The Watch Floor

Four failure modes, and only one of them is prompt injection

Hijacked goals: content the agent reads carries hidden instructions, and it uses its real permissions to exfiltrate or destroy. Tool and privilege abuse: a real tool called with destructive parameters, or tools chained in an order nobody intended. Poisoned memory: an attacker seeds persistent memory slowly, so decisions go wrong long after the injection. Cascading failure: in multi-agent workflows, one bad agent poisons everything downstream.

Repeated capability gaps look identical to prompt injection

One team widens agent access when the agent keeps hitting the same wall, treating it as a signal the scope was too narrow. An attacker steering an agent toward a permission it lacks produces exactly the same signal. The widening decision needs a human every time, and most teams have not noticed why.

An architect at a global consultancy

Endpoint-resident agents are a risk surface people underestimate

An agent that lives on the endpoint inherits everything already wrong with that endpoint, and adds destructive local actions to the blast radius. It also generates event volume nobody has budgeted for. Security teams tend to reach this conclusion after deployment rather than before.

65% had an incident. 82% found agents they didn't know about.

Two-thirds of enterprises reported an AI agent security incident in the past year, and four in five discovered shadow agents nobody had registered. The second number explains the first.

Cloud Security Alliance and Token Security data · covered on camera

Isolation isn't a control

A sandbox an agent can reach out of is a boundary on a diagram, not a boundary in production. Isolation counts when something enforces it at the moment the agent tries to cross.

Hugging Face, OpenAI and METR disclosures · covered on camera

Self-reported logs aren't an audit trail

If the agent writes the record of what the agent did, the record inherits every failure mode of the agent. An audit trail is produced by something the agent cannot edit.

Hugging Face, OpenAI and METR disclosures · covered on camera

Detection isn't enforcement

Knowing an agent did something harmful after it did it is incident response. Enforcement is the control that sat between the decision and the action.

Hugging Face, OpenAI and METR disclosures · covered on camera

Edge controls see the wire, not the action

Gateways and proxies see what crosses them, and actions that never route through them fall outside. Prompt firewalls score text for injection patterns, then let the resulting tool call through uninspected. Both are worth having. Neither answers what the agent did once it started acting.

Air-gapped stops egress, not deviation

Running in a customer-controlled, disconnected environment solves data leaving. It does nothing about an agent wandering off its intended path inside the boundary, which is the harder problem and the one teams reach second.

Use MITRE ATLAS as a coverage map, not a reading list

Take each technique that targets the execution layer and name the specific control in your stack that would catch it. Most organizations find the input stages covered and almost nothing after that. It takes an afternoon and it is the most useful afternoon in this whole subject.

The trace fields that actually matter

Tool name, inputs, returned result or summary, latency, error state, and what the agent did next. Structured metadata retained, full payloads kept selectively. The framing that came with it: this is an observability problem before it becomes an ML problem.

A CISO at a global bank

Structured output is auditable in shape, not in how the agent got there

A clean JSON response passes schema validation and tells you nothing about the reasoning, the tools called, or the data touched on the way to producing it. The cleanest statement of the whole problem I have heard.

A CISO at an Asian insurance group

Ephemerality as containment

Scheduled prompt, fresh session, shut down after. No long-running agents on purpose. It caps blast radius and kills memory poisoning outright, at the cost of everything persistent context buys you.

A security researcher running agents in production

Retention asymmetry: ten years on the record, ninety days on the reasoning

One regulated firm keeps records for ten years, logs for thirty days, and log backups for ninety. When a regulator asks in year three why an agent made a decision, the decision is on file and the reasoning is long gone.

A compliance lead at a regulated financial firm

Agents appear in no asset inventory

They behave like transient workloads. They spin up, hold credentials, act, and disappear, and the CMDB never learns they existed. Discovery is the first move for a reason.

A security leader at a large SaaS vendor

Agent identity is unsolved and everyone is improvising

The question teams hit first when they scale past a handful of agents is what identity to issue them, and there is no settled answer. Shared service accounts, per-agent credentials, borrowed human identity, all in production somewhere right now. MCP makes it sharper, because the credential and the tool surface arrive together and nothing standardizes either.

Cross-language failures turn incident response into a relay race

When an agent workflow spans services in different languages owned by different teams, tracing a failure backwards means each team walks its own segment in sequence. Days, not hours, and the trace is reconstructed rather than recorded.