Agent security is an architecture problem. An agent that reads untrusted text, holds sensitive data, and can reach the network will eventually do all three in the wrong order, so cut one leg before deployment. Filters stacked on top of an uncut trifecta buy time, not safety.
Why this matters
Four surveys, four different populations, four different question forms, one answer: security is the top barrier to scaling agents. About two-thirds of respondents with direct AI-governance responsibility name security and risk, roughly twenty points ahead of regulatory uncertainty and technical limitations (n≈496, fielded Dec 2025–Jan 2026). Among financial-services decision-makers, security and risk tops the infrastructure-challenge list at 63%, with 57% saying their organization lacks the internal capability to capitalize on agents at all (n=559, AWS-commissioned). In a survey of 603, cybersecurity and privacy is the highest-ranked adoption challenge by eight points. In an unsponsored US tracking study, security risks rank #1, up from #2. The convergence is real; the magnitudes remain incomparable across these instruments, and all four measure perceived barriers rather than incidents.
The mechanism is a change in the defensive assumption rather than an increase in attacks. Classic controls assume a deterministic mapping from input to outcome; that determinism is what makes a signature meaningful. An agent’s behaviour is generated at runtime from text it read a moment ago, and the attacker’s cost per attempt has collapsed. The best-evidenced version of that shift is an event rather than a forecast: a threat actor used agentic orchestration to execute an estimated 80–90% of an espionage campaign autonomously, with humans intervening at roughly four to six decision points, across about thirty targets including financial institutions (the model vendor’s own report, November 2025, catalogued as MITRE ATT&CK C0062; there is no independent forensic account).
Take the mechanism from the bank research that predicted this, and refuse its remedy. The remedy offered there, human oversight plus real-time detection, is the control class most likely to decay, and this wiki’s position throughout is that architecture beats runtime checking. Cut a leg of the lethal trifecta in design; put guardrails on top of the cut, never instead of it. The reason is in prompt injection: twelve published defenses fell to adaptive attack at over 90% success, and the realised incidents needed no jailbreak.
One reading worth resisting. In the 603-respondent survey, security concern falls with maturity: 36% among laggards, 31% followers, 24% leaders. That could mean leaders solved it, or that they never tripped over it, and a cross-sectional survey cannot separate the two readings. The finding cannot support an argument that security worry fades with competence.
For a fund specifically: the dangerous surface is rarely the model. It is the agent holding an analyst’s entitlements, reading a PDF from a counterparty, and able to reach the internet: three ordinary decisions that compose into an exfiltration path nobody approved. Work the composition, not the components: threat-modeling a citizen agent does it end to end on one realistic build.
Where you stand
| Level | Looks like | Cheapest next move |
|---|---|---|
| Crawl | Agents run on human credentials with the builder’s full entitlements and unrestricted network access. No one has enumerated the trifecta for any agent. | Pick the three most-used agents and mark which of the three legs each has. Most firms find all three, and the exercise takes an afternoon. |
| Walk | Secrets are managed and some agents are sandboxed. Egress is “the corporate proxy,” which the agent’s own rendered output bypasses. | Cut the cheapest leg, egress, but enumerate every channel first, including image URLs and tool outputs. |
| Run | Per-agent identity with short-lived scoped credentials; tool access allow-listed; untrusted content isolated from privileged action by design. | Test revocation: after the kill switch, what can that identity still do for the next hour? |
| Fly | Quarantine patterns for high-stakes flows, supply-chain re-verification on change, and detection that conditions on cross-session history. | Re-verify approved tools on update rather than on install: the attacks arrive through updates. |
Concerns this dimension covers
- Prompt injection and goal hijack — the root failure class.
- Data exfiltration — where injection cashes out.
- Memory and context poisoning — compromise that persists after the session ends.
- Tool and supply-chain compromise — rug pulls, poisoned servers, and descriptions the model treats as instructions.
- Privilege and identity abuse — the confused deputy holding the firm’s credentials.
- Cross-session delayed detonation and multi-agent cascades — the unwatched perimeter.
- Resource overload and runaway cost — denial of wallet as an availability attack.
Controls that answer them
- The three legs a firm can cut: identity and access, egress control, sandboxing and isolation.
- Secrets management — the first thing citizen builds leak.
- Kill switches and revocation, runtime guardrails, supply-chain vetting.
- Grounded in: the lethal trifecta, non-human identity, Model Context Protocol.
- Built as: dual-LLM quarantine and friends; worked end to end in threat-modeling a citizen agent.
Who sells it
- AI gateways (and MCP gateways) and guardrail products — the two categories with real products.
- Agent runtime security and identity platforms for agents — the two without a credible leader. The absence of an anchor is the finding.
Sequencing and where this is checked
- Day 3 sequencing — architectural controls before runtime checks, and the reasoning for that order.
- Agent incident response — the test of whether revocation revokes.
- Promotion gates — where the trifecta check has to be a blocking question rather than a discussion.
Open questions
- Whether provable-security patterns survive contact with agents nobody threat-modeled. Every published quarantine design assumes a designer; citizen agents assume an analyst in a hurry.
- Whether any of the four “security is the top barrier” surveys corresponds to realized incidents. None of them measures losses, and nobody has published an incident base rate for citizen-built agents.