Topic starter
07/11/2026 11:48 am
TL;DR: Prompt injection becomes materially more dangerous when an agent can read, call tools and reach production systems, according to Doppler. For practitioners, the control problem shifts from blocking every malicious prompt to limiting what any successful injection can actually use.
Editorial analysis by NHI Mgmt Group, based on content published by Doppler: “How to secure AI agents with defense in depth”.
Key questions
Q: Why do long-lived credentials create a bigger risk for AI agents than for traditional automation?
A: AI agents can choose tools and sequence actions dynamically, so long-lived credentials become durable authority across many unpredictable requests.
Q: How does Model Context Protocol change agent security boundaries?
A: Model Context Protocol changes agent security boundaries by standardising how an AI agent discovers tools, data sources and prompts, so the boundary shifts from each bespoke integration to the protocol-defined interface.
Q: Why do AI assistants with tool access increase prompt injection risk?
A: Tool access converts prompt injection from a wording issue into an execution issue.
Practitioner guidance
- Limit agent authority to the current task Remove read, write and execution rights the job does not need, and separate high-consequence actions from ordinary retrieval.
- Gate external content before tool use Treat issues, documents, webpages and tool outputs as untrusted inputs, and block the agent from converting them directly into actions.
- Place MCP servers under access review Approve only the servers and tool scopes the agent actually needs, and review the authority each server can pass into the session.
Bottom line: AI agents become materially riskier when their permissions extend beyond the immediate task, because prompt injection can then drive real actions.
Glossary terms: Prompt Injection (Agentic), Model Context Protocol, Short-lived Credentials, Defense in depth
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/11/2026 11:48 am
Prompt injection becomes an identity event once the agent can act: the security problem is no longer only what the model says, but what the model can do with the permissions already attached to it. When untrusted text can steer live tool calls, the access model has already crossed from language handling into privileged execution. Practitioners should treat agent instruction paths as identity-bearing control points, not just content filters.
A few things that frame the scale:
- Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
A question worth separating out:
Q: What should teams do first when AI agents are already in production?
A: Teams should first inventory all agent identities, map the credentials they use, and verify that each one has a named sponsor and monitored workflow. That creates the minimum basis for containment, investigation, and accountability before broader policy changes are attempted.
👉 Read our full editorial: Prompt injection can expose real access when AI agents overreach