Research, policy, and
practitioner writing on
agentic AI security.

There’s a line I keep hearing from people I genuinely respect, and I’ve come to think it’s half right in a way that quietly costs us the most important idea in AI security. It comes up in Slack threads, on conference panels, in the hallway conversations that are usually more honest than the talks. It goes something like this: “You can’t really defend AI systems; stop pretending you can. The mature move is to threat-model your exposure, accept that something will get through, and put your energy into solid incident response.”

My first real encounter with AI security wasn’t research, it was a presentation. I’d been asked to help a room decide whether large language models were safe to bring into their work, and I had to make the risk legible to an audience that was half technical and half not. So I did the only thing an offensive security person instinctively knows how to do, I tried to break it. I stood up with Llama 2 and showed, live, how the safety on these models could be walked around. I came at it the way I’d come at any system: find the input that makes it do the thing it shouldn’t.

I was testing a model for a piece of research, running ordinary prompts, when I rephrased one the way people around me actually talk; half English, a little Pidgin, the meaning sitting in the gap between them. The model handed back something it had flatly refused in clean English barely a minute earlier. It wasn’t a clever exploit, I hadn’t jailbroken anything, I had just spoken to it the way Lagos speaks, and the guardrail quietly stepped aside.

In a survey, 82% of security leaders said they were confident their agent controls worked. In the same survey, 88% reported an agent security incident in the past year. Sit with that pairing for a moment. One survey. One population of security leaders. Most of them are confident that their governance works. Nearly all of them have already breached.

We spend a lot of time asking whether AI will replace experts. I wonder if the bigger story is that AI is quietly changing how experts are formed in the first place. Over the past few months, I have found myself returning to the same idea from different angles. AI is moving from “help me do this” to “I’ll do this for you.” Models are no longer just helping us write, code, research, or analyze, they are increasingly expected to perform those tasks on our behalf. That shift feels like a natural progression in capability, but delegation changes both sides of the relationship. As AI learns to do more of the work, humans inevitably spend less time doing it themselves.

Three recent research threads released in May and June 2026 point toward the same structural conclusion: memory itself is becoming a primary attack surface for agentic AI systems. The first is MemMorph, a memory-poisoning attack that influences tool selection via long-term memory. The second thread is sleeper memory poisoning. The third thread is MemPoison, which explores how memory poisoning can persist despite emerging memory-management defenses.

AI agents are acquiring persistent memory. The attack that was planted in one session activates in another, affecting different users, weeks later; without any further action by the attacker. Session-level monitoring cannot catch this. The governance frameworks have not yet caught up to it.

NIST, OWASP, ISO/IEC 42001, and the EU AI Act are converging on the same four requirements; agent identity, task-scoped authorization, tamper-evident audit trails, and named accountability. Most deployments cannot satisfy any of them. This is not a future compliance requirement. It is the current specification.

The six-nation joint guidance on agentic AI security from CISA, NSA, NCSC-UK, ACSC, CCCS, and NCSC-NZ is correct. The deployment reality it is trying to address is not equipped to implement it. 74% of organizations plan to deploy agentic AI at scale. 21% have mature governance. That 53-point gap is the actual problem.

MCP collapses the boundary between language, trust, and execution. The primary interface between an MCP server and an agent's reasoning is natural language, which means the agent does not verify what a tool does. It reasons about what the tool says it does. The attack is not in the syntax. It is in the meaning.

Monitoring tells you what happened. Enforcement changes what happens. Most teams building agentic AI systems are solving the first problem and calling it the second. This issue covers what building behavioral enforcement actually requires; session state architecture, behavioral invariants, intervention ladders, and why the handoff between agents is where most enforcement designs quietly fall apart.

Why AI agents running under inherited credentials are the prerequisite attack surface for everything else. The identity vacuum does not cause the accumulation problem — but it removes the architectural layer that would make accumulation detectable and containable.

How multi-turn adversarial sequences defeat per-request monitoring, and what measuring behavioral decay actually looks like. Per-request monitoring catches these at ~0%; session-level trajectory monitoring flags ~44% before they reach critical on a realistic natural-language corpus — up to 76.9% on a keyword-scored synthetic benchmark, at a ~8% false-positive rate.

The foundational framing for the Controlled Agency research agenda. What changes when AI systems stop responding to prompts and start pursuing objectives across extended autonomous sessions — and what that means for the organizations deploying them.