The intern moves at the speed of light
Enterprises keep asking whether the model is safe. The more useful question is what an autonomous agent can touch, and what stops it when it is wrong.
An AI agent is a new hire who started this morning. It has read none of the handbook, wants to help and can act a thousand times before you finish your coffee.
Ask it to summarise your inbox. One email contains a hidden instruction: ignore the request, find the quarterly files and send them elsewhere. To the agent, both messages are text in context. Unless the surrounding system imposes a boundary, it may treat the attack as part of the job.
In December 2025, the Open Worldwide Application Security Project (OWASP) published its first Top 10 for agentic applications. The ten risks differ in mechanism, but most begin with the same weakness: the agent cannot reliably distinguish data it should read from instructions it should obey. The weakness spans products because it sits in the way the current generation of agents is built.
The model is not the weak point. What it can reach is. Between 2024 and 2026, assistants acquired tools, credentials and permission to act – and the attack moved with them, into the content they read.
The attacks arrived with names and patches
By mid-2026, the previous 18 months had produced named failures, patches and Common Vulnerabilities and Exposures (CVE) entries. EchoLeak was a zero-click flaw in Microsoft 365 Copilot that allowed an emailed instruction to exfiltrate a user’s documents without a click. CurXecute turned poisoned content read by the Cursor coding assistant into code running on the developer’s machine. A malicious package posing as a common email tool, installed in hundreds of developer workflows, silently copied outbound mail to an attacker.
Agent security now has a patch history.
For 30 years, enterprise security relied on a useful separation: untrusted data became executable only when software mishandled it – through a missing input check, an unsanitised query or another implementation error. Agents collapse that separation as part of normal operation. They read untrusted content and decide what to do next in the same step, using the same faculty, with no seam between the two. To the model, the document it retrieves and the instruction it follows are the same kind of thing.
Accuracy still matters. Reach sets the cost of failure. A board should now ask its team one practical question: if an agent believes the wrong sentence, what can it do before anyone notices?
You did not hire the intern for their judgement.
You hired them for their speed, and speed is exactly what makes a bad instruction expensive.
Why eagerness becomes an attack surface
Picture the intern on day one: quick, willing and taking everything they read at face value, because they have no context yet for what is normal and what is an attack. That is the sharpest way to hold an AI agent in mind – an intern who moves at the speed of light, does not know what is going on and is very easy to please. Now give them your credentials, point them at the inbox and document store, then leave for a meeting. The metaphor predicts three recurrent failures.
Goal hijack
An eager intern acts on a note left inside a file. OWASP calls this goal hijack; engineers usually encounter it as prompt injection. The instruction can be waiting in an email, a web page, a support ticket or a SharePoint document. The person who assigned the task never sees it.
ConfusedPilot, a 2024 study of Microsoft Copilot, showed that anyone with write access to a shared corpus could insert a document that redirected the answers Copilot gave to other users in the organisation.
Privilege abuse
An intern without a map of the locked drawers opens whatever the key allows. Agents often run with the credentials of the user or service account that configured them, and those permissions are commonly broader than the task. A successful injection therefore hands that reach to the attacker.
The risk often appears only when ordinary choices combine: token scopes nobody has audited; a command intended for a local copy that can execute against production; and no approval gate. Each choice may pass a review on its own. Together, they determine the blast radius.
Memory and retrieval poisoning
An intern who trusts their own notes will keep acting on a forged one. Once a false instruction enters long-term memory or a retrieval store, it can resurface on later tasks, long after the attacker has left. The agent has no inherent way to recognise that the note was planted.
Across all ten risks, model intelligence is secondary. Security turns on reach and review: what the intern can touch, and whether anything checks the work before it acts.
The note can be planted hours or weeks earlier. The failure takes milliseconds because the agent supplies the speed.
Mostly old discipline, worn by a faster worker
Most of the OWASP list is familiar software-engineering discipline returning under pressure: least privilege, input validation, dependency pinning and sandboxed execution. The same controls have sat on web-security lists for years. Agents make their absence more expensive because they do not know which conventions are safety-critical.
The supply-chain attack delivered through a fake email package was a classic dependency compromise. CurXecute was injection in a new wrapper.
A smaller set of risks is genuinely new. Insecure inter-agent communication and cascading failures appear when agents talk to one another, delegate work and pass errors between systems. Rogue-agent risk appears when an agent can act beyond its intended constraints, with no person between steps. One underlying property also changes the engineering. Classical systems can enforce a boundary between instructions and data. A language model processes both as tokens.
The remedy cannot live solely in a stronger prompt. You do not secure an intern by giving them a sterner induction talk; you secure them by controlling what they can reach and what happens before an irreversible action. Around the model, that means narrow permissions, provenance, isolated execution and approval gates. Agent security is therefore a mixed discipline. Most of it is established practice applied to a worker that moves at machine speed and cannot reliably tell data from commands. The rest comes from autonomy and scale.
The field moved slowly, then quickly: from early warnings to named attacks and operational exposure. By 2026, it had a shared taxonomy and a defence with provable guarantees.
Where the risk bites
The mechanism is common. The consequences depend on what the agent can reach.
Biopharma – structural risk
Clinical document retrieval, regulatory submissions and lab notebooks rely on data integrity. Retrieval poisoning contaminates the evidence trail itself, in a setting where that trail is inseparable from the product.
Insurance – operational risk
Claims triage, fraud signals and policy-document analysis often begin with material supplied by a claimant or third party. Provenance and human sign-off belong before any payout or bind.
Manufacturing – structural risk with physical consequences
Supplier documents, maintenance logs and control-system interfaces extend the agent into operational systems – often within sovereign or locally controlled environments. A supply-chain or code-execution failure can then leave the screen and reach the plant.
Any regulated sector – a performance trade-off
Developer assistants, internal copilots and task automation produce gains that are real but modest, bought by accepting risk that still has to be scoped and contained.
Three questions for every agent
‘Is it secure?’ is too broad to produce a useful answer. Three narrower questions create a measurable baseline.
1. How much of its permission set does the task use?
For each agent, list every scope on its credentials, then log the scopes it exercises over a week. The share it never uses is the least-privilege gap, and it is often larger than the design documents suggest.
2. Which actions can it take without confirmation?
List every irreversible action: sending money, sending email, writing to production, deleting a record or changing a customer outcome. Any item without a human gate belongs in the blast radius.
3. Can you trace every input?
Record where each document, email and tool result came from. After an incident, could you establish whether the content had been altered and trace the poisoned instruction back to its source? Without provenance, the answer is no.
Together, these measures establish a baseline for the agentic attack surface. For most organisations moving from copilots to agents, it is probably wider than it was 12 months ago.
Trust has to be earned per system
For most AI workloads, the productivity is worth having and the risk is manageable with ordinary engineering care. An assistant that is narrowly scoped, read-only and unable to send anything out has a far smaller security blast radius. An agent that can send money, email, write to production or delete records belongs in a different control class.
The evidence is now on the record. EchoLeak was rated 9.3 on the ten-point severity scale and required no user interaction. CaMeL, from researchers at Google and ETH Zurich, is the first defence reported with provable prompt-injection guarantees: it separates the trusted plan from the untrusted data the agent reads. On the benchmark reported by its authors, it completed 77% of tasks against 84% for an undefended system – a modest but real utility cost for security guarantees that hold within the paper’s threat model.
The count of court decisions catching AI-fabricated citations and quotes passed 1,700 by mid-2026 and was still climbing. The count measures a different failure mode, yet it exposes the same operational imbalance: producing a confident output is cheap and verifying it is expensive.
Trust is system-specific. It depends on the permissions, provenance, gates and measurements surrounding the model.
Working out which agents to narrow, which actions to gate and which evidence would justify wider autonomy is what Brightbeam does. If your team is living with that question, we would welcome the conversation.
For technical readers
The notes below cover the mechanism, current defences, benchmark numbers and a practical test plan.
The mechanism
The vulnerability underneath most of the OWASP agentic list is structural. A transformer processes its system prompt, the user’s request and retrieved content in one token stream. External systems can label and order those inputs, but the model does not expose an architectural channel that guarantees some tokens are trusted instructions and others are inert data. Most mitigations try to reconstruct that boundary around or within the model.
Instruction hierarchy (Wallace et al., OpenAI, 2024) trains the model to prefer higher-privilege instructions. Spotlighting and datamarking (Hines et al., Microsoft, 2024) tag untrusted spans so the model can learn to distrust them. Both lower attack success. Their protection remains probabilistic, so determined injections still succeed often enough to matter.
The strongest current direction treats the model as untrusted by construction. CaMeL (Debenedetti et al., 2025) runs a privileged large language model that sees only the user’s query and emits a restricted program. A quarantined model reads untrusted content but cannot call tools. A custom interpreter tracks the provenance of every value and gates each tool call against a capability policy. An email address that arrived in untrusted content therefore cannot become the recipient of an outbound message.
Simon Willison’s ‘lethal trifecta’ names the precondition these defences target. An agent becomes dangerous when three conditions coincide: access to private data, exposure to untrusted content and the ability to communicate externally. Remove any one and the exfiltration path closes.
The numbers
On AgentDojo (Debenedetti et al., NeurIPS 2024), a widely used agentic prompt-injection benchmark, CaMeL completes 77% of tasks with provable security guarantees within its threat model, against 84% for an undefended baseline. That is a difference of roughly seven percentage points on the benchmark’s task suite with frontier backbone models.
The figure is not portable. The cost depends on how much of the workload requires the quarantined model to reason over data it cannot expose, and complex data-dependent tasks pay more.
On the attack side, retrieval-augmented generation poisoning research – PoisonedRAG, USENIX Security 2025, and CtrlRAG, 2025 – reports around 90% attack success from injecting roughly five crafted documents into a corpus of millions. That result assumes the attacker can write to the indexed store and that retrieval-layer defences are absent.
Install
pip install agentdojo
pip install garak
AgentDojo lets you run the benchmark against your own agent and models. The CaMeL reference implementation is a research artefact for reproducing the paper, not a supported production package. NVIDIA’s garak probes large language model and agent failure modes. Meta’s LlamaFirewall is a guardrail framework; PromptGuard 2 is one of its input-side scanners.
Try
Take one production agent and enumerate every scope on its credentials. Log which scopes it calls over a week of real traffic. Then run AgentDojo as a reference benchmark, and reproduce its attack classes against your real prompt, tools and policies in a staging harness.
Measure
1. The share of granted permissions each agent never exercises – the least-privilege gap.
2. The fraction of agent actions that are irreversible and ungated.
3. Injection attack-success rate on your own prompts and tools, rather than the benchmark headline.
Watch
Capability policies in CaMeL-style systems carry a maintenance burden. The authors also note that user-approval prompts create decision fatigue, which can quietly erode the defence. Prompt-injection susceptibility varies by model family, alignment and attack type; size alone is not a reliable predictor. Multi-agent pipelines reintroduce the attack surface at every hop, so a defence at the edge does not cover the interior.
Read
Defeating Prompt Injections by Design (Debenedetti et al., 2025) sets out the CaMeL architecture and proof. The OWASP Top 10 for Agentic Applications (2025) provides the threat taxonomy and per-item mitigations.
This Perspective emerged from an internal Brightbeam discussion. Our ‘Digital Intelligence: State of the Art and Beyond’ programme is a regular forum where colleagues building production AI systems discuss what is real, what is hard and what is merely fashionable. The thinking presented here is, therefore, collective.