AI agent security needs architectural boundaries, not prompt tuning

At a glance

What this is: This analysis argues that the Lethal Trifecta of private data access, untrusted content processing, and external action capability creates a structural AI agent security problem that prompt tuning cannot solve.

Why it matters: IAM, PAM, and NHI teams need to treat AI agents as governed principals with bounded permissions, because effective access and data flow, not model quality, now determine blast radius.

Context

AI agent security is the problem of controlling what an agent can read, what it can ingest, and what it can do once it has both. Cyera frames the core issue as an architectural one: when private data access, untrusted content processing, and external action capabilities overlap, the resulting exposure is not reliably contained by prompt engineering or training.

For identity teams, the key shift is that an AI agent is not just a workflow helper. It is a governed runtime principal whose effective access can expand across data sources and action channels unless permissions, session scope, and data flow are deliberately bounded.

That makes the article relevant to NHI governance and agentic AI identity rather than generic model safety. The control problem is not whether the agent sounds safe, but whether its identity, privileges, and outputs are constrained so the attack path cannot form.

Key questions

Q: What breaks when an AI agent can read private data and send it externally?

A: The agent can become an exfiltration path instead of a productivity layer. If attacker-controlled content reaches the agent at the same time as sensitive data and outbound communication tools, prompt injection can turn ordinary workflow actions into disclosure. The failure is architectural, because the agent has enough privilege to act on malicious instructions while appearing legitimate.

Q: Why do prompt tuning and training not fully secure AI agents?

A: They reduce some unsafe behaviour, but they do not remove the underlying capability overlap that creates risk. If the agent can still read sensitive sources and use outbound tools, a malicious instruction can be embedded in normal content and executed through legitimate workflows. The control problem is the architecture, not just the prompt.

Q: What are the signs that an AI security model is failing or becoming unreliable?

A: Common warning signs include rising false positives, missed threats, inconsistent outputs, and recommendations that security teams cannot explain or validate. Poor results often point to weak training data, stale models, or poisoned inputs. When analysts spend more time correcting the model than using it, the system is no longer improving security and may be creating operational noise.

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Technical breakdown

Why the Lethal Trifecta breaks AI agent security

The Lethal Trifecta is the combination of private data access, untrusted content processing, and external communication capability. Each capability is useful on its own, but together they let hostile text shape an agent’s action path and turn ordinary business content into a delivery mechanism for exfiltration. The security failure is semantic, not binary: the agent cannot reliably distinguish instructions from content once both share the same runtime context. That is why firewalls, DLP, and model training do not fully address the risk. The threat is that the agent’s own authorized tools become the exfiltration channel.

Practical implication: Practitioners should assess whether any agent can both read sensitive sources and send data outward in the same session.

Identity and permission boundaries for AI agents

Cyera’s analysis treats identity as the first hard boundary. A common anti-pattern is letting an agent inherit the invoking user’s full permissions, which collapses human and machine access into one overly broad effective identity. A safer pattern is a separate service identity whose runtime access is the intersection of user privilege, agent scope, and session policy. That intersection must be enforced at runtime, because static provisioning alone does not stop overreach. This is classic NHI governance applied to an autonomous execution context: the agent needs just enough privilege to operate, but not so much that a compromised session can act as the user.

Practical implication: Practitioners should define separate agent principals and enforce runtime intersection of user and agent permissions.

Data flow enforcement and isolation primitives

Static permissions do not solve the problem if sensitive data can still be combined with outbound channels. Data flow enforcement blocks that combination by policy, for example disabling external communication after restricted data is accessed. Isolation primitives strengthen that boundary by constraining connection posture, session state, and external resource loading so the agent cannot bypass policy through alternate channels. In practice, this means clean session boundaries, allowlisted endpoints, and a single chokepoint for tool invocation. The architecture matters because the agent cannot be trusted to self-police in the presence of untrusted input.

Practical implication: Practitioners should separate sensitive data access from outbound action paths and contain each session with enforceable isolation.

Threat narrative

Attacker objective: The attacker wants the agent to disclose sensitive internal information using legitimate tools and without triggering traditional security alerts.

1. Entry occurs when an attacker embeds malicious instructions inside ordinary business content such as a meeting invite, support ticket, or uploaded document.
2. The agent ingests the untrusted content alongside sensitive internal context, so the instruction is processed as if it were legitimate work.
3. The agent then uses its authorised tools to send emails, make requests, or post messages, turning normal business action into exfiltration.
4. Impact is the disclosure of internal documents, customer data, or other sensitive material through the agent’s own approved channels.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• postmark-mcp malicious MCP server 2025: A fake Postmark MCP server on npm quietly BCC'd every email AI agents sent through it to an attacker, using victims' own Postmark tokens.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent security fails when the control plane assumes language is safe. The Lethal Trifecta shows that an agent can be manipulated through ordinary business content once private data access and outbound action capability coexist. That is not a prompt-quality problem, it is a boundary problem. The practitioner implication is that agent governance must move from content moderation to architectural containment.

Separate agent identity is now the minimum viable control, not an advanced option. When an agent inherits the user’s full permissions, the effective identity becomes too broad for safe runtime use. Cyera’s model reinforces a core NHI principle: access must be scoped to the intersection of principal, purpose, and session, not to convenience. The implication is that agent permissions must be engineered as a distinct runtime entitlement set.

Prompt tuning cannot substitute for data-flow enforcement. The article is clear that the attack vector is language itself, which means a model can be trained to behave better without the architecture becoming safe. Once sensitive data can reach an external channel, the harmful path still exists. The practitioner implication is to treat outbound data flow as a policy boundary, not a model behaviour problem.

Hard boundaries define the new agentic AI security baseline. The most useful control concept here is architectural containment, not behavioural trust. That means clean session isolation, allowlisted tools, payload inspection, and human authorization for cross-boundary actions. For identity programmes, the implication is that agent security now sits at the intersection of NHI governance, zero trust, and privileged workflow design.

Assumptions built for human-paced review collapse under agentic execution. Access review processes were designed for privileges that persist long enough to be observed and certified. That assumption fails when an AI agent can acquire context, act, and expose data within a single session. The implication is that practitioners must rethink where trust is granted, because review after execution is no longer a meaningful safeguard.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Architectural containment is becoming the real control boundary for agentic AI. Programmes that still depend on prompt quality or behavioural alignment are leaving the decisive risk in place, because the agent can be manipulated through normal business content once its identity can both read and act. The governance question is no longer whether the model is clever enough, but whether the execution path is impossible in the first place.

AI agent identity should be scoped as an intersection, not a union. When a runtime principal inherits the user’s entire access profile, the effective privilege set expands far beyond what any reviewer would intend. Identity teams should model the agent’s effective access as the narrow overlap of user intent, agent scope, and session policy, because that is the only place the boundary is enforceable.

Access reviews alone will not catch within-session abuse. Agents that ingest data and emit external actions in one run can create exposure without leaving a meaningful review artefact behind, which means the control has to move earlier in the lifecycle. For practitioners, that means issuing, constraining, and terminating agent access with runtime policy, not relying on periodic certification.

For practitioners

• Define separate agent principals Create non-human identities for agents instead of inheriting the invoking user’s full permissions, and enforce runtime intersections of user scope, agent scope, and session policy.
• Block sensitive-to-external data paths Tag restricted data and external communication tools differently, then block any session that tries to move sensitive content into outbound channels.
• Constrain sessions with hard isolation Use clean session state, allowlisted endpoints, and a single policy chokepoint so one compromised invocation cannot bleed into later actions.
• Require human approval for cross-boundary actions Put a human authorization gate in front of agent actions that would send data, update systems, or disclose information after sensitive context has been accessed.
• Audit agent behaviour for zero-click manipulation Test support tickets, meeting invites, documents, and other normal inputs for embedded instructions that could redirect an agent’s tool use.

Key takeaways

• AI agents become dangerous when private data access, untrusted inputs, and outbound action capabilities converge in one runtime.
• Cyera’s analysis shows that the attack surface is architectural, because normal business content can drive exfiltration through approved tools.
• Practitioners should enforce hard boundaries around identity, data flow, isolation, and human approval so the harmful path cannot form.

Key terms

• Lethal Trifecta: A risky AI agent condition where one system can read private data, consume untrusted content, and communicate externally. When those three capabilities overlap, the agent can be tricked into disclosing sensitive information through legitimate tools without a conventional exploit.
• Data-flow Enforcement: Runtime controls that stop sensitive information from moving from a protected session to an external channel. In agent security, this is a containment function, not a policy document, and it must operate even when the model behaves as intended.
• Runtime boundary: The point at which an identity's permissions, execution context, and observable behaviour are contained for policy purposes. In agentic systems, runtime boundaries matter because they determine whether the organisation can explain, audit, and limit what the agent did after execution begins.
• Agent Principal: An agent principal is a distinct identity issued to an AI agent so it can authenticate and be audited separately from the human it serves. In practice, it should have its own lifecycle, scoped credentials, and revocation path, because borrowing a human session collapses accountability and widens blast radius.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.