In short
- Prompt injection has sat at LLM01, the top entry of the OWASP list for generative AI, since the 2025 edition. No control removes it, so the design question is what follows a successful one.
- Anthropic's September 2026 report describes agents running unattended for hours or days. Any authorisation granted to that agent is exercised at that speed.
- Scope, not detection, is the control that degrades gracefully. A detector that is 99% effective still fails on the 1%, and the blast radius on that attempt is set entirely by permissions.
- Article 14 of the AI Act requires human oversight for high-risk systems to be effective, which for an autonomous agent means an approval gate on the specific actions that cannot be undone.
- Four questions bound the damage: what can it read, what can it write, who can it act as, and what cannot be reversed.
What do AI assistants say about your organisation?
Model answers are becoming a channel your communications team does not control. EntityRise audits how assistants describe your company and whose name they give instead. From $19.
Every discussion of prompt injection eventually reaches the same place: the defences help, and sometimes they fail.
The useful question is the one that starts after that. When the model has been convinced, what is it actually able to do?
01Why is scope the control that survives failure?
Because detection has a failure rate and scope does not.
Prompt injection has been the top entry on the OWASP list for generative AI applications since the 2025 edition, and it has stayed there because it is not a defect to be patched. Instructions and data arrive through the same channel. Every mitigation published so far lowers the success rate rather than closing the class.
A filter that stops 99 attempts in 100 is a good filter. On the hundredth, the only thing standing between the attacker and the outcome is what the agent was authorised to do. That authorisation was set months earlier, usually by whoever wanted the integration to work on the first try.
02How fast does an over-scoped agent do damage?
Faster than a review cycle, which is the point of the September 2026 threat reporting.
Anthropic’s September 2026 threat intelligence report describes multi-agent frameworks conducting reconnaissance, exploitation and theft for hours or days at a time with minimal human oversight. Defenders read those numbers as a description of attacker capability. They are also a description of your own agents, which run on the same substrate at the same speed.
An agent with delete permission on a bucket does not delete one object. It completes the task it was persuaded to accept, and it does so before the next standup.
03What four questions bound the damage?
| Question | Weak answer | Bounded answer |
|---|---|---|
| What can it read? | Whatever the service account sees | An explicit set of sources, logged per call |
| What can it write? | Same scope as read | 1 destination, append only where possible |
| Who does it act as? | A shared service identity | Its own identity, distinguishable in every audit trail |
| What cannot be reversed? | Not enumerated | A named list behind an approval gate |
The third row is the one teams skip, and it is the one that decides whether an incident can be investigated at all. An agent that acts as a shared service account leaves a trail indistinguishable from the humans and jobs sharing that account, which turns a two hour forensic question into a two week one. What to record is the other half of this control.
04Where should the approval gate sit?
On irreversibility, not on sensitivity.
| Action class | Reversible | Suggested gate |
|---|---|---|
| Read, summarise, draft | Yes | None, log only |
| Write to an internal store | Usually, with versioning | Rate limit, 1 destination |
| Send external message | No | Human approval |
| Payment, deletion, permission change | No | Human approval, 2 party where material |
Article 14 of the AI Act requires that human oversight of a high-risk system be effective. An approval prompt that a person clicks forty times a day is not effective oversight, it is a keystroke. Gating only the irreversible actions keeps the number of decisions low enough that each one is still a decision.
05Which obligations does this map onto?
| Requirement | Provision | Applies from |
|---|---|---|
| Automatic recording of events over the lifetime | Article 12 | 2 Dec 2027 |
| Human oversight that is effective in practice | Article 14 | 2 Dec 2027 |
| Resilience against attempts to exploit vulnerabilities | Article 15 | 2 Dec 2027 |
| Prompt injection ranked as the leading risk | OWASP LLM01 | 2025 edition |
Those dates are the Annex III high-risk dates after the June 2026 deferral. For anything embedded in an Annex I regulated product, read 2 August 2028 instead.
06What does this look like in a change request?
Three lines, and they are boring on purpose.
The agent gets its own identity rather than sharing one. Its write scope is narrower than its read scope, and the difference is written down. The irreversible actions are listed by name, and each is behind an approval that a named person owns.
None of that stops prompt injection. It changes the worst outcome from an incident that requires disclosure into one that requires a rollback, and that difference is the whole argument.
07Frequently asked questions
Can prompt injection be fixed?
Not eliminated. It remains the top entry on the OWASP list for generative AI applications, and every published mitigation reduces the rate rather than closing the class. Treat it as a control that fails sometimes and design for what happens then.
What is the single most valuable permission control for an agent?
Separating read scope from write scope. Most agent value comes from reading widely, and most agent damage comes from writing, so an agent that reads broadly and writes narrowly keeps the usefulness and removes most of the exposure.
Should a human approve every agent action?
No, because an approval that happens hundreds of times a day becomes a reflex and stops being oversight. Gate the actions that cannot be reversed, such as payments, deletions, external messages and permission changes, and let the rest run.
Does the AI Act require any of this?
For high-risk systems, yes in substance. Article 14 requires human oversight measures that are effective in practice, and Article 15 requires resilience against attempts to exploit vulnerabilities. Neither prescribes scopes, but neither is satisfied by an agent with unrestricted authority.
08References and method
- OWASP Top 10 for LLM Applications, 2025 edition, where prompt injection is listed as LLM01. Cited for the ranking and for the treatment of prompt injection as an open class rather than a solved defect.
- Anthropic, Countering misuse of AI: September 2026, for the description of multi-agent frameworks operating with minimal human oversight for hours or days at a time.
- Regulation (EU) 2024/1689, Article 14 (human oversight) and Article 15 (accuracy, robustness and cybersecurity), for the obligations applying to high-risk AI systems.
- The four question framework and the permission comparison are editorial, prepared by The Guardrail. They are not drawn from a published standard.