Research briefing — Agentic AI security and enterprise architecture
Beyond Behavioural Trust: The Shift to Architectural Certainty in Agentic AI
The "Vibe Coding" Hangover and the Autonomous Reality
The enterprise is currently emerging from the "Vibe Coding" era, a period characterised by the use of LLMs as stochastic parrots for low-stakes, probabilistic content generation. In this experimental phase, security was largely a matter of monitoring chat logs. However, we have transitioned into the "Autonomous Reality," where agents are no longer passive advisors but active participants in the enterprise stack. These agents possess the capability to read, write, and execute across production directories, databases, and APIs.
The strategic importance of this shift cannot be overstated: it represents a leap in productivity, but it fundamentally shatters current security perimeters. As agents move from reading data to executing multi-step tool chains, the trust model must shift. Relying on "model alignment" to prevent unauthorised actions is a category error. As agents gain agency, our current security mental models, rooted in human-centric sessions, are no longer just outdated; they are an invitation to systemic compromise.
The Authorisation Gap: Why Traditional IAM Fails the Agent
The central failure in contemporary agent deployment is the "Authorisation Gap." Traditional Identity and Access Management (IAM) and Privileged Access Management (PAM) are designed for deterministic software paths. Proving an identity (Authentication) is insufficient when the entity's execution logic is non-deterministic and calculated on the fly.
To formalise this, we must view the agent's state as a Partially Observable Markov Decision Process (POMDP). The internal context of an agent at step is defined as:
where is the prompt, represents untrusted external observations (files/tool outputs), is system knowledge, is history, and is the active execution plan. In an adversarial plan injection, an attacker introduces a perturbation into the context substrate (via poisoned data), yielding a corrupted context:
Because the model maximises action probability conditioned on this corrupted state, it executes the malicious plan ฮดP as a legitimate directive.
| Traditional software authorisation | Autonomous agent logic |
|---|---|
| Deterministic: Paths are predefined in code during provisioning. | Calculated on the fly: Actions generated at runtime based on context. |
| Stable handshake: Authentication translates to a predictable profile. | Dynamic chaining: Multi-step operations over extended horizons. |
| Static entitlements: Permissions remain constant per session. | Non-deterministic: Logic changes based on ingested untrusted data. |
When an agent inherits a human's full permission set, model hallucinations or prompt injections lead to "catastrophic, unreviewed side effects." This includes unauthorised database writes, exfiltration of GITHUB_TOKEN via CI/CD runners, or the destruction of production infrastructure. This gap exists because the control plane and data plane have collapsed into a single, vulnerable context window.
The Framework Illusion: NIST, MITRE, and the Empty Promise of Compliance
Organisations frequently fall for the "Framework Illusion," believing that alignment with a single standard constitutes security. In reality, picking one framework creates predictable gaps.
The AI security framework matrix
| Framework | Primary axis | Level | Enforcement layer | The "runtime gap" |
|---|---|---|---|---|
| NIST AI RMF | Governance & risk process | Organisational | Process / policy | Satisfied entirely through documentation; lacks any runtime enforcement. |
| MITRE ATLAS | Adversary TTPs | Threat intel | Detection / defense | Describes attacker behaviour but omits defender architecture. |
| OWASP (LLM/Agentic/MCP) | Vulnerability taxonomy | Protocol / layer | Application / system | Names vulnerabilities but does not prescribe implementation. |
A "NIST-only" strategy is a governance failure. An organisation can be fully NIST-aligned while their agents make ungoverned tool calls to production databases with sero audit trail. These frameworks are maps, not shields. The missing layer is the deterministic runtime infrastructure.
Anatomy of a Sero-Click Kill Chain: Deconstructing the MCP and RCE
The Model Context Protocol (MCP) has introduced severe architectural vulnerabilities. Specifically, the protocol allows bidirectional sampling where an external MCP server can request model completions via the sampling/createMessage method. Without origin authentication, a malicious server can use the "user" role to inject prompts directly into the host LLM.
The sero-click RCE kill chain
- Malicious instruction delivery: An attacker embeds an indirect prompt injection in a file (e.g.,
README.mdor a source code comment). - Binary planting: The agent, manipulated by the injection, uses a file-write tool to plant a malicious executable (e.g., a payload-carrying
npx.exe) in the project root. - Unsafe execution trigger: On the next routine command, the system resolves the binary. On Windows, the "Relative Binary Resolution" flaw prioritises the Current Working Directory (CWD) over
C:\Windows\System32, executing the malicious code with the user's full OS privileges.
This is exemplified by CVE-2026-10591 (CVSS: 8.8 High), where workspace configuration poisoning allowed agents to write to .vscode/tasks.json, triggering arbitrary command execution upon opening a folder. Furthermore, the "GitInject" vector proves that malicious configuration files like CLAUDE.md or AGENTS.md are parsed before code evaluation in CI/CD pipelines, allowing for the silent exfiltration of environment secrets.
The "No-Read" Principle: Implementing Execute-Only Agents (XOA)
To move from probabilistic trust to architectural certainty, we must adopt the Execute-Only Agent (XOA) paradigm. This is a move from trying to build "safer" models to building a system that is safe even when the AI is successfully manipulated.
XOA is built on two core principles
- The No-Read Principle: The LLM never observes untrusted data directly.
- Data-Independent Code Generation: The LLM generates scripts based solely on tool schemas and user requests.
The architecture: The LLM operates in a "Trusted Dev Playground" to generate scripts. These are then executed in an "Isolated Sandbox" (e.g., gVisor) that returns sero data to the LLM, only a final result to the user. Analysis of the AgentDojo benchmark confirms that 79% of tasks are scriptable without the LLM ever observing untrusted data.
The utility trade-off: XOA achieves a 0.0% effective Attack Success Rate (ASR). However, a strategic advisor must acknowledge the utility cost: XOA currently exhibits a 16-27 percentage point utility drop compared to standard ReAct architectures. This is the price of deterministic certainty.
The Blueprint for Enterprise AI Governance: The Agent Gateway
Security must move out of the non-deterministic context window and into a deterministic Agent Gateway. This gateway treats the agent as an untrusted requester, mediating every interaction between the agent and infrastructure.
The five phases of a least-privilege agent gateway
- Discovery: Agents find tools via a schema-restricted interface, limited by role.
- Request: The agent submits a structured JSON-RPC tool invocation.
- Validation: The gateway validates the request against a static schema and computes a plan hash.
- Authorisation: A Policy Engine (e.g., Open Policy Agent / OPA) evaluates the request against declarative "Policy-as-Code."
- Ephemeral execution: Approved actions run in short-lived, gVisor-based sandboxes, destroyed immediately after use.
This architecture is bolstered by "Semantic Firewalls." Unlike simple filters, these are independent, lightweight auxiliary models performing real-time intent classification to flag directive intent within passive context data before it ever reaches the core LLM.
Strategic Implication: From Probabilistic Trust to Architectural Certainty
The core thesis for 2026 is that AI security is not a model-tuning problem; it is a document-architecture and system-design problem. We must stop trying to "align" models and start governing the infrastructure they inhabit.
Leadership checklist for 2026
- Close the Authorisation Gap: Deploy dynamic Agent Gateways to move beyond session-level IAM.
- Enforce the No-Read Principle: Transition high-risk data processing to XOA architectures to eliminate injection vectors.
- Implement Signed Plan Catalogs: Ensure every execution chain is cryptographically bound to a verified artifact.
- Adopt Continuous Runtime Authorisation: Use OPA to validate every individual tool call against Policy-as-Code.
The goal is not to build a "safer" AI, but a system that remains secure even when the AI is successfully compromised. Building a hardened gateway is no longer an option; it is a strategic necessity for the autonomous age.
