AI Security Has a New Perimeter. Most Stacks Haven't Moved Yet.

Home Resources

Labs

Tal Melamed

June 9, 2026

12 Min Read

Table Of Contents

Legal Rich Text Anchor Link Text

Ask AI to Write a TL;DR for this article

An AI agent at a financial services firm queries a customer database, summarizes the records, and emails the summary to an outside address.

Every prompt was clean. Every response was on-topic. No jailbreak, no injection, no toxic language. Every guardrail in the stack reported green.

The breach happened anyway.

This is the scenario Gartner's latest emerging technology analysis is built around, and it's worth being precise about what it means. The industry already agrees that prompt filtering isn't agent security. The real question in 2026 is harder: if the perimeter is now the agent's actions, what does enforcement at that perimeter actually look like, and how far is your current stack from providing it?

Prompt Security Is Already Obsolete: Agents Have Moved the Perimeter

For the past few years, AI security has largely meant prompt guardrails: filtering text inputs for toxicity, data leakage, jailbreaks, and prompt injection. That made sense when AI was a chatbot sitting behind a text box.

Agents reason, plan, select tools at runtime, touch production systems, and chain decisions across execution loops. They coordinate with other agents. They do all of it at machine speed, often under auto-run, with credentials a human handed them once and forgot about.

Nobody seriously disputes this anymore. What's underappreciated is the gap it exposes: most enterprise security programs are still instrumented for the old perimeter. The controls watch the conversation. The risk lives in the tool calls.

As Gartner puts it in their Market Guide for Guardian Agents (February 2026):

"The primary risk is not what the AI says, but what the AI does."

Source: Gartner. AI security shifts from supervising conversations to governing autonomous execution.

Stateless Tools Cannot Secure Stateful Agents

Prompt guardrails are stateless by design. Agent security must be stateful by necessity. You can't govern what you can't observe across time and context.

Here's the structural problem, and it's architecture, not maturity.

Traditional AI security is stateless. Each prompt gets evaluated in isolation: classifiers, regex, similarity matching. That model fits a chatbot behind a text box.

Agent security has to be stateful. Risk accumulates across the execution loop: this tool call, given that memory context, after those reasoning steps, on behalf of this delegated task. An individual action can look benign while the sequence is an exfiltration. You can't govern what you can't observe across time and context.

This isn't a theoretical concern. Google Security's April 2026 analysis documents active exploitation of AI agents via indirect prompt injection: attacks where malicious instructions are embedded in data the agent reads, not in the user's input. Palo Alto Unit 42 and Help Net Security have both published in-the-wild telemetry on the same attack class. A prompt filter at the input layer catches none of it. The attack surface for agentic systems runs through every tool call, every data source the agent reads, and every downstream action it takes.

The OWASP Top 10 for Agentic Applications (2026 edition) maps this precisely: the top risks (unchecked agent actions, unsafe tool use, over-privileged identities, and context poisoning) are all execution-layer problems, not input-layer ones. The MITRE ATLAS v5.4.0 adversarial threat landscape (updated February 2026) tells the same story from the attacker's perspective, cataloguing attack techniques that operate entirely below the prompt layer.

A 2025 ScienceDirect paper on LLM-powered agent workflows puts it directly: the attack surface expands with every tool the agent can call. Prompt guardrails secure a boundary that no longer defines the risk. And arXiv research on indirect prompt injections shows that even purpose-built firewalls need stronger grounding; static classifiers are insufficient against adaptive injection techniques.

Five Capabilities Every Enterprise Needs to Govern AI Agents: What Gartner's Framework Requires

The Gartner report, alongside the broader consensus from NIST's AI RMF Agentic Profile v1 published by the Cloud Security Alliance, outlines a clear capability framework for securing agentic AI:

Discovery. Identify agents across the enterprise, understand their configurations, tools, and permissions. Gartner's six-step framework for managing AI agent sprawl (April 2026) starts here: you cannot govern what you haven't inventoried.
Behavioral monitoring. Analyze runtime activity, detect anomalies, track agent actions across cognitive and execution loops.
Identity and access management for agents. Assign workload identities, enforce least-privilege access, and ensure agents can prove who they're acting for and why. HashiCorp's analysis of SPIFFE/SPIRE for agentic non-human identity (NHI) and the GitGuardian Workload Identity Day recap both document how far behind current tooling is on this.
Real-time action authorization. Enforce controls within the agent's execution loop, not after the fact. Gartner states plainly: "If an AI agent cannot prove who it is acting for and why, it should not get access to tools and data."
Runtime Security for agents. The unit of risk isn't the user and it isn't the agent. It's the session. A developer running five coding agent projects/sessions from the same endpoint, each with different permissions and tools, can have four sessions doing routine work and one drifting toward something dangerous. Deterministic policies written per user, per agent or per tool can't see that difference. Runtime security for agents means evaluating that risk continuously, as the session unfolds, and responding in proportion to it. The four safe sessions never feel a thing. The risky one gets a graduated response: reinforce security instructions directly into the agent's context, revoke auto-mode so a human is back in the loop, or stop the session outright. The session earns its level of freedom in real time.

The numbers behind this are concrete. Gartner projects that by 2029, over 50% of successful cyberattacks against AI agents will exploit access control issues. And by 2028, AI TRiSM for agents adoption in AI-native software engineering will reach 30%, up from less than 5% today. Zenity's contributions to the MITRE ATLAS 2026 update document that this threat model is already being operationalized by attackers.

The window to build these capabilities is now, not after the breaches.

What Enforcement at the Action Layer Actually Means

The thread running through all of this is the same one: risk is contextual and continuous, so enforcement has to be too. The piece where that breaks the old mental model most completely is authorization.

Authorization bound to purpose, not role. An agent legitimately needs a customer record while it's resolving that customer's support ticket. It does not need that same record ten seconds later while drafting a marketing email. Same agent, same credentials, same role binding: different task, different legitimate access. Role-based permissions have no vocabulary for this. Authorization has to be just-in-time, contextual, and scoped to the specific task in flight. This is the layer we built Tego AI around.

Identity that survives delegation. Orchestrators spawn subagents. Subagents call tools. Every hop is a place where identity and purpose can silently widen. Cryptographic workload identity at each delegation hop, with scope that narrows rather than inherits, is the architecture the frameworks are converging on.

Human attention as an escalation, not a gate. Putting a human approval in front of every sensitive action does not scale to agent operating speed; you end up rubber-stamping or bottlenecking, and both kill the deployment. The scalable model is the inverse: enforcement runs autonomously by default, and human judgment is pulled in only when session risk warrants it, by requiring a justification or revoking auto-mode. Humans stop being the gate and become the response.

An action-level audit trail. Not the conversation log. A record of what was accessed, what was executed, under which identity, for which purpose, at every step of the loop. When something goes wrong at machine speed, this is the difference between an incident report and a guess.

The Practical Question for Security Teams

The requirement space is now well-defined. OWASP for the threat taxonomy, MITRE ATLAS for attacker technique mapping, NIST's agentic profile for governance controls, Gartner's guardian agent framing for the vendor landscape. Nobody needs to invent the requirements anymore.

The open question for every security team is narrower and more urgent: how fast can you close the distance between what your infrastructure provides today (static identities, pre-authored policies, after-the-fact logs) and what agents operating at full autonomy actually require, which is continuous, session-level evaluation with enforcement inside the execution loop? The organizations deploying agents are not waiting for the security stack to catch up.

Q&A

Q: What does "securing agent actions" actually mean in practice?

It means moving the enforcement point from the input layer (what users ask the agent) to the execution layer (what the agent does). Concretely: enforcing access control at each tool call, validating that the agent's claimed identity and purpose match the action it's requesting, and maintaining an auditable record of every action taken across the agent's execution loop, not just logging the conversation.

Q: Why can't we just use existing IAM systems for AI agents?

Existing IAM is designed for human users and static service accounts. AI agents are different in three ways: they act dynamically (selecting tools at runtime), they operate across delegation chains (orchestrators spawning subagents), and they need purpose-aware authorization (the same agent should have different access depending on what task it's executing). Static role bindings don't model any of this. Workload identity frameworks like SPIFFE/SPIRE are closer, but still require agentic-specific extensions for per-task scope reduction.

Q: What is indirect prompt injection, and why does it matter for agent security?

Indirect prompt injection is an attack where malicious instructions are embedded in data an agent reads (a web page, a document, a database record) rather than in the user's input. The agent processes the malicious content as instructions and executes actions the attacker intended. It's invisible to input-layer guardrails because the attack vector is the agent's tool use, not its prompt. Palo Alto Unit 42 has documented active exploitation of this in the wild.

Q: What is runtime security for agent sessions, and how is it different from policy-based controls?

Policy-based controls require someone to predict risk in advance and encode it deterministically, per user or per agent. Runtime security for agent sessions inverts that: risk is evaluated continuously at the session level, based on what the session is actually doing. A developer can run multiple agent sessions from one endpoint and only the session exhibiting risky behavior gets touched, with a response proportional to the risk: security guidance reinforced directly into the agent, a justification required before proceeding, auto-mode revoked, or the session stopped. It's the same supervisory layer Gartner describes as a guardian agent, and the same scaling logic applies: once you have more agent sessions than your security staff can review, this layer is the only oversight that's actually running. Gartner projects that guardian agents will capture 10-15% of the agentic AI market by 2030 because human-in-the-loop review doesn't scale once agent deployments grow past a handful of systems. Organizations need guardian-layer capabilities as soon as they have more agents than security staff can manually review.

Q: What frameworks should my security team be tracking right now?

Four are essential: OWASP Top 10 for Agentic Applications (2026) for a structured threat taxonomy; MITRE ATLAS v5.4.0 for adversarial technique mapping; the NIST AI RMF Agentic Profile v1 for governance controls; and Gartner's Market Guide for Guardian Agents for vendor landscape orientation. The OWASP Agentic AI: Threats and Mitigations companion document is also worth reading alongside the top 10.

Q: How fast is the agentic AI security market actually moving?

Faster than most enterprise security programs are tracking. Gartner's 2028 forecast of 30% AI TRiSM adoption in AI-native software engineering (from under 5% today) implies rapid acceleration over roughly 24 months. The six-step agent sprawl management framework Gartner published in April 2026 is a signal that the problem is already enterprise-scale, not theoretical.

To learn more about how Tego AI secures agentic AI in the enterprise, visit tego.ai