secrets, interpreted malicious text as instruction and executed it.

Researcher Rein Daelman of Aikido demonstrated the attack against Google's own Gemini CLI repository. By submitting an issue containing hidden instructions, Daelman directed the agent to execute shell commands that leaked the repository's GEMINI_API_KEY, GITHUB_TOKEN, and Google Cloud access tokens. Google patched within four days, but the implications ran well beyond a single repository: Aikido confirmed that at least five Fortune 500 companies were affected, and open-sourced Opengrep rules and a scanning tool to help developers find vulnerable workflow files. The same year brought CVE-2025-53773, a hidden prompt injection in pull request descriptions that achieved remote code execution through GitHub Copilot at a CVSS score of 9.6. PromptPwnd also showed that environment variables offer no protection. Configurations that appeared restrictive, such as Claude Code Actions' allowed_non_write_users setting, amplified risk when misconfigured, and some could be triggered by anyone filing an issue, making them reachable by attackers with no prior access.

March 2026 supplied the ecosystem-scale proof, and it began with a credential rotation somebody thought was finished. Aqua Security, maintainer of the widely used Trivy vulnerability scanner, disclosed a comparatively small breach in late February 2026. The rotation that followed was partial, and the attackers retained access. The group, which calls itself TeamPCP and which Google tracks as UNC6780, used that retained access on 19 March to force-push malicious commits to 76 of the 77 version tags on the trivy-action repository and to all seven tags on setup-trivy, then published a malicious Trivy 0.69.4 release through official distribution channels. Over the following days the same operation reached Checkmarx's KICS and AST GitHub Actions, and then LiteLLM. Microsoft's incident analysis is unusually direct about the mechanism: the attackers leveraged access from a prior incident that had not been fully remediated. Partial remediation of a minor compromise financed a major one.

LiteLLM's CI/CD pipeline pulled Trivy from apt without a pinned version, so the poisoned action ran inside its GitHub Actions runner and exfiltrated the project's PYPI_PUBLISH token from the runner environment. Five days after the Trivy compromise, that token was used against LiteLLM's PyPI publishing pipeline. Malicious versions 1.82.7 and 1.82.8 went live at 10:39 UTC on 24 March 2026 and were quarantined by PyPI roughly 40 minutes later. The two used different injection techniques, and the second is the more alarming. Version 1.82.7 carried a base64-encoded payload inside litellm/proxy/proxy_server.py that executed whenever anything imported litellm.proxy. Version 1.82.8 added a litellm_init.pth file to site-packages, a file type Python executes on every process startup in any environment where the package is installed, which converts a library compromise into an interpreter compromise. The payload ran a three-stage operation: credential harvesting, attempted lateral movement across Kubernetes clusters, and installation of a persistent systemd backdoor that polls for further payloads. CloudSEK's analysis of roughly 434,000 captured files mapped them to more than 2,500 organisations, a figure the firm was careful to describe as potential exposure rather than a victim count, because it identifies organisations whose credentials may have been captured rather than organisations known to have been breached. On 2 July 2026 the FBI issued FLASH-20260702-01, warning that affiliated actors are likely to weaponise credentials exfiltrated during the campaign long after the initial compromise, and urging rotation of CI/CD secrets, publishing tokens, and cloud credentials exposed during the relevant windows. The tail of this compromise is measured in months, not days.

None of it was a flaw in LiteLLM's own code, which is exactly what makes it the strongest available argument about pipelines. LiteLLM is the language model gateway used by CrewAI, DSPy, Microsoft GraphRAG, and dozens of other agent frameworks, so the chain ran from a security scanner to a CI/CD pipeline to a package registry and into the agent framework supply chain, with each link trusted precisely because the one before it was. The recursion is the point: the case for treating pipelines as attack surface was proved by an attack that travelled through the tooling of the people who do security professionally. A single compromised workflow affects every build and release passing through it, arriving through the automation organisations trust to enforce quality.

The Model Context Protocol and Supply Chain Peril

The Model Context Protocol has become the connective tissue of the agentic ecosystem, the standardised interface through which agents discover and invoke external tools. Wiz Research found in early 2026 that MCP servers were present in at least 80 per cent of observed cloud environments, and that 5 per cent of those ran at least one internet-facing server. Adoption at that speed has been matched by an equally rapid accumulation of vulnerabilities.

The tool poisoning attack Invariant Labs discovered exploits a fundamental design characteristic. Tool descriptions are transmitted as metadata that models process as instructions, while users see only simplified tool names. A malicious server can embed hidden directives within those descriptions, using constructs such as tags that are invisible to the operator and fully visible to the model. The specification allows tool definitions to change between tools/list responses with no integrity check, no hash pinning, and no mandatory re-approval. This creates the conditions for rug pull attacks, in which a tool that appeared safe at installation quietly mutates weeks later, and for the tool shadowing seen in the WhatsApp demonstration.

The scope of implementation flaws is sobering. Research compiled by Tigran Bayburtsyan found that 43 per cent of tested MCP implementations contained command injection flaws and 30 per cent allowed unrestricted URL fetching. Three chained vulnerabilities in Anthropic's own mcp-server-git achieved remote code execution via malicious .git/config files, and its MCP Inspector permitted unauthenticated execution through its proxy architecture, meaning that merely inspecting a malicious server could compromise a developer's machine. In September 2025 the first malicious MCP server was found in the wild, an npm package impersonating Postmark's email service that worked normally while secretly copying every message to an attacker. The following month, the Smithery attack affected over 3,000 hosted applications and their API tokens.

Then, on 15 April 2026, OX Security disclosed something categorically different. Its researchers reported a systemic architectural vulnerability in MCP's STDIO transport, the mechanism by which most local servers launch: user-controlled configuration values flow directly into shell execution without sanitisation or allowlisting. The flaw sits not in a third-party implementation but in Anthropic's official SDKs, across Python, TypeScript, Java, and Rust alike. The injected command executes even when the target process fails to start, so an attacker does not need a working server, only a configuration entry. The numbers are unusual for a single disclosure: more than 150 million package downloads, roughly 7,000 publicly reachable servers, an estimated 200,000 vulnerable instances, commands executed against six live production platforms, and nine of eleven MCP registries affected. Ten CVEs accompanied the disclosure and fourteen have followed, most critical, including LiteLLM (CVE-2026-30623), Agent Zero (CVE-2026-30624), and Windsurf IDE (CVE-2026-30615), alongside Fay, LangChain, and IBM LangFlow. OX Security grouped the exploitation into four families: unauthenticated interface injection, hardening bypasses in protected environments, zero-click prompt injection in AI IDEs, and malicious distribution through registries.

The decisive moment came not in the disclosure but in the response. During coordinated disclosure in January 2026, Anthropic confirmed the behaviour was intentional. Its position is that STDIO execution is a secure default provided developers restrict what may appear in the command field; sanitisation is the developer's responsibility. Nine days after initial contact it updated SECURITY.md to advise caution with STDIO adapters. No architectural change was made. Some researchers now call it the protocol that will not be patched.

This is qualitatively unlike every other item catalogued above. A rug pull abuses a specification gap; an unsanitised AppleScript call is a bug with a patch number. Here there is no patch to wait for, because the maintainers do not accept that the flaw is theirs to fix, and their reasoning is not unserious: a protocol that launches local processes must let a developer specify what to launch. But the standard advice, treat every MCP server as a third-party dependency and vet it accordingly, no longer reaches far enough. Vetting assumes the ecosystem beneath the dependency is sound. Organisations must now defend against a transport whose specified behaviour is itself the exploitation primitive.

When the Marketplace Becomes the Payload

The governance argument for MCP servers generalises, and in February 2026 it did so violently. Researcher Paul McCarty identified 386 malicious skills on ClawHub, OpenClaw's official skill repository, published between 1 and 3 February. Koi Security's Oren Yomtov then audited all 2,857 skills available and found 341 malicious, 335 of them traced to a single coordinated operation now tracked as ClawHavoc.

The skills impersonated crypto-trading automation using real brand names including ByBit, Polymarket, Axiom, Reddit, and LinkedIn, and deployed infostealers on macOS and Windows that harvested exchange API keys, wallet private keys, SSH credentials, and browser passwords. All shared common command-and-control infrastructure, and a single account, hightower6eu, accumulated close to 7,000 downloads. By 16 February the count had reached 824 malicious skills across a registry that had itself expanded past 10,700, and Antiy Labs eventually catalogued 1,184 published to ClawHub over the platform's history.

The lesson is not specific to one marketplace. Every agent extension ecosystem reproduces the same structure: low-friction publishing, a naming system that permits brand impersonation, an install flow granting broad local privilege, and review that scales far more slowly than submissions. The npm and PyPI ecosystems took a decade to learn this. Agent marketplaces are relearning it in months, with the aggravating factor that the installed artefact is not a library the developer calls but an instruction set the agent obeys.

The IDEsaster Landscape

The attack surface extends beyond servers and registries into development environments themselves. Over a six-month investigation, security researcher Ari Marzouk, who publishes as MaccariTA, identified a pattern he named IDEsaster: more than 30 vulnerabilities across over ten market-leading products, including Claude Code, Cursor, GitHub Copilot, Windsurf, JetBrains Junie, and Zed.dev, of which 24 received assigned CVEs. His central finding was unambiguous. One hundred per cent of tested AI IDEs were vulnerable.

The research revealed three core attack patterns. Remote JSON schema attacks exploit the tendency of IDEs to fetch schemas referenced in JSON files automatically; an attacker who prompts the agent to write a file containing a remote schema reference can cause the IDE to transmit data as URL parameters when fetching it, exfiltrating information even with human-in-the-loop protections and diff preview active. Settings overwrite attacks modify .vscode/settings.json or .idea/workspace.xml to redirect executable paths to malicious code, with CVEs assigned to Cursor, Roo Code, and JetBrains Junie. The third pattern exploits multi-root workspace files, affecting GitHub Copilot, Cursor, and Roo Code.

What makes these attacks troubling is that they defeat the safeguard most developers rely on, the confirmation prompt. Even with diff preview enabled and approval required for every change, they succeed because the malicious behaviour sits inside changes that look benign. A remote schema reference looks like ordinary configuration; a workspace settings change looks routine. The reviewer, facing hundreds of them daily, has neither the time nor the context to spot the threat. Context hijacking extends this through vectors few would think to inspect: poisoned URLs containing invisible Unicode characters, malicious .cursorrules files inside cloned repositories, and instructions hidden in filenames.

The Vulnerability Moves Down a Layer

On 7 May 2026, Microsoft disclosed two vulnerabilities in its own Semantic Kernel framework that shifted the problem again. CVE-2026-26030, affecting the Python package before version 1.39.4, arose from unsafe string interpolation in a default filter function. The framework used eval() to build lambdas from filter strings the model controlled, so an attacker could close the quote, append Python logic, and turn a data lookup into an executable payload. A blocklist meant to stop exactly this was circumvented by traversing Python's type system to reach __name__, load_module, and eventually system, reconstructing dangerous capability from parts that were individually permitted.

CVE-2026-25592, affecting the .NET SDK before 1.71.0, was simpler and more instructive. A DownloadFileAsync method had been marked with the [KernelFunction] attribute, making it directly callable by the model. With no path validation on its destination parameter, it permitted arbitrary file writes to the host, breaking container isolation by writing a payload into the Windows Startup folder from inside a sandboxed session. Nobody chose to expose that capability. An annotation intended to publish useful functions to a model published a dangerous one.

Microsoft's remediation was properly layered: allowlists of permitted AST node types and callable functions, a blocklist of attributes used for class hierarchy traversal, and a restriction on name nodes to lambda parameters, plus removal of the offending attribute and canonicalised path validation. The significance lies in the location rather than the fix. Every vulnerability discussed so far lived in an agent's configuration, tools, or extensions, the layer an organisation controls. These live in the framework that builds agents, beneath the layer most security teams inspect.

Building Layered Defences

The OWASP GenAI Security Project announced its Top 10 for Agentic Applications on 9 December 2025, explicitly as the 2026 edition, the product of more than a year of research involving over 100 researchers and an expert board including NIST, the European Commission, and the Alan Turing Institute. It spans ten categories, from agent goal hijacking and tool misuse through identity abuse, insufficient sandboxing, and supply chain compromise to memory manipulation, cascading failures, and rogue agents.

It also introduces a concept that may prove as consequential as its predecessor, least privilege: the principle of least agency. Where least privilege restricts what permissions a process holds, least agency restricts what autonomous decisions an agent may make. An agent with broad tool access but constrained autonomy can still be held to bounded, well-defined tasks.

Meta gave that principle an implementable shape. Its Agents Rule of Two, published on 31 October 2025, holds that until prompt injection can be reliably detected and refused, an agent must satisfy no more than two of three properties within a session: processing untrustworthy input, accessing sensitive systems or private data, and changing state or communicating externally. Where all three are genuinely required, the agent should not operate autonomously and needs human approval or another reliable means of validation, with a fresh context window as the mechanism for resetting the count. It is the lethal trifecta expressed as an operational constraint rather than a warning, and OWASP names the two together as the field's dominant heuristics. The practical value is that it is checkable: an engineer can read a session configuration and count.

The first implementation layer is tool restriction: limiting which commands, APIs, and resources an agent may reach, and separating operations safe to auto-approve, such as reads and static analysis, from those needing approval, such as filesystem writes, package installation, and outbound network calls. The separation is not merely administrative tidiness. It maps the blast radius of a successful injection, because an agent that can only read cannot exfiltrate, and an agent that cannot install packages cannot be handed a payload by a poisoned manifest. Trail of Bits' argument injection research is the caveat that keeps this honest: allowlisting a command name without constraining its arguments is not a control, it is a label. The lesson generalises well beyond the specific flags Vandevanter demonstrated. Any tool rich enough to be worth giving an agent has a parameter space large enough to conceal an escape, so restriction is better expressed in terms of the capability granted than the binary invoked. Anything that can spawn a subprocess, write to an arbitrary path, or fetch a remote resource should be treated as the dangerous capability it is, whatever name sits at the front of the command line.

The second layer is sandboxing, and here the past year has produced genuine movement. Software-only isolation was always the weak form of this recommendation; Bayburtsyan's research emphasised the need for hardware-enforced boundaries. Claude Code now ships operating-system-level sandboxing that enforces filesystem and network isolation through the kernel rather than through trust or prompt engineering, routing network access through a proxy outside the sandbox, applying domain allowlists, and prompting on first contact with a new domain. That last detail matters more than it appears. It moves the approval decision off the question the model can be manipulated about, whether an action is reasonable, and onto one it cannot, whether a destination is on a list. The Semantic Kernel file write is the reminder of what happens when the boundary is enforced anywhere softer: an isolation layer defeated by a single unvalidated destination path was never isolation, only a convention that the code inside agreed to observe. A recommendation made in the abstract a year ago is now a shipped default.

The third layer is identity and credential isolation, which has matured from an aspiration into a standards effort. Each agent instance should hold unique, scoped credentials granting access only to what the current task requires. Shared credentials and long-lived tokens create the conditions attackers exploit, as the Supabase Cursor breach of mid-2025 showed when an agent with privileged service-role access processed support tickets containing user-supplied SQL. What has changed is that agents are beginning to hold identities of their own. Microsoft Entra Agent ID, first documented in April 2026, issues agent identities that speak OAuth 2.0, MCP, and A2A. NIST's AI Agent Standards Initiative, announced in February 2026, organises the work across three pillars: industry-led standards development, community-led open source protocol maintenance, and research into agent security and identity. The principle emerging from that work is scope attenuation, the rule that each delegation hop must narrow and never widen the permitted action set, so no sub-agent accumulates capabilities the original human principal never authorised. Cryptographic workload identity, through SPIFFE and SPIRE identity documents or OIDC-federated tokens, replaces the shared API key with something that can be scoped, attributed, and expired.

The fourth layer is trust boundary enforcement. Every piece of external data an agent processes must be treated as adversarial, scanned not only for injection patterns but for hidden instructions, role-playing directives, and system prompt overrides. The list of entry points is longer than most teams assume: issue bodies and pull request descriptions, fetched web pages, the output of one tool feeding the input of the next, dependency manifests, and the configuration files that arrive with any cloned repository. Invisible Unicode and instructions concealed in filenames both belong on the same list. But the layer should be held loosely, because filtering is a probabilistic control applied to a probabilistic system, which is why it is the last of the preventive layers rather than the first.

The fifth layer is monitoring and anomaly detection, and it exists because the preceding four will eventually be got round. Agent actions warrant the scrutiny given to privileged human users, which means baselining what normal looks like for a particular agent in a particular repository and alerting when behaviour departs from it. The baseline is more tractable than it sounds, because agents are creatures of habit. A documentation agent that reads Markdown and opens pull requests has a behavioural signature, and a sudden interest in environment variables, credential stores, or outbound connections is a deviation visible without any understanding of what the agent was asked to do. Continuous comparison against expected patterns catches the class of compromise that defeats every preventive control by looking legitimate at each individual step, because in those cases the anomaly lives in the aggregate rather than in any single action. Detection of this kind is imperfect and will fire on unusual but entirely legitimate work. That is the right trade for a system whose characteristic failure mode is silence.

Audit Logging as Institutional Memory

Detection without documentation is insufficient. An effective agent log should capture the instruction that triggered each action, the tools invoked and the arguments passed, the outputs and side effects, the credentials used, timestamps precise enough for causal ordering, and the provenance of any external data the agent consumed. This matters for two reasons. Prompt injection is designed to be invisible, so without logs there is no artefact to investigate and no way to establish whether an agent was manipulated or merely mistaken. And because identical inputs can produce different outputs, a decision cannot be reproduced unless it was recorded at the time it was made. The log is the only durable evidence that a probabilistic system ever behaved in a particular way.

Logging also underwrites the control that matters most once something has gone wrong, which is the ability to stop the agent mid-action. Every major tool exposes a manual interruption path: Ctrl+C in Cursor, Cmd+Esc in VS Code, Esc in Claude Code. These are worth knowing and worth teaching, but they depend on somebody watching at the moment it matters, which is precisely the assumption agentic workflows are designed to remove. Beyond manual intervention, organisations should implement automated kill switches that trigger when agent behaviour exceeds defined parameters: an unusual volume of file modifications, network requests to unknown domains, or attempts to reach credentials outside the agent's designated scope. The thresholds are organisation-specific, and the first versions of them will be wrong. Thresholds set too tightly halt an agent that was doing legitimate work, which is an annoyance measured in minutes. The absence of a halt is measured in the FBI advisories that follow months later.

Logging must also span agent boundaries, and OWASP's emphasis on cascading failures explains why. When multiple agents interact, whether through direct communication or through shared resources such as a repository, a job queue, or a common memory store, a compromise in one propagates through the system. An injected instruction absorbed by the first agent becomes a plausible-looking artefact consumed by the second, and by the third the origin has vanished entirely, because what the third agent sees is simply the state of the codebase. Tracing that chain of causation after the fact requires detail comparable to distributed tracing in microservices, applied to decision-makers whose behaviour is inherently less predictable than deterministic software. The comparison is instructive and also generous to the problem. Microservices at least fail the same way twice.

Preserving Autonomy Within Boundaries

The central tension in agent security is that every control reduces capability. Requiring approval for every tool invocation eliminates the productivity benefit that justified deployment; restricting agents to read-only operations prevents the work that makes them valuable. Over-constrained agents become expensive autocomplete. The pragmatic path accepts that some risk is inherent and concentrates on making it manageable, building architectures where no single control is assumed sufficient and the failure of one layer is caught by the next.

Plan-then-execute workflows offer one approach: requiring agents to produce execution plans for review before acting inserts a checkpoint without discarding their reasoning. It is not foolproof, since a sophisticated injection could produce a plan that reads as benign, but it raises a single-step exploitation into a multi-stage deception that must survive scrutiny. Its underrated value is that it changes what the reviewer is asked to look at. A diff shows what will change; a plan shows what the agent believes it has been asked to do, and a hijacked goal is far more legible in a statement of intent than in the file that intent eventually touches. Tiered autonomy provides another frame: low-risk operations such as reading code, running tests, and producing analysis proceed autonomously, source modification requires automated policy checks, and pushing to production or accessing secrets always requires explicit authorisation. Read against the Rule of Two, this keeps the sessions touching untrusted content separate from those holding sensitive access and outbound reach, which is the same discipline expressed as a workflow rather than a count.

Egress filtering remains the most underrated control available. Most exfiltration depends on the agent reaching an attacker-controlled endpoint, so restricting which domains it may contact, and alerting on attempts to reach anything else, disrupts exfiltration even when injection succeeds. The alert is as valuable as the block. A blocked request to an unrecognised domain is close to a positive indicator of compromise, and it is one of very few signals in this field that does not require anyone to interpret a model's reasoning. Egress filtering removes the third leg of the trifecta outright, which is why kernel-enforced network isolation with domain allowlisting is the highest-value change most teams can make this quarter.

MCP server governance deserves particular attention, with the caveat the OX Security disclosure imposes. Organisations should maintain curated registries of approved servers, prohibit dynamic loading of tool definitions from untrusted sources, and monitor definition integrity continuously, the discipline Invariant Labs' MCP-Scan was built to support. But vetting does not address a transport whose vendor considers the execution behaviour correct, which means the configuration files feeding server definitions must themselves be treated as executable content, versioned, reviewed, and access-controlled accordingly.

None of this composes into a guarantee, and the framing matters. Layered defence is not a claim that five imperfect controls multiply into one reliable control. It is a claim that their failure modes are uncorrelated enough that an attacker must defeat several unrelated mechanisms rather than one. Prompt injection defeats the model's judgement. It does not defeat a kernel-enforced network boundary, a scoped credential that expires, or an alert that fires on a file-modification threshold, because none of those controls consult the model about whether they ought to apply. That is the design principle underneath every recommendation here: place as much of the enforcement as possible in the parts of the system the agent cannot argue with.

The Institutional Challenge

The technical controls above are necessary but insufficient. The deeper challenge is institutional: building cultures that treat agent security as a first-class concern.

The scale is now measurable. OWASP's State of Agentic AI Security and Governance, published in June 2026, tracks 53 agentic projects, 28 of them coding agents, with Claude Code, Gemini CLI, Codex, Cline, and Aider growing fastest. Advisory counts are already substantial: 57 for n8n, 22 for Claude Code, 15 for AutoGPT, 13 for Dify, 11 for Roo-Code. Release velocity compounds the triage burden, with one tracked project averaging a release every eight hours. No security team reviews changes at that cadence. The governance model most organisations apply, periodic review of a stable dependency set, does not survive contact with software that reissues itself three times a day.

Bayburtsyan's observation that “IDEs were not originally built with AI agents in mind” applies equally to the governance structures within which they operate. His sharper point is that “once AI began to take action, the nature of security changed forever.” Most organisations adopted these tools on the strength of productivity promises, addressing security retrospectively if at all. The result is a landscape where agents hold privileges no human developer would receive without vetting, tool access is configured for convenience, and behavioural monitoring is minimal. Reversing this means involving security teams from the outset, bringing agent configurations under the change management applied to infrastructure, and writing agent compromise into incident response plans. Training matters too: developers must understand that pull requests can carry injections, that MCP tools can mutate after installation, that marketplace extensions can be hostile at a rate approaching one in eight, and that agent output is untrusted however confident it sounds.

Sixteen months after the WhatsApp demonstration, the honest assessment is neither vindication nor despair but a split verdict. Real defences shipped. Kernel-enforced sandboxing exists and is available by default. The Rule of Two and the lethal trifecta have given engineers a vocabulary precise enough to design against. Agent identity has moved from conference talk to standards initiative, with NIST convening the work and scope attenuation as its organising principle. These are not gestures; they are the recommendations of 2025 arriving as products. And yet the underlying problem is untouched. OWASP's researchers now describe prompt injection not as a defect awaiting a patch but as a structural property of how language models consume tokens, and the year's most consequential disclosure ended with a protocol's maintainers declining to change it. That is the tension the industry has to hold. The perimeter around the agent is getting genuinely stronger while the thing inside it remains, by construction, persuadable. Every control described here is an admission of that, a way of ensuring that when an agent is talked into working for the attacker, and it will be, the damage is bounded by something that cannot be talked into anything.

References and Sources

1. Invariant Labs. “WhatsApp MCP Exploited: Exfiltrating Your Message History via MCP.” invariantlabs.ai, April 2025. https://invariantlabs.ai/blog/whatsapp-mcp-exploited
2. Invariant Labs. “MCP Security Notification: Tool Poisoning Attacks.” invariantlabs.ai, April 2025. https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks
3. Willison, S. “The Lethal Trifecta for AI Agents.” simonwillison.net, 16 June 2025. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
4. Willison, S. “Model Context Protocol Has Prompt Injection Security Problems.” simonwillison.net, 9 April 2025. https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/
5. Vandevanter, W. “Prompt Injection to RCE in AI Agents.” Trail of Bits Blog, 22 October 2025. https://blog.trailofbits.com/2025/10/22/prompt-injection-to-rce-in-ai-agents/
6. Cymulate. “CVE-2025-54795: InversePrompt: Turning Claude Against Itself.” Cymulate Blog, August 2025. https://cymulate.com/blog/cve-2025-547954-54795-claude-inverseprompt/
7. Lynch, B. “From Assistant to Adversary: Exploiting Agentic AI Developer Tools.” NVIDIA Developer Blog, 2025. https://developer.nvidia.com/blog/from-assistant-to-adversary-exploiting-agentic-ai-developer-tools/
8. Daelman, R. “PromptPwnd: Prompt Injection Inside GitHub Actions.” Aikido Security Blog, December 2025. https://www.aikido.dev/blog/promptpwnd-github-actions-ai-agents
9. The Hacker News. “Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations.” thehackernews.com, 12 August 2026. https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html
10. Microsoft Security. “Detecting, Investigating, and Defending Against the Trivy Supply Chain Compromise.” Microsoft Security Blog, 24 March 2026. https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/
11. OX Security. “The Mother of All AI Supply Chains: Critical Systemic Vulnerability at the Core of the MCP.” ox.security, 15 April 2026. https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/
12. The Hacker News. “Anthropic MCP Design Vulnerability.” thehackernews.com, April 2026. https://thehackernews.com/2026/04/anthropic-mcp-design-vulnerability.html
13. Wiz. “Model Context Protocol (MCP) Security.” wiz.io, 2026. https://www.wiz.io/academy/ai-security/model-context-protocol-security
14. AuthZed. “A Timeline of Model Context Protocol (MCP) Security Breaches.” authzed.com, 2025. https://authzed.com/blog/timeline-mcp-breaches
15. Code Integrity. “Notion MCP Server Vulnerability Analysis.” codeintegrity.ai, 2025. https://www.codeintegrity.ai/blog/notion
16. Dark Reading. “Malicious OpenClaw Skills on ClawHub Threaten AI Supply Chain.” darkreading.com, February 2026. https://www.darkreading.com/cyber-risk/malicious-openclaw-skills-clawhub-threaten-ai-supply-chain
17. Marzouk, A. “IDEsaster.” maccarita.com, 2025. https://maccarita.com/posts/idesaster/
18. Bayburtsyan, T. “Securing AI Coding Agents: IDEsaster Vulnerabilities.” tigran.tech, 29 December 2025. https://tigran.tech/securing-ai-coding-agents-idesaster-vulnerabilities
19. Microsoft Security. “Prompts Become Shells: RCE Vulnerabilities in AI Agent Frameworks.” Microsoft Security Blog, 7 May 2026. https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/
20. OWASP GenAI Security Project. “OWASP Top 10 for Agentic Applications for 2026.” Announced 9 December 2025. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
21. Help Net Security. “OWASP: Prompt Injection Underpins AI Security Failures.” helpnetsecurity.com, 11 June 2026. https://www.helpnetsecurity.com/2026/06/11/owasp-prompt-injection-ai-security-failures/
22. Check Point Research. “AI Security Report 2026.” research.checkpoint.com, July 2026. https://research.checkpoint.com/2026/ai-security-report-2026/
23. Meta. “Agents Rule of Two: A Practical Approach to AI Agent Security.” ai.meta.com, 31 October 2025. https://ai.meta.com/blog/practical-ai-agent-security/
24. Anthropic. “Claude Code Sandboxing.” code.claude.com, 2026. https://code.claude.com/docs/en/sandboxing
25. NIST. “Announcing the AI Agent Standards Initiative for Interoperable and Secure Innovation.” nist.gov, February 2026. https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...