The agent that writes your refund is the agent an attacker can drive

The customer-support agent that processes your refund is no longer following rules. It is choosing them, in plain English, on every request. When the same model that reads a complaint also writes to a payment system, the model becomes the user, and the user can be anyone who types a sentence.

Google's August 17 post on the Agent Development Kit argues exactly this: a system prompt telling an agent to cap refunds at the order total is a soft constraint living in the same context an attacker can overwrite. Tune the model, update the weights, or append a paragraph to a customer's message, and the cap moves. Perimeter firewalls cannot see it, because the policy violation happens inside the LLM, not at the network edge.

The fix is to push hard guarantees out of the model, and Google's August 17 post names the three layers. Cryptographic signatures on writes, with hardware-backed keys, make every state mutation non-reputable. Kernel-level sandboxes, Google's own gVisor, isolate the code an agent is allowed to run from the host it runs on. Deterministic semantic gateways stand between the model's free-form output and any system that trusts it, validating that what the model said matches what the system can do.

Anyone wiring an LLM into a refund flow, a database, or a shell is now standing on the same assumption: the prompt is not a security control. The control is what the model cannot talk its way past.