Why does runtime defense need both prompt filtering and host-level controls for AI agents?

Runtime defense needs both because AI risk is split across two planes. Prompt filtering helps stop injection, jailbreaks, and data leakage in transit. Host-level controls stop what happens after an agent executes, including reading sensitive files, spawning processes, or opening network connections. Without both layers, a control gap remains wherever the attack moves outside the request path.

Why prompt filtering alone cannot defend an AI agent at runtime

Prompt filtering is valuable because many agent attacks begin before execution, through injection, jailbreaks, or prompt-mediated disclosure. It shapes what the agent is allowed to see and say, but it does not govern what the agent can do once a tool call, code path, or delegated action is already in motion. Runtime defense has to cover both the instruction layer and the execution layer.

A useful mental model is to separate content control from action control. Prompt filtering reduces malicious input reaching the model, while OWASP Agentic AI Top 10 and AI agent identity security guidance both reflect the separate problem of governing the agent’s authority to act. If the agent can still read files, call services, or invoke shell commands, the adversary may simply shift from prompt abuse to execution abuse.

This is why host-level controls matter in addition to prompt defenses. They constrain the container, VM, or runtime where the agent actually executes, so the agent cannot freely touch secrets, spawn processes, or open arbitrary network connections just because the prompt layer looked clean. Host-level policy is the backstop when the request path fails, and it is often the only layer that can stop post-prompt misuse of tools or local resources.

What each layer blocks, and what it does not

Prompt filtering is strongest against pre-execution threats such as malicious instructions, embedded exfiltration requests, and obvious policy-bypass attempts. It is weaker once the model has already accepted a task and begun planning, because the harmful outcome may now depend on tool output, retrieved context, or side effects outside the prompt itself. That is also why prompt-only defenses are fragile against indirect prompt injection embedded in documents, webpages, tickets, or chat content.

Host-level controls address a different trust boundary. They can limit filesystem access, process creation, outbound traffic, environment variable exposure, and credential reachability even if the model is convinced to act. In practice, that means bounding the blast radius of a compromised agent process so a successful prompt attack does not automatically become environment compromise.

For agentic systems, this layered design is especially important where the runtime can reach sensitive business data or privileged APIs. Controls such as sandboxing, network egress restriction, read-only mounts, and scoped execution tokens turn a prompt compromise into a contained failure instead of a full-system event. The point is not to trust the model less, it is to trust the runtime only as far as its privileges have been deliberately reduced.

Why the gap appears when one control is missing

When only prompt filtering exists, the defender is assuming that preventing bad text is enough to prevent bad outcomes. That assumption fails as soon as the agent has any meaningful authority beyond generating text, because the harmful step may be performed by the host, not the model. When only host controls exist, the system may still ingest malicious instructions that steer the agent into abuse, data leakage, or unsafe tool sequencing before the host ever has a chance to constrain the outcome.

The most common failure pattern is asymmetry: one layer protects inputs, the other protects effects. If either layer is absent, an attacker looks for the path that bypasses the surviving control. That is exactly why runtime defense must be designed as a chain of containment, not a single gate.

Host controls also support incident response. When an agent is forced to run with tight execution boundaries, anomalous file reads, unexpected subprocess creation, and unusual outbound connections become more visible and easier to correlate with a suspicious prompt or tool invocation. That observability is part of the defense, not just an operational convenience.

Risk and Threat Considerations

Runtime agent risk is not limited to prompt injection. Once the agent has local execution rights, the adversary can move from influencing language to abusing authority, which raises the stakes from content misuse to data theft, lateral movement, or destructive action.

Failure mechanism: A malicious prompt or poisoned context steers the agent into an unsafe tool call, then the host grants access to files, processes, secrets, or network paths that the prompt filter never directly controlled.

Impact: The compromise can extend beyond misleading output to credential exposure, unauthorized data access, service abuse, or actions taken in the environment under the agent’s legitimate execution context.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Agentic AI Top 10	ASI02 — Tool Misuse	Directly addresses agent misuse of tools after prompt compromise.
	ASI03 — Identity & Privilege Abuse	Runtime defense here depends on limiting agent authority, not just inputs.
Recommendation — Constrain agent tool permissions and monitor tool invocations for misuse. Assign the agent the minimum privileges needed for each task.
MITRE ATT&CK	T1059 — Command and Scripting Interpreter	Host controls must stop agents from spawning or abusing local execution paths.
	T1005 — Data from Local System	Host-level containment is needed to prevent agent access to local sensitive files.
Recommendation — Restrict interpreter access and alert on unexpected command execution. Limit local data access and detect suspicious file-reading behavior.
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	Least privilege is the core host-side safeguard that bounds agent authority.
Recommendation — Grant the agent only the privileges required for the approved task.

Practitioner Guidance

What to verify: Check whether the agent can still reach sensitive data or external systems after prompt filtering is in place. If the answer is yes, treat the runtime boundary as incomplete and review host permissions before trusting the control.

What good looks like: The agent can complete its intended task only inside a bounded execution context, with explicit limits on filesystem scope, network egress, and process spawning. If a prompt attack succeeds, the resulting damage should still be narrow and observable.

Decision rule: If the failure mode involves the agent doing something after it is prompted, host-level controls are mandatory. If the concern is only malformed or malicious text, prompt filtering helps, but it is not sufficient on its own.

Practitioner takeaway: The safest runtime posture is layered containment: filter what enters the agent, then strictly constrain what the agent can do when the prompt layer fails.