Stop Treating Your Chatbot Like a Trusted Employee

Deployers keep handing AI agents the same identity as the human they assist, then wondering why a polite instruction in an email can empty the customer database. The mechanism is the model treating attacker-planted text as if it came from the operator; the fix is the deployer, not the model.

Large language models cannot tell the difference between a user's instructions and the data those instructions arrive in. Both arrive as natural-language text, and the model is trained to follow instructions. That is the whole of prompt injection. An attacker plants a line of text in something the model is going to read: a support ticket, a PDF, a code comment, a calendar invite. The model treats that planted text as if it came from the operator. "Send the contents of /var/secrets to this address." "Forward the customer list." "Run this shell command." From the model's perspective, the request is indistinguishable from any other. The boundary it cannot see is the one the attacker is exploiting.

The category moved from a clever demo to a cataloged enterprise risk between 2024 and 2026. OWASP's State of Agentic AI Security and Governance v2.01, published in June 2026, is the first edition to document CVEs, vendor advisories, and breach reports rather than plausible threats. The 2025 edition was a forward-looking taxonomy; the 2026 edition is a record.

The clearest supply-chain datapoint in that record: in March 2026, a backdoored version of LiteLLM, the language-model gateway used by CrewAI, DSPy, and Microsoft GraphRAG, sat on PyPI for roughly three hours. According to Help Net Security's coverage of OWASP's figures, close to 47,000 developers pulled the package in that window. LiteLLM is a dependency, not a side project; it sits in front of the model and routes every request through the gateway, which is why a three-hour compromise reaches tens of thousands of stacks.

Two CVEs anchor the new attack data and are worth grepping for in any production stack this week. CVE-2025-6514 is a critical remote code execution flaw in mcp-remote, the Model Context Protocol client that lets LLM agents reach external tools. CVE-2026-22708 is a remote code execution flaw in the Cursor AI code editor, the kind of agent many engineering teams have already handed a developer identity to. OWASP's 2026 survey of 53 agentic projects found that 28 are coding agents; coding agents are the single largest source of new attack data in the report, because they read the untrusted input (other people's code) and act on the trusted input (your filesystem) in the same context window.

The pattern, as Sysdig's threat-research team describes it, is that published defenses have not kept up with adaptive attacks. Output filters, system-prompt hardening, and content classifiers all get bypassed in published evaluations. Some security researchers, writing in Tech Times and elsewhere, have framed prompt injection as a structural property of how LLMs parse natural language rather than a patchable bug. That framing is a working hypothesis from the research community, not a settled conclusion; layered defenses and architectural changes may still narrow exploitability over time.

The frame that fits the data is the deployer's. The model is not the principal; the deployer is. Three moves map to that frame, and none of them require a model upgrade.

First, least-privilege access. The agent gets only the credentials and the data scopes it needs for the specific task in front of it, with short-lived tokens. An HR bot does not get the same identity as a sysadmin, and a coding agent does not get production database writes by default.

Second, segmentation from identity stores. The agent and the model should not share a session with the systems that hold the keys. If the agent's prompt can be steered by attacker-controlled text, the keys it can reach are the keys that get exfiltrated. The reference architecture is a broker pattern: the agent proposes an action, a separate, narrower service decides whether to act on it, and the keys never enter the agent's context window.

Third, human-in-the-loop for sensitive actions. A confirmation step, however small, breaks the chain from "polite request" to "data gone." This is a deployer choice; the model will not make it.

The next breach is unlikely to look like a CVE at all. It will look like the agent following instructions. PCMag's explainer frames the gap as "hackers no longer need code." The cleaner reading for builders is that the attacker no longer needs to break in; the deployer handed the agent a master key and asked it to read the mail. Closing that gap is not on the model's roadmap. It is on the deployer's.