{"id":26202,"date":"2026-09-21T15:15:21","date_gmt":"2026-09-21T23:15:21","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/agentic-ai-risk-isnt-a-model-problem-its-an-architecture-problem\/"},"modified":"2026-09-21T15:15:21","modified_gmt":"2026-09-21T23:15:21","slug":"agentic-ai-risk-isnt-a-model-problem-its-an-architecture-problem","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/21\/agentic-ai-risk-isnt-a-model-problem-its-an-architecture-problem\/","title":{"rendered":"Agentic AI risk isn’t a model problem. It’s an architecture problem."},"content":{"rendered":"
\n
\n

<\/h1>\n<\/p>\n

With artificial intelligence, trust isn\u2019t what it used to be. AI is prodding security teams to move from static, binary, identity-based trust toward dynamic, probabilistic, behavior-based trust. They\u2019re also adjusting to a shift in security from the component layer of applications to the data layer.<\/p>\n

AI pushes a meaningful portion of security risk up from static components \u2014 libraries, services, containers \u2014 and into the data and context the system consumes at runtime, said Christopher Jess, senior R&D manager at Black Duck Software.<\/p>\n

The root of the problem is architectural, he said.<\/p>\n

\u201cIn current LLM-based systems, there is not a reliable security boundary between instructions and data inside the prompt, so when developers concatenate trusted instructions with untrusted content, they can accidentally grant attacker-controlled data the ability to steer decisions.\u201d<\/em>
\u2014Christopher Jess<\/p>\n

That means that classic application security (AppSec) controls such as patching dependencies, using static and dynamic testing, and writing web application firewall rules are no longer sufficient on their own, he said. Those legacy controls can\u2019t detect payloads that arrive via text in an email, a document in a knowledge base, or content retrieved for retrieval-augmented generation (RAG).\u00a0<\/p>\n

Indirect prompt injection \u2014 malicious prompts ingested from separate data sources such as web content or plugins during normal operation \u2014 can lead to data exfiltration or unauthorized actions without the attacker ever logging in to the application. In Jess\u2019s words, \u201cData security becomes application security.\u201d\u00a0<\/p>\n

Joint government guidance on AI data security makes the same point: Machine-learning models derive their decision logic from data, so an attacker who can manipulate the data can manipulate the logic of the system.<\/p>\n

Here\u2019s why rethinking your architecture is essential to managing agentic AI risk \u2014 and advice on what to do now.\u00a0<\/p>\n

[ Get Report: <\/strong>AI Is the Supply Chain<\/strong><\/span><\/a> ]<\/strong><\/p>\n

Risk has a new home in the AI age<\/h2>\n

Elad Luz, head of research at Oasis Security, said the reason that agentic AI has shifted the attack surface from the component layer to the data layer is that agents don\u2019t execute predefined code paths. They reason over data and use it to decide what to do next. This has opened the door to a jump in prompt injection, poisoned context windows, and manipulated RAG sources, all of which are being discovered constantly, Luz said. Today\u2019s attack surface is enormous and difficult to fully secure.<\/p>\n

\u201cUntrusted data is no longer passive input. It can steer an agent\u2019s behavior, turning observation into control.\u201d<\/em>
\u2014Elad Luz<\/span><\/a><\/p>\n

Defenders of the component layer have spent decades building firewalls, endpoint agents, and network segmentation. But Tim Freestone, chief strategy and marketing officer at Kiteworks, said that now that risk resides on the data layer, AI agents can reach across repositories and workflows at machine speed, without the hesitation a human employee might exercise. Organizations that fail to enforce governance at the data layer \u2014 controlling what is accessed, by whom or what, under what policy \u2014 will find themselves securing infrastructure that AI simply bypasses. This requires a whole new mindset.<\/p>\n

\u201cThe security perimeter hasn\u2019t been breached. It\u2019s been made irrelevant.\u201d<\/em>
\u2014Tim Freestone<\/span><\/a><\/p>\n

Jeff Williams, CTO and co-founder of Contrast Security, spelled out the danger: In AppSec, attacks have always arrived as data, and the code decides whether that data stays data or turns into behavior. What AI changes is that software now reads untrusted content, reasons over it, and may act on it. Passing untrusted data to a large language model (LLM) is risky, and no complete solutions exist yet, he said \u2014 only boundaries, least privilege, policy enforcement, and runtime controls that minimize attacks and limit exploitation.<\/p>\n

Rein in privileges<\/h2>\n

One way to address agentic AI risk is to control the agent\u2019s access privileges. Williams recommends restricting agents to least-privilege access, as well as adding strict policy checks around tool use, separating trusted from untrusted data, requiring human approval for high-impact actions, and gaining visibility by applying runtime monitoring and protection to prompts, retrieved context, tool calls, and actions.<\/p>\n

\u201cIf you cannot see what the agent actually did in runtime, you\u2019re basically guessing.\u201d<\/em>
\u2014Jeff Williams<\/p>\n

David Brauchler, technical director and head of AI and ML security at NCC Group, has more advice. AI systems with exposure to untrusted data should have privileges no higher than those of the author of that data. Organizations also need to manage data provenance, he said, and although they can\u2019t trace every piece of data to its origin, they should know how much to trust each piece relative to the intended execution context. Another danger, he said, is building \u201cone agent to rule them all\u201d architectures; better to split tasks between low-privilege, sandboxed models and convert their responses to safe data types.<\/p>\n

The infrastructure underneath the agents needs attention, too. Aner Gelman<\/span><\/a>, vice president of product at Salt Security, said that beyond validating and securing an organization\u2019s Model Context Protocol (MCP) servers<\/span><\/a>, a strong API security program protects the underlying infrastructure that allows agents to operate.<\/p>\n

Chris McHenry, chief product officer at Aviatrix, advises controlling internet egress. Full-default \u201cdeny\u201d may not be practical for every environment, he said, but it\u2019s powerful where it can be applied \u2014 and layering helps everywhere else. He recommends blocking command-and-control traffic, access to file-sharing sites, and post and put requests to external services, as well as implementing for agents the URL category filtering and threat blocking that\u00a0 human users get. These are containment approaches every security practitioner understands, McHenry said.<\/p>\n

\u201cTreat the workloads like users on the network and you\u2019re already ahead.\u201d<\/em>
\u2014Chris McHenry<\/span><\/a><\/p>\n

How to set up containment<\/h2>\n

The control that organizations most consistently underutilize is the governance gate between AI reasoning and execution, said Yogesh Thanvi, a member of the ISACA Emerging Trends Working Group and a senior software development engineer at Akamai Technologies. He said the Chevrolet chatbot incident \u2014 in which a customer manipulated a dealership AI agent into agreeing to sell a car for $1 \u2014 demonstrates what happens when an autonomous actor has no policy checkpoint between reasoning and action. An unsupervised agent that can call APIs, write to databases, or trigger transactions is operating with privileged access and no supervision.<\/p>\n

\u201cEvery sensitive downstream action should require an explicit authorization decision, not an implicit one inherited from the model\u2019s confidence level.\u201d<\/em>
\u2014Yogesh Thanvi<\/span><\/a><\/p>\n

Organizations need to treat AI agents as identities with ownership, access limits, and lifecycle controls, said Rosario Mastrogiacomo<\/span><\/a>, chief strategy officer at Sphere Technology Solutions and the author of AI Identities<\/em>. He recommends data sanitization pipelines to remove sensitive or malicious inputs, continuous adversarial testing to expose manipulation risks, tight scoping of access to APIs and tools, and short-lived, frequently rotated credentials. Audit trails must capture more than access events \u2014 inputs, outputs, and decisions\u00a0 must be known as well.<\/p>\n

Kiteworks\u2019 Freestone said the controls that matter most right now are containment capabilities: purpose binding that limits what an agent is authorized to do, kill switches that can rapidly terminate a misbehaving agent, and network isolation that prevents lateral movement into sensitive systems.\u00a0<\/p>\n

Layered beneath those, he added, are data-layer enforcement mechanisms: attribute-based access control that evaluates every AI request against policy in real time, input validation against prompt injection and data poisoning, and tamper-evident audit logging that creates the evidentiary trail regulators and counsel will demand. The common thread, Freestone said, is shifting from observation to action: Most organizations can watch an AI agent do something unexpected, but far fewer can stop it.<\/p>\n

Remember your AppSec foundations<\/h2>\n

Agentic applications bring together faster development cycles and more complex system behavior, said Eran Kinsbruner, vice president of product marketing at Checkmarx \u2014 a combination that lets risk build quickly if it is not managed carefully. Uncertainty about how to secure these systems persists across the industry, he said, and the organizations that regularly test their assumptions and stay flexible will be in the strongest position as the landscape evolves.<\/p>\n

Contrast Security\u2019s Williams said that while formulating a practical strategy for securing agentic AI applications is not complicated, it does require discipline \u2014 and that does not describe most AI efforts he has seen. The most important thing, he said, is to base security decisions on runtime truth, not architecture diagrams or source code \u2014 in other words, watch what the agent actually does in production.<\/p>\n

Brett Smith, a distinguished software developer at SAS, said the fundamentals still apply \u2014 and may be more critical than ever.<\/p>\n

\u201cSanitize all incoming data, grant minimal necessary permissions, and validate outputs before use. These concepts are not new, but they are critically important when you have autonomous agents operating in your infrastructure.\u201d<\/em>
\u2014Brett Smith<\/span><\/a><\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

With artificial intelligence, trust isn\u2019t what it used to be. AI is prodding security teams to move from static, binary, identity-based trust toward dynamic, probabilistic, behavior-based trust. They\u2019re also adjusting to a shift in security from the component layer of applications to the data layer.AI pushes a meaningful portion of security risk up from static components \u2014 libraries, services, containers \u2014 and into the data and context the system consumes at runtime, said Christopher Jess, senio<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[32775],"tags":[],"class_list":["post-26202","post","type-post","status-publish","format-standard","hentry","category-reversinglabs"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26202"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26202\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26202"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}