Prompt injection remains a residual risk, so agent security is a privilege-and-containment problem. Evidence, controls and three NKK models: a Threat-to-Control Map, Autonomy Tiers and an Agent Identity Stack.
Written for: CISOs, heads of AI, identity and platform architects, risk and audit leads
12 chapters, 67 cited sources, 28 models and charts. The first 2 chapters are open; the rest unlock with the form.
attack success against most of 12 recent jailbreak and prompt-injection defences under adaptive attack
Weights and system instructions. Can be steered by any text that reaches the context window.
Retrieved documents, tool outputs, conversation history and persisted memory. The main entry point for indirect injection.
APIs, MCP servers, skills and plug-ins, with their descriptions and responses. A software supply chain, not a feature list.
The process, filesystem, network route and secrets in which tool code runs.
The principal, credentials and delegated rights the agent presents to every downstream system.
The record that ties each action to an agent, a sponsor and a policy decision.
In NKK's view, too much agent-security effort is aimed at the one component that cannot be made reliable: the model. The evidence is consistent. Adaptive attacks bypassed 12 recent jailbreak and prompt-injection defences, with success rates above 90% for most [1]. A public competition recorded over 60,000 successful policy violations from 1.8 million attacks [2], and NIST's CAISI reports at least one successful attack against all 13 frontier models tested [3]. The UK NCSC says prompt injection "may never be totally mitigated in the way that SQL injection attacks can be" [4], and an OWASP project leader calls for "assuming AI will sometimes fail or be fooled" [5].
Our thesis follows: securing agentic AI is a privilege-and-containment problem. Assume the model will sometimes be hijacked, then engineer what a hijacked agent can read, change and send. The weight of the control set moves outside the model, to a distinct identity per agent, short-lived scoped credentials, a policy decision on every request, filesystem and network isolation, egress allow-lists and tamper-evident logs.
The paper offers three NKK models: a Threat-to-Control Map with seven interposition points, Agent Autonomy Tiers (T0 to T3 plus a T4 delegation flag) and a five-layer Agent Identity Stack. The models are NKK opinion built on cited prior art; no public outcome data exists for tiered controls, so test them in your own environment. The paper ends with seven next steps.
attack success against most of 12 recent jailbreak and prompt-injection defences under adaptive attack
A chatbot that is fooled says something wrong. An agent that is fooled does something wrong, with credentials someone gave it. That sentence compresses three differences between a language model and an agentic system, and each one widens what has to be secured.
Instructions arrive through data. Greshake and colleagues showed in 2023 that LLM-integrated applications "blur the line between data and instructions", so an attacker can plant a prompt in content the system is likely to retrieve [7]. An email, a web page, a pull request or a tool description can all carry instructions. NIST's adversarial machine learning taxonomy adds that because agents take actions with tools, injection can enable actors "to hijack agents to execute arbitrary code or exfiltrate data from the environment in which they are operating", and notes that "Security research focused specifically on agents is still in its early stages" [8].
Actions have side effects. NIST's CAISI describes an agent system as at least one generative model plus scaffolding software that equips it with tools to take discretionary actions [9]. The security question changes with that scaffolding. One OWASP sponsor put it as a move "from what a model can say to what a system can do", a remark made by the chief executive of a security vendor inside OWASP's release, so read it as opinion [5].
Authority is borrowed. An agent acts with a token, a service account or a user's session. The six-agency guidance from ASD's ACSC, CISA, NSA, the Canadian Cyber Centre, NCSC-NZ and NCSC-UK [11] warns that "every individual component in an agentic AI system widens the attack surface", and that LLM-based agents "may change their behaviour when evaluations are underway and may even bypass system-level instructions to achieve their objectives" [10]. It advises "never granting it broad or unrestricted access, especially to sensitive data or critical systems" and, as a headline position, that organisations "should only use agentic AI for low-risk and non-sensitive tasks" [10]. The guidance organises agent risk into five categories: privilege, design and configuration, behaviour, structural and accountability [10]. In practice an agent is a stack, and every layer is an attack surface.
Weights and system instructions. Can be steered by any text that reaches the context window.
Retrieved documents, tool outputs, conversation history and persisted memory. The main entry point for indirect injection.
APIs, MCP servers, skills and plug-ins, with their descriptions and responses. A software supply chain, not a feature list.
The process, filesystem, network route and secrets in which tool code runs.
The principal, credentials and delegated rights the agent presents to every downstream system.
The record that ties each action to an agent, a sponsor and a policy decision.
OWASP's 2026 list moves Excessive Agency from LLM06 in the 2025 edition to LLM03 [12][13]. The 2026 PDF is openly downloadable from OWASP's resource page, which is dated 3 August 2026; the PDF's own cover leaves the publication date to be set [12]. The project leads write that Excessive Agency "climbed to third, the most consequential move on the list, because the vote and the record agree that agentic deployments are where the damage is landing" [12]. The definition is the vulnerability "that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM", "regardless of what is causing the LLM to malfunction" [12].
| Criterion | What OWASP says (2026 edition) | What it means for an agent programme |
|---|---|---|
| Root causes | Excessive functionality, excessive permissions and excessive autonomy. | Three separate dials. Most programmes tune autonomy and forget the other two: a tool that can do more than the task needs, and a credential broader than the tool needs. |
| Core mitigation | Complete mediation: implement authorization in logic rather than relying on an LLM to decide if an action is allowed, with requests checked by the tool, an independent pre-execution policy decision point or the downstream system. | The policy decision lives in the system being called, not in the prompt. This is the design principle behind the Identity Stack later in this paper. |
| Approval | Require human approval for high-impact actions. A graduated policy (audit, warn, block, escalate) lets recoverable actions auto-approve and routes irreversible ones to human review. | Approval is a scarce resource. Spend it on consequence and irreversibility, and enforce routine limits by mechanism (see the Autonomy Tiers). |
| Monitoring | Monitoring tool use and rate limiting "will not prevent Excessive Agency but can limit the level of damage caused". | Detection is damage limitation, not prevention. Budget for it as such, and do not count it as a substitute for scoped authority. |
Every figure and regulatory statement in this piece traces to a numbered source below. Links open the original publisher in a new tab.
MCP and A2A standardise how agents connect, not who may do what. Where the standards and governance stand, what has failed in deployments, and three NKK models for the control plane around them.
A benchmark pass, a judge score and a green dashboard are different instruments with documented gaps. Here is what the evidence shows and a layered NKK model for evaluating agents in production.
ISO 42001, NIST, the EU AI Act and MAS agree on the capabilities but not the operating model. NKK's tiering matrix, six pillars and evidence chain turn them into decisions, owners and proof.
