Topic starter
18/08/2026 2:09 pm
TL;DR: Prompt injection defenses for AI agents decay quickly unless teams first build runtime observation and per-agent baselines, according to ARMO, while a UK AISI red-teaming challenge found 1.8 million attacks produced more than 60,000 policy violations across 22 agents. The practical issue is observation debt, because controls that depend on recorded behavior cannot be enforced safely until enough agent activity has been collected.
Editorial analysis by NHI Mgmt Group, based on content published by ARMO: “How to Secure AI Agents Against Prompt Injection”.
Key questions
A: The control that fails is behavioural enforcement, because it depends on a runtime baseline that does not yet exist.
Q: Why do AI coding agents create new IAM risk even when prompt injection is addressed?
A: Because prompt injection only affects what the model may be persuaded to do, while the deeper risk is what the agent can already do with inherited credentials.
Q: What are the signs that an AI agent baseline is not mature enough for blocking controls?
A: Frequent unexplained deviations, changing tool-by-destination patterns, and policies that are still being edited after each deployment are all signs that the agent's normal behaviour is not yet stable.
Practitioner guidance
- Establish a runtime observation baseline for each agent Collect execution telemetry for tool calls, destinations, spawned processes, and files opened so enforcement reflects actual behaviour rather than declared intent.
- Scope every agent to residual completable capability Review what each coerced agent can still finish today, including live credentials, reachable destinations, and writable tools, then remove unnecessary reach before moving to blocking mode.
- Run agent policies in audit before enforcement Let the full rule set observe deviations without blocking them, then promote only after the deviation pattern is stable across deployment changes.
Bottom line: AI agent prompt injection becomes a governance problem when enforcement depends on behaviour that has not yet been observed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:02 pm
Observation debt is the named control gap in AI agent security. Static controls can be deployed immediately, but the enforcement that actually constrains an agent depends on a behavioural baseline that only runtime observation can create. That means the first production risk is not model weakness alone, but the period when teams have already delegated tools and credentials without enough evidence to govern how the agent really behaves. Practitioners should treat this as an issuance-time governance problem, not a later tuning exercise.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: Should teams prioritise prompt filtering or per-agent behavioural enforcement first?
A: Prioritise both in sequence, not as substitutes. Prompt filtering and tool allowlists reduce opportunistic attacks immediately, but per-agent behavioural enforcement is the control that actually constrains a coerced agent once enough runtime evidence exists. The right order is exposure reduction first, then enforced baselines when the data supports them.
👉 Read our full editorial: Observation debt is the real control gap in AI agent security