Detection isn't enough for AI agents. Three teams just agreed on the fix.

Three independent groups — Anthropic, Chase Cunningham, and the security vendor Cequence — landed on the same answer for AI agent security without coordinating. None of them built a smarter prompt filter. All three converged on runtime containment: limiting which functions an agent can call and which systems it can reach, even when something goes wrong, rather than trying to screen out bad inputs first.

The convergence matters because AI agents are now trusted to send messages, call APIs, and move money on behalf of users. A detection-only defense is the wrong gate for a system that can act.

Anthropic published the most concrete first-party evidence in May, detailing how it contains its own Claude-based systems. Classifiers, the company's own data shows, block a large share of jailbreak attempts, and new techniques have reduced indirect prompt injection success rates to single digits. But adversarial techniques can still reach perfect success rates across model families, and the models themselves still struggle to distinguish harmless context from actionable instructions. Detection raises the cost of an attack. It does not close the door.

That is the architectural shift: from screening inputs to bounding actions. Anthropic's containment strategy leans on sandboxes, egress controls, and capability grants at the function level, enforced even when the underlying model changes. The framework is laid out on the company's Anthropic engineering blog and applied to external deployments in its Zero Trust for AI agents post.

Cequence reached the same answer from the opposite direction: production traffic from deployed AI agents. The vendor's Agentic Zero Trust research paper and implementation guide argue that delegated identity and prompt classifiers operate before the agent acts, and that an agent's behavior has to be supervised in real time regardless of the model behind it. Cequence separately documented how AI agent personas are now a distinct attack surface in production, per Help Net Security's coverage.

Chase Cunningham has argued the same thing for agentic systems: identity checks and prompt screening are preconditions, not endpoints. Allowlists, in his framing, are capability grants, not boundaries. Least privilege has to be enforced at the function level, with the agent's behavior supervised continuously rather than verified once at login.

The pattern is consistent across three different vantage points. A model lab sees algorithmic attacks succeed where classifiers fail. A production-traffic vendor sees agents take unintended actions without any adversary present. A zero-trust researcher treats agent capabilities as the unit of trust, not the agent's identity or its inputs. All three land on the same engineering prescription: capability grants, function-level least privilege, sandboxed execution, and egress allowlists.

For security leaders, the practical question is which control plane enforces these grants. A runtime containment layer sits in the path of every tool call an agent makes, evaluates it against a policy, and is the new perimeter for agentic systems; the prompt is not.

The watch item is whether the model labs themselves adopt this as the default deployment posture. Anthropic has published the framework and applied it to its own systems. Whether the broader industry follows will depend on whether the next round of agent breaches come from agents that had no runtime ceiling, or from agents whose ceilings were defined but unenforced.