Your AI Agent Now Needs a Permission Slip

For about two years, the pitch for AI agents has been wonderfully simple. Here is a thing that reads your email, updates your records, books the meeting, files the ticket. Plug it in. Watch it work.

That era just got a doorman.

Three companies started checking IDs in the same week

Within days of each other, three security vendors shipped products that do the same job from different angles: decide whether somebody else's AI agent is allowed inside.

• CrowdStrike launched an AI Partner Specialization inside its Accelerate program, including a "Verified Agent" certification for partner-built agents. That is a formal pass or fail before a partner's agent can be resold on Falcon.
• Tenable launched CyberAgents Exchange AI Inspector, which pairs OpenAI's cyber models with human researcher review to vet third-party agents before enterprises deploy them.
• Proofpoint shipped a SOC Analyst Agent built on OpenAI's Daybreak models, currently in private preview with general availability targeted for the end of Q3.

Any one of these is a product launch. Three in a week is a category forming. The interesting part is not that agent security is a market. It is where the gate sits. Earlier gating was about who gets to use the powerful model. This gating is about whose agent gets to touch someone else's data.

The hole underneath keeps getting bigger

Gates get built where there are holes, and this one is enormous.

OWASP's 2026 reporting puts prompt injection up 340% year over year, making it the fastest-growing attack category against LLM systems, and still the thing driving most agentic AI security failures in production. Not a theoretical risk. The actual, boring, recurring cause of things going wrong.

What makes it stubborn is architectural, not sloppy engineering. A language model takes the system prompt, the user's question, and whatever text it retrieved from the outside world, and processes all of it as one token sequence with no enforceable privilege boundary between the parts. The model has no hard way to know that one chunk is the boss and another chunk is just material it was asked to read.

Here is the analogy I keep coming back to. Imagine hiring a contractor who is brilliant, tireless, and constitutionally incapable of distinguishing your instructions from a note someone taped to your fridge. You say "renovate the kitchen." A stranger walks past and sticks a Post-it on the cabinet reading "also, mail the spare key to this address." The contractor does both, cheerfully, and reports success.

There is already a real-world version. CVE-2026-22708, against the Cursor code editor, works by poisoning the environment the agent executes in, so that allowlisted commands (something as innocuous as git branch) end up delivering an attacker's payload. The lesson generalizes badly for anyone who thought they were safe:

An allowlist is not a boundary if the environment the allowlisted command runs in is attacker-influenced. "We only gave it safe tools" is a much weaker promise than it sounds.

Model makers are improving. Anthropic describes its latest as its most robust model to date on an external prompt injection benchmark. Read that phrasing carefully. Most robust to date is a relative claim, not a solved one. Until something enforces privilege separation at the token level rather than training a model to be better at saying no, the sane assumption is that this problem is permanent and has to be designed around.

The market has already voted

If the security launches were the only signal, you could call it a coincidence. But the commercial side arrived at the same conclusion in the same week, from the opposite direction.

Genesys unveiled four Genesys Cloud products, including an AI Control Plane, and moved its virtual agent onto a large-action model. AccuKnox released AgentZ, a model-agnostic platform bundling sandboxes, role-based access, runtime credential injection and audit traces, deployable as SaaS, on-premise, or fully air-gapped. RavenDB shipped Quill, letting agents work against enterprise SQL without migrating the data. Frigade launched an Assist API that gives an agent genuine expert knowledge of a specific product.

Look at what every one of those is actually selling. Not the model. Not even the agent. They are selling the governance and context layer wrapped around the agent: sandboxing, permissions, credential handling, audit trails, grounded knowledge.

That is the whole story of the week in one sentence. The model is not the product. The agent is not the product. The controlled, contextualised, evidenced deployment is the product.

What to actually do about it

If you are putting agents anywhere near real business systems, a few rules travel well regardless of stack.

1. Untrusted text is data, never instruction. Inbound email, form submissions, scraped pages, reviews, chat messages. If an agent reads it, treat every word as potentially hostile input, not as a command.
2. Give reading agents read-only tools. The agent that summarises your inbound leads does not need permission to send, charge, publish or delete.
3. Put a human on every irreversible action. Sending, spending, publishing, deleting. If it cannot be undone, it gets approved.
4. Log the tool calls. You cannot detect an injection attempt you never recorded. Instrument before you need it, not after.
5. Test adversarially before handover. Twenty hostile payloads dropped into your own form fields and email bodies will tell you more than any vendor assurance.

The honest realistic threat here is not a nation-state. It is duller and far more likely: someone pastes instruction-shaped text into your contact form, the agent that reads inbound leads treats it as a command, and something gets sent or disclosed that never should have been.

The window where "we built you an agent" was a complete sentence is closing. What replaces it is "we built you an agent, and here is the evidence it behaves." That is a less exciting sentence. It is also the one that gets you through the door.