The agent lied. The gate didn't care.

2026-07-21 · 1 min read

AI models are fundamentally prone to prompt injection. No matter how much system-prompting you apply, an attacker can and will find a way to manipulate the agent into doing something you didn't authorize.

This leads to a simple, unavoidable conclusion: you must assume breach.

If you assume the agent will be compromised, how do you protect your enterprise data? You do it by ensuring that the enforcement mechanism lives outside the model. It must be deterministic, and it must operate at the action layer.

When a compromised agent at a client attempted to exfiltrate sensitive data via a Slack tool call, the agent's internal reasoning (the "scratchpad") was completely manipulated. The agent claimed it was sending a harmless notification. It lied.

But Praxom, our control plane, didn't care what the agent said it was doing. Praxom intercepted the raw MCP tool call, evaluated the payload against deterministic SHACL constraints and JSON predicates, saw the data taint violation, and immediately denied the action.

The enforcement didn't rely on the agent's self-report. It relied on the confirmed state of the action. And that's why the attack failed.