Topic starter
06/06/2026 11:31 am
TL;DR: Agentic AI browsers and copilots remain vulnerable to prompt injection because probabilistic guardrails cannot reliably separate trusted intent from malicious instructions, according to Zenity’s PerplexedComet analysis. The real security boundary is deterministic enforcement at the code, network, or OS layer, where the model never gets a vote.
Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “Why Soft Guardrails Get Us Hacked: The Case for Hard Boundaries in Agentic AI”.
Key questions
Q: What breaks when runtime guardrails are missing from agentic AI?
A: Without runtime guardrails, the organisation loses control at the moment the agent takes a real-world action.
Q: Why do hard boundaries reduce prompt injection risk more effectively?
A: Hard boundaries reduce risk because they remove dangerous capabilities instead of trying to classify instructions as safe or unsafe.
Q: What are the signs that agentic AI controls are too weak?
A: The warning signs are capability exposure and late-stage detection.
Practitioner guidance
- Define enforceable capability boundaries List every action an agent can take, then decide which actions must be blocked at the code, OS, or network layer rather than left to model judgment.
- Remove privileged file system reach Disable or tightly constrain file:// and any equivalent local resource access for agents that can process untrusted content or execute user-facing tasks.
- Separate detection from prevention Treat confirmation prompts, anomaly checks, and behavioural guardrails as secondary controls that add friction and visibility after deterministic constraints are in place.
Bottom line: Agentic AI systems that depend on soft guardrails alone remain vulnerable because probabilistic supervision cannot reliably separate legitimate intent from hostile instructions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 12:23 pm
Prompt-level guardrails are a detection layer, not a security boundary. Agentic systems that reason over untrusted content cannot reliably distinguish benign from malicious instructions at runtime. The PerplexedComet case shows that when the same model evaluates both user intent and attacker payload, probabilistic checks fail as a containment mechanism. The implication is that security architecture must stop treating model judgment as the place where trust is enforced.
A few things that frame the scale:
- The agentic AI market is already worth $5 billion and is projected to reach $50 billion by 2030.
A question worth separating out:
Q: How should teams decide which agent actions need deterministic enforcement?
A: Teams should apply deterministic enforcement to any agent action that would create material blast radius if manipulated, especially local file access, network egress, and access to credentials or other sensitive resources. If a capability cannot be safely delegated to model judgment, it belongs in the hard-boundary layer rather than in a prompt rule.
👉 Read our full editorial: Hard boundaries, not soft guardrails, define agentic AI security