Notifications
Clear all
Topic starter
26/08/2026 11:50 am
TL;DR: Xabier Muruaga’s Bounded Agents preprint argues that prompt injection only becomes harmful when an AI agent already has the authority to combine permitted actions into a forbidden result, and reports that benchmarked exfiltration fell to zero across 3,154 synthetic cases while utility dropped 8.6 to 13.9 points, according to Cakewalk. The governance problem is compositional risk, because session-start permissions cannot anticipate how delegated actions accumulate into a prohibited outcome.
NHIMG editorial — based on content published by Cakewalk: Agents Can Combine Permitted Actions Into a Prohibited Outcome
By the numbers:
- Across 3,154 instances from public benchmark suites, AgentDojo exfiltration fell from a range of 75 to 100 percent to zero in all four domains.
- All 544 InjecAgent data-stealing cases were blocked.
Questions worth separating out
Q: What breaks when an AI agent can use allowed actions incorrectly?
A: The break is in the assumption that permission equals safety.
Q: Why do AI agents complicate least-privilege design?
A: AI agents complicate least-privilege design because their tool use can change dynamically while the underlying permissions remain persistent.
Q: What do security teams get wrong about prompt injection defence?
A: They often assume better blocklists will solve the problem, but obfuscation simply changes the shape of the payload.
Practitioner guidance
- Map delegation chains end to end Document the full path from human initiator to primary agent, sub-agent, and tool so you can see where authority is inherited instead of narrowed.
- Evaluate cumulative outcomes, not isolated requests Add policy checks that assess what a sequence of approved actions can produce together, especially when reading data and sending data are both separately allowed.
- Constrain sub-agent authority at each hop Require explicit narrowing when one agent delegates to another, and block any handoff that preserves the original blast radius by default.
What's in the full article
Cakewalk's full article covers the operational detail this post intentionally leaves for the source:
- The specific authorization model the preprint proposes for evaluating session history across multiple agent actions.
- The benchmark setup behind the 3,154 test instances and how exfiltration was blocked across the four domains.
- The paper's own boundary conditions, including where the model complements ABAC and RBAC rather than replacing them.
- The delegation-chain interpretation of authority flow from human initiator to sub-agent and tool.
👉 Read Cakewalk's analysis of bounded agents and AI authorization risk →
Agent delegation chains: where permitted actions become prohibited outcomes?
Explore further
26/08/2026 11:51 am
Compositional risk is now the right name for a class of agentic failures that IAM teams already understand in other forms. The problem is not that a single permission is wrong, but that permitted actions become unsafe when evaluated together across a session. That makes the policy boundary a sequence problem, not a point-in-time problem, and it moves agent governance closer to access-path analysis than to model trust. Practitioners should treat the combined outcome as the unit of control.
A few things that frame the scale:
- Across 3,154 instances from public benchmark suites, AgentDojo exfiltration fell from a range of 75 to 100 percent to zero in all four domains, according to the AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How should organisations govern agent-to-agent delegation?
A: They should treat delegation as a formal governance boundary, not just an integration pattern. That means defining what data can move between agents, how inherited permissions are recorded, and when delegated actions require review. Without that, one agent can extend another's access in ways the original control model never saw.
👉 Read our full editorial: Bounded agents expose a compositional risk in AI authorisation
