Blog By Barry

Finish zero trust before you buy AI security.Copy link

Agentic AI needs three layers of defence. Two are controls you have already bought. The third is design work, and the products being sold in its place do not survive a live attacker.

The security industry has decided agentic AI is a product category. AI gateways, prompt firewalls, guardrail models, agent-monitoring dashboards with riskiness scores. Real budget is moving towards these products right now, and most of it is pointed at the wrong end of the problem.

I've spent the last year with coding agents doing real work on production systems, so this comes from the keyboard rather than the analyst deck. The agent on a laptop is not an alien actor that needs a security discipline invented from scratch. It sat down in the operator's seat. It holds the operator's credentials, reads what the operator can read, reaches what the operator can reach, and moves a great deal faster. Most of what makes it dangerous was on that machine before the agent arrived.

That framing now carries official weight. Six national cyber security agencies, including the US CISA and NSA, the UK NCSC and Australia's ACSC, published joint guidance in May called Careful adoption of agentic AI services. The core recommendation, verbatim: "The authoring agencies strongly recommend aligning agentic AI risks and mitigation strategies with your organisation's existing security model and risk posture." Extend the model you have. Don't stand up a parallel one. (The NCSC's companion blog makes the same point in plainer English.)

Extending it, concretely, is three layers of work. Two of them you already own.

Secure the seatCopy link

Start where the incidents are. The documented real-world exposure from agentic tooling, the things being found and exploited rather than theorised about, is overwhelmingly conventional. Unauthenticated MCP servers listening on the open internet. Leaked agent config files with credentials inside, which attackers now scan for the way they scan for exposed .git directories. Packages that execute code at install time. Agents lifting SSH keys, browser tokens and .env files off local disk, because the operator could read them and so the agent can.

None of that needs a new control category. It needs the substrate NIST SP 800-207 wrote down back in 2020: endpoint detection and response, egress filtering, network access control, microsegmentation, identity-aware policy, device posture as a first-class signal. A workstation running an agent is a workstation with a faster, more literal-minded operator at it. Harden it the way you were already supposed to.

The breach at Mexico's federal tax agency earlier this year is the same pattern at national scale. Around 195 million taxpayer records, 150 gigabytes in all, went out the door over roughly a month, and Claude was in the attacker's toolkit. The model was not the exploit. The exploit was exposed credentials, weak segmentation and unwatched egress. AI made an existing path faster to walk, and the controls that would have closed that path all live on this layer. None of them are new.

Scope the identityCopy link

The second layer is identity, and a February incident shows why. An attacker put a crafted title on a GitHub issue in the Cline repository. An authenticated Claude session in the project's CI pipeline read that title, followed the instructions hidden in it, and handed over an npm publish token. The attacker shipped a malicious package as an official update, and roughly 4,000 machines pulled it down in the eight hours or so before revocation.

Look at what set the size of that incident. Not the cleverness of the injection. The token. One long-lived credential with publish rights, resident in a workflow that reads the public internet. The trap was AI-shaped; the blast radius was set entirely by identity hygiene we have known how to do for a decade.

So treat every agent as a non-human identity and scope it properly. Least privilege per workflow, not per team. Short-lived credentials that expire before an attacker can spend them. One key per workflow, so a stolen token compromises one thing instead of everything the operator touches. Per-session scoping for interactive agents, so a bad session's damage ends with the session. Agents didn't create the non-human identity problem; they removed the tolerance for leaving it unfixed.

Fix the architectureCopy link

The third layer is the new work. There is a failure class the first two layers cannot reach, because it happens inside the agent's reasoning while every control you own reports normal.

Simon Willison gave it a name back in 2025: the lethal trifecta. An agent that holds private-data access, reads untrusted content and can communicate outwards can be steered by anyone able to write to something it reads. It's the confused deputy problem, rebuilt inside the model's context window. The GitHub MCP private-repo leak was the pure form: a poisoned public issue steered an agent into pulling private repository data out through its own legitimate access. Above the encryption boundary, through authorised calls. Network and transport controls see nothing, and that's by design rather than by failure.

The remedy the field has settled on is architectural. Meta's Agents Rule of Two says an agent "must satisfy no more than two" of the following: it processes untrustworthy inputs; it has access to sensitive systems or private data; it can change state or communicate externally. Need all three in one job? Split the workflow, or put a human between the halves. Run the Cline pipeline through that rule and it fails on the spot: untrusted issue text, a publish credential and network reach, all in one authenticated session.

The same layer covers trust hygiene for MCP itself. The protocol leaves authorisation optional and has no native defence against tool poisoning or a malicious server shadowing a trusted one. Treat MCP servers as the supply chain they are: allowlist them, pin them, and read the tool definitions before they get anywhere near a credential.

This layer is made of design reviews and workflow splits. Engineering time, not procurement. Which brings me to what the procurement budget is currently buying.

Three layers of agentic AI security: two you already own, one you must design, and every guardrail product tested has been bypassed A feed-legible infographic in three parts. Big serif headline: three layers of agentic AI security. Subtitle: two you already own, one you must design. Below, three side-by-side cards. Card one, marked OWNED, big numeral 01: SECURE THE SEAT, controls you already run. Card two, marked OWNED, big numeral 02: SCOPE THE IDENTITY, identity you already scope. Card three, signal-stroked, marked NEW, big numeral 03: FIX THE ARCHITECTURE, engineering, not procurement. Below the cards, an evidence band. Eyebrow: what not to buy, guardrails under adaptive attack. Headline: 12 tested. All 12 bypassed at over 90%. Attribution: The Attacker Moves Second, USENIX Security 2026. Closing line at the bottom, in signal red: finish zero trust before you buy AI security. Three layers of agentic AI security two you already own · one you must design Layer 01: SECURE THE SEAT. Owned. Harden the workstation the agent sits at using controls you already run. Owned 01 SECURE THE SEAT controls you already run Layer 02: SCOPE THE IDENTITY. Owned. Every agent is a non-human identity; scope it with the identity discipline you already have. Owned 02 SCOPE THE IDENTITY identity you already scope Layer 03: FIX THE ARCHITECTURE. New. The only genuinely new work. Engineering time, not procurement: Agents Rule of Two, and MCP trust hygiene. New 03 FIX THE ARCHITECTURE engineering, not procurement What not to buy · guardrails under adaptive attack 12 tested. All 12 bypassed at >90%. The Attacker Moves Second · USENIX Security 2026 finish zero trust before you buy AI security Three layers of agentic AI security (narrow layout) Same content stacked vertically. Three cards, top to bottom: SECURE THE SEAT (owned), SCOPE THE IDENTITY (owned), FIX THE ARCHITECTURE (new, signal-stroked). Below, an evidence band: 12 tested, all 12 bypassed at over 90%, from The Attacker Moves Second, USENIX 2026. Closing line: finish zero trust before you buy AI security. Three layers of agentic AI security two you own · one you must design Layer 01: SECURE THE SEAT. Owned. Owned 01 SECURE THE SEAT controls you already run Layer 02: SCOPE THE IDENTITY. Owned. Owned 02 SCOPE THE IDENTITY identity you already scope Layer 03: FIX THE ARCHITECTURE. New. New 03 FIX THE ARCHITECTURE engineering, not procurement What not to buy · guardrails 12 tested. All 12 bypassed at >90%. The Attacker Moves Second · USENIX 2026 finish zero trust before you buy AI security
two layers you already own · one you must design · and one product category you should not buy

What not to buyCopy link

The guardrail products, then. Prompt-injection detectors, jailbreak classifiers and model firewalls, sold as the fix for exactly that failure class. Independent evidence on these arrived, and it is brutal.

Researchers from OpenAI, Anthropic and Google DeepMind, working with ETH Zurich, took twelve recently published defences and did the thing vendor benchmarks don't, which is let the attacker adapt. The paper, The Attacker Moves Second, is at USENIX Security this year. Every one of the twelve was bypassed at better than 90% attack success. 100% against Circuit Breaker and StruQ. 94% against PromptGuard. 90% against ProtectAI and Model Armor. Human red-teamers got through all twelve every single time, including defences that had reported 0% attack success under their own static testing. The strongest hardened configuration anyone has published, DeepMind's adversarially trained Gemini 2.5, still failed 53.6% of the time. No published detector or guardrail has demonstrated zero bypass under adaptive attack. Not one.

A control an adaptive attacker gets past nine times in ten is a speed bump with a dashboard. Keep a guardrail as defence in depth if you like; it filters the ambient noise cheaply. But the moment one becomes the thing standing between an attacker and your data, you have bought a product in place of an architecture decision, and the numbers say the attacker wins that trade.

Where the budget goesCopy link

So, the executive version. The great bulk of your agentic AI exposure is covered by finishing the zero-trust programme you already started. Identity, device posture, segmentation and egress, with every agent enrolled as a non-human identity on short-lived, narrowly scoped credentials. That's layers one and two, funded from budget lines that already exist. If the programme stalled somewhere around 2023, agents are the reason to restart it, and the deadline pressure is not artificial this time.

The new spend is small and it is not a product. It's engineering time. A Rule of Two review of every agent workflow you run, and supply-chain treatment of every MCP server you allow. A day of architecture review per workflow will do more for you than any guardrail subscription on the market.

Buy the AI security products last, if at all, and never let one carry load. The vendors pitching them as the answer can read that USENIX paper as well as I can. They're betting your board won't.

Barry.