Topic starter
26/08/2026 11:50 am
TL;DR: Xabier Muruaga’s Bounded Agents preprint argues that prompt injection only becomes harmful when an AI agent already has the authority to combine permitted actions into a forbidden result, and reports that benchmarked exfiltration fell to zero across 3,154 synthetic cases while utility dropped 8.6 to 13.9 points, according to Cakewalk. The governance problem is compositional risk, because session-start permissions cannot anticipate how delegated actions accumulate into a prohibited outcome.
Editorial analysis by NHI Mgmt Group, based on content published by Cakewalk: “Agents Can Combine Permitted Actions Into a Prohibited Outcome”.
By the numbers:
- Across 3,154 synthetic instances, AgentDojo exfiltration fell from 75 to 100 percent to zero in all four domains.
Key questions
Q: What breaks when AI agents can combine permitted actions into a forbidden outcome?
A: Session-start authorisation breaks because it evaluates each action in isolation and misses harmful combinations that emerge later in the same delegation chain.
Q: Why does compositional risk increase when delegated agent actions are chained together?
A: Because each hop can preserve or expand authority, and the security outcome depends on the total sequence rather than any single request.
Q: How do security teams know if agent authorization is actually working?
A: Authorization is working only if the agent can complete the intended task without gaining unnecessary reach.
Practitioner guidance
- Map authority across the delegation chain Document which permissions each agent, sub-agent, and tool inherits, and flag any path where a later step can combine earlier permissions into an outcome the original policy would forbid.
- Enforce cumulative-session authorisation Require policy decisions to consider prior actions in the same session so that a harmless first step cannot become dangerous only after subsequent permitted steps.
- Constrain sub-agent authority transfer Prevent sub-agents from passing on broader authority than they received, and treat any authority handoff as a separate governance event.
Bottom line: The article frames agent authorisation as a compositional problem, where individually permitted actions can still produce a prohibited outcome.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Compositional risk is the right security label for agent authorisation failures. The article shows that the problem is not whether one action is allowed, but whether allowed actions can be assembled into a forbidden result. That shifts the analytical unit from individual requests to the delegation chain as a whole. Practitioners should treat agent authorisation as an accumulation problem, not a single-decision problem.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should teams do when an AI agent is suspected of prompt injection?
A: Contain the session, revoke the agent’s active credentials, and inspect the full chain of tool calls, retrieved content, and downstream writes before resuming service. The priority is to stop the agent from completing additional actions and to determine whether the malicious instruction has already propagated into memory or connected systems.
👉 Read our full editorial: Bounded agents expose a compositional risk in AI authorisation