What the literature keeps showing
Recent agent-security research repeatedly lands on the same weakness: once an agent can call tools, the risk moves from text generation to action selection. Defenses that only inspect prompts become brittle when the agent has authority.
The control point has to be independent from the model's interpretation of untrusted content.
Where detection breaks down
Filters have to identify every dangerous instruction shape. Attackers only need one path that survives the filter and reaches a useful tool. This asymmetry gets worse as agents gain memory, credentials and long-running autonomy.
Detection should inform policy and review, but it should not be the final authority for privileged execution.
A durable defense
Define what each environment may do, enforce that locally and return evidence after each decision. That turns agent security from a prompt-quality problem into an operating control.
Policy before action. Evidence after execution.