AI agent guardrails are shifting from chat to multimodal action

At a glance

What this is: This is an Enkrypt AI announcement arguing that multimodal AI agents need guardrails that constrain actions in real time, because text, image and voice inputs can now drive operational decisions.

Why it matters: IAM, IGA, PAM and NHI teams need to treat agent behaviour as an access-control problem at runtime, not only as a model-risk or post-event audit problem.

Context

Agentic multimodal AI is software that can interpret multiple input types and then choose actions, such as triggering approvals or changing records. The control problem is no longer limited to output safety, because the same system can now consume a poisoned screenshot, a spoofed voice prompt or a misleading PDF and convert it into an operational step.

For identity programmes, that changes the boundary of governance. Traditional review and logging processes assume there is a stable action to inspect after the fact, but multimodal agents can turn a single manipulated input into a chain of actions before anyone intervenes. The article frames this as a runtime guardrail problem, not a model-quality problem.

Key questions

Q: What breaks when multimodal AI agents can act on screenshots, PDFs and voice prompts?

A: The control assumption that only text can drive high-risk agent behaviour breaks down. A single manipulated image or audio clip can become a trigger for approvals, transfers or record changes, so security teams have to govern input-to-action paths rather than just prompt quality.

Q: Why do multimodal AI agents increase the risk of unsafe approvals and transfers?

A: Because the agent can turn untrusted content into an execution signal without a human deciding whether the action is legitimate. That removes the natural pause that conventional review processes depend on and lets bad inputs reach privileged outcomes faster than audit can intervene.

Q: How do security teams know whether agent guardrails are working?

A: They know guardrails are working when denied tool calls are visible in logs, high-risk paths are blocked consistently, and the agent cannot override policy from inside its own session. Observe mode is useful first because it shows what the agent actually tries to do before the team decides where to deny access. The signal is repeatable enforcement, not model compliance.

Q: Should organisations treat agent content safety and action safety as the same control?

A: No. Content safety reduces harmful outputs, but action safety prevents those outputs from changing systems or authorising transactions. Multimodal agents need both, because a safe-looking response can still be converted into an unsafe operational step.

Technical breakdown

Why multimodal inputs expand agent attack surface

Multimodal agents do not receive only text prompts. They also process images, audio and document content, which creates more places for adversaries to hide instructions or influence decisions. A poisoned screenshot can carry text the model interprets as a tool directive, while a spoofed voice can be used to push a high-risk approval path. The security issue is not the input type alone. It is that the agent can treat untrusted content as actionable context and then move from interpretation to execution without a separate trust boundary.

Practical implication: classify every input mode as a potential control plane for the agent, not just as content.

How runtime guardrails stop unsafe agent actions

Runtime guardrails sit between model output and system execution. They evaluate whether a proposed action is allowed, compliant and consistent with policy before the agent can call tools, approve transactions or alter records. This matters because multimodal systems can translate a single misleading cue into a sequence of privileged actions. The effective control point is therefore not the model alone, but the decision boundary around tool use, approval logic and policy enforcement. That is where identity and authorisation must be applied.

Practical implication: enforce pre-execution checks on tool calls, approvals and policy-sensitive actions.

Why audit trails are not enough for agentic decisioning

Audit remains necessary, but it is no longer sufficient. Once an agent has acted on a spoofed or poisoned input, the outcome may already be a transfer, account change or policy decision. In practice, the absence of a human review step means the organisation learns about the event after the damage path has completed. That is why action prevention has to precede logging. Audit tells you what happened; it does not stop multimodal manipulation from becoming a live business event.

Practical implication: pair logging with decision-time enforcement instead of relying on retrospective review.

Threat narrative

Attacker objective: The objective is to induce the agent to carry out a business-impacting action that the attacker could not directly authorise.

1. Entry begins when an attacker introduces a poisoned screenshot, PDF or spoofed voice prompt into the agent's input stream.
2. Escalation occurs when the agent interprets that content as an instruction and uses its allowed tools or permissions to take the next step.
3. Impact follows when the action becomes an approval, wire transfer, account change or unlogged policy decision that is hard to reverse.
4. The attack succeeds because the manipulated input is converted into execution before a human review gate can intervene.

Breaches seen in the wild

• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime guardrails are becoming the control boundary for agentic AI. Once text, image and voice all feed the same action path, the question is no longer whether the model can reason correctly. The question is whether the organisation can stop an unsafe action before it reaches a payment, approval or policy engine. That makes pre-execution policy enforcement the real governance layer for multimodal agents.

Multimodal AI turns content ingestion into a trust problem. A screenshot, PDF or voice clip is no longer just data to be interpreted. It can become a vehicle for instruction smuggling, which means the organisation has to govern inputs as potential commands. The practical consequence is that content handling, tool access and identity authorisation now overlap in the same runtime decision path.

Access review assumptions break down when action is immediate. Conventional IAM and PAM controls assume a decision can be reviewed after access is used. Multimodal agents compress that window because a single bad input can trigger a chain of actions before any review cycle sees the event. The implication is that governance must move from periodic review to decision-time constraint.

Multimodal action boundary: this is the point where untrusted content becomes an executable instruction. The article shows that the field is moving past model evaluation and into operational control of what the agent may do with what it perceives. Practitioners should treat that boundary as the new locus of identity governance for agentic systems.

Agent safety metrics now need to include action containment, not just response quality. A model that answers safely can still be unsafe if it can be nudged into taking a harmful operational step. The meaningful control question is whether the system can absorb manipulated multimodal input without emitting an irreversible side effect. That is the standard identity teams should use when evaluating agent governance.

From our research library:

• Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.

What this signals

Multimodal agent governance is moving from prompt moderation to execution control. The practical boundary is now the tool call, approval step and system update, because that is where manipulated content becomes a business action. Teams that only monitor output quality will miss the point at which risk becomes irreversible.

Identity programmes should stop treating agent behaviour as a passive audit problem. For multimodal systems, the real governance question is whether the organisation can constrain what the agent is allowed to do with what it perceives. That shifts the centre of gravity from review after the fact to authorisation before execution.

For practitioners

• Define action boundaries for multimodal agents Map which tool calls, approvals and record changes require explicit policy checks before execution. Treat each modality as a potential route into the same privileged decision path.
• Gate high-risk outputs before downstream execution Block agents from triggering transfers, account changes or policy updates until a deterministic authorisation rule has passed. Do not rely on post-action audit to catch unsafe decisions.
• Harden input trust assumptions across media types Test whether a screenshot, PDF or voice sample can influence tool selection or approvals. If it can, the input path is acting as a control surface and needs separate trust handling.
• Measure containment, not only model quality Track whether unsafe multimodal prompts are stopped before execution, not just whether the model answers accurately. Use those signals to separate content safety from action safety.

Key takeaways

• Multimodal AI agents can convert screenshots, PDFs and voice prompts into privileged actions, which expands the attack surface beyond text-only prompt abuse.
• The main control gap is not model quality alone but the lack of runtime enforcement before approvals, transfers or policy changes are executed.
• Identity and access teams should measure whether unsafe inputs are blocked at decision time, because audit trails cannot undo an already completed action.

Key terms

• Multimodal Agent: An AI system that can interpret more than one input type, such as text, images and voice, and then use that context to choose an action. In governance terms, the risk is not only what it says, but what it is allowed to do after interpreting the input.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.
• Action Boundary: The action boundary is the point where a user or system turns a request into a business-impacting decision, such as a payment approval or access grant. It is the most important place to add controls when attackers are using legitimate-looking messages to redirect trusted workflows.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.