I spent today reading AI agent security properly, with primary sources open and snippets distrusted. Seven lines of inquiry ran in parallel across injection, poisoning, agents and MCP, jailbreaks, detection science and governance, plus one sceptic whose job was to falsify whatever the other six found. I build Wegweiser, a scanner-side product for providers, and its analyser ingests stranger text, so this is my own write path under discussion. Nothing tangible came out of the day yet, no product, no release. The picture that came back is worth writing down as one person's qualified view.

The result that governs everything else comes from Nasr and colleagues across OpenAI, Anthropic and DeepMind (paper). They took twelve published defences that mostly reported near zero success for attackers on static tests, then attacked them adaptively with gradients, reinforcement, random search and human red teams. Most fell at over 90%. Spotlighting and sandwiching moved from about 1% to over 95%. Classifier guards fell to score-feedback search at over 90%. Human teams succeeded in all 29 AgentDojo cases where automation managed about two thirds at 800 queries.

I now treat any defence claim without an adaptive test as marketing, including any I might make myself. Static near perfect means unmeasured. The model merges instructions and data into one token stream, OWASP still ranks injection first, and neither retrieval nor fine-tuning fixes the structure. Encoding work sharpens the point: FlipAttack reached about 98% bypass against five guard models in a single query, with about 79% attack success across eight LLMs, MathPrompt averaged 73.6% across thirteen models through symbolic maths, and Crescendo climbs past per-turn filters by spreading intent across turns, beating prior methods by 29 to 61% on GPT-4 and 49 to 71% on Gemini-Pro.

Poisoning numbers are measured and uncomfortable. PoisonedRAG took about 90% with five texts per target question in corpora of millions, black-box, with paraphrase and perplexity filters not fixing it. AgentPoison held at least 80% from under 0.1% poison rate with almost no benign loss. MINJA injected without any direct memory write, at 98.2% injection and 76.8% attack success. Semantic cache poisoning, new at NDSS 2026, lands at 81 to 89% against GPTCache and three cloud caches. Shared caches and shared memories are cross-user surfaces now.

Tools are worse than prompts. MCPTox ran 1,348 cases over 45 live servers and 353 tools against 20 agents, with tool poisoning reaching 72.8% on one model while the best refusal rate stayed under 3%. More capable models proved more susceptible, the paper notes, because the attack exploits their superior instruction-following. Rug pulls mutate a tool after approval, poisoned descriptions steer the agent, and the classical name for the failure is the confused deputy: a privileged agent talked into misusing authority it legitimately holds.

Detection is possible but narrower than brochures say. Whisper Leak infers prompt topic from TLS packet size and timing alone at over 98% across 28 production models, and AgentPrint fingerprints which agent runs from encrypted traffic. Flow shape leaks use. Intent is not in the flow. Closed-world classifiers degrade under TLS 1.3 and encrypted hello, drift, and shaping, and no peer-reviewed result separates rogue intent from sanctioned use by shape alone. What has detected intent joins causes: AgentSight traces the boundary with eBPF at under 3% overhead, while Uber's ADR joins prompts to tool calls in a causal chain across 7,200 hosts and 10,000 daily sessions, reporting zero false positives with 67% detection on its own ADR-Bench, at two to four times the F1 of guard-only baselines. Both are single-source and unreplicated, which I state because it matters.

I ran a small lab alongside the reading, on one quiet Ubuntu box with a local Ollama model, socket timing per chunk validated against tcpdump. Streaming scored 0.75 and above, short ambiguous turns sat at 0.55, benign bulk and idle stayed at 0.35 and below, with no tuning. The telling case was a rogue stream to a custom host no inventory would list: destination intelligence never fired, flow shape caught it anyway. Then I red-teamed my own detector with padding, batch flush, jitter, slow exfil and split flows, and added cadence scoring, burst periodicity and session correlation until no stacked shape reached benign at session level.

I do not mistake that for proof. The lab was cooperative: localhost, plain HTTP, one quiet machine, uniform cadence, shapes I invented myself. The field brings cloud batching and burst, HTTP/2 and QUIC multiplexing, video and telemetry as false-positive fuel, encrypted hello erasing SNI, DNS over HTTPS erasing DNS, plus shaping, splitting, low and slow exfil, tunnels over websockets, and inference with no traffic at all inside embedded models. Identity signals are hygiene, not detection. A detector that asks what a binary is called loses to a rename; one that asks what a process does has a chance. My verdict line at 0.6 is a public target once known.

What stands up

What stands up to scrutiny is architectural, and every item carries a cost. CaMeL separates control from data by design and solves 77% of AgentDojo tasks with provable security against 84% undefended, at about 2.8 times input and 2.7 times output tokens, with hand-written policies and approver fatigue as the tax. RobustRAG isolates sources then aggregates and moves attack success from over 90% to about 10%, at a clean accuracy cost. Signed memory provenance remains preprint-grade work with no cross-vendor format, and key management is the product. A policy engine at the tool boundary judges permission, never intent. A microVM contains execution without stopping semantic misuse inside. Classifiers and prompt techniques sit in front as tripwires whose bypass is assumed and audited.

Language, not proof

Governance gives vocabulary, not certification. NIST's risk framework with its GenAI profile, the OWASP LLM and agentic top tens, MITRE ATLAS technique IDs, and the EU AI Act with duties mostly on providers and high-risk deployers: all useful for procurement language and audit checklists, none able to certify an agent product as safe. No binding agent security standard exists yet. The direction is agent identity, authorisation and auditability, so those are the three to build now and map to standards as they harden.

Three numbers I will not quote

The sceptic pass killed three numbers on the day they were heading toward buyer material, and I list them so nobody else has to. A vendor blog claimed 43% of public MCP servers ship an injection point; the primary says 43% of tested implementations in an undisclosed sample had command injection, with no census behind it. A merged claim said 63% of firms report shadow AI compromise with 247-day dwell; IBM's published 2025 figures are 63% lacking AI governance and shadow AI breaches at 20% of breaches, costlier by about $670k, while the 63% compromise line comes from Stratix's separate August 2026 release with no disclosed sample. The 247-day figure is the 2026 overall mean time to identify and contain, not a shadow-AI number, and IBM's 2026 update has since moved shadow AI to 43% of incidents at $5.39M average. LlamaFirewall's static win is real, 17.6% down to 1.75% on AgentDojo at a utility cost from 47.7% to 42.7%, but adaptive robustness is unproven and the over 90% bypass line belongs to a narrow preprint metric, not the paper.

What I would do on Monday

For anyone running agents now, the practical stack that falls out of the above is short:

  • Require adaptive numbers before buying or shipping any guard: best of n and human red-team rates, benchmark scope, utility cost, or no purchase.
  • Separate control from data in any agent you own: plan from the trusted query, capability-check tools, approve shell, write and send in person.
  • Sign memory and retrieval writes, tier recall, partition caches by tenant, and surface source disagreement as a finding with provenance attached.
  • Log the causal chain, prompt to tool to syscall, hash-chained, and score intent across turns rather than per-message.
  • Sandbox execution by risk tier and put consequential claims through a second channel with sources attached.

I do not believe 100% safety is possible. The winnable posture, for a provider's estate and for my own agent alike, is detection plus response: find unsanctioned and malicious activity fast, score it honestly, attach a hardening step to every finding, and keep a human in front of side effects. The filter is one tripwire in that stack. Anyone selling it as the wall has not read the adaptive results, or hopes you have not.