In late 2009, Operation Aurora tore through the assumption that a network perimeter could be trusted. I was at Google when it happened, and the aftermath pulled me into security for the next fifteen years. The industry’s answer, which Google pioneered as BeyondCorp and NIST later codified as SP 800-207, was not a better perimeter. It was abandoning the idea of a trusted perimeter entirely: authenticate every request, at every resource, every time.
AI agents have recreated the exact same mistake, one layer up.
The new perimeter is the model
Today’s agent systems mostly rely on what amounts to perimeter defense for model behavior: system prompts telling the agent what not to do, classifiers screening inputs for injection attempts, instruction hierarchies. The published research is unambiguous about how well that works. Researchers from OpenAI, Anthropic, and Google DeepMind tested twelve published prompt-injection defenses that each reported near-zero attack success; adaptive attacks bypassed all twelve at over 90% success. Google DeepMind’s own hardening of Gemini reduced attack success but left the best remaining attack succeeding 6.2% of the time, at a cost of less than $10 to craft. OpenAI has said plainly that prompt injection, like social engineering, is unlikely to ever be fully solved.
You cannot patch your way to a trustworthy model output. The answer is to stop needing one.
This is the same inflection point network security hit fifteen years ago. The answer is the same too. Just as zero trust abandoned trust in the network perimeter, AI agent architectures must abandon trust in model outputs. Treat every LLM output as untrusted input at every point where it touches infrastructure: the way a web application treats user-submitted form data, the way a database driver treats a query string.
What that looks like in practice
Instead of asking “is this output safe?” (a question no one can answer reliably), ask “even if this output is malicious, what damage can it cause?” and engineer the answer to be “none.” Every boundary validates independently, enforced by deterministic systems the model cannot influence:
Access control lives in the database, not the prompt. The agent operates inside a session scoped to the current user’s permissions; even a fully hijacked agent asking for someone else’s data gets refused by the engine itself. Agent-generated code runs in sandboxes with no access to the host application, credentials, or network. Outputs are parsed and validated against allowlists before anything executes. Tool access is granted at the API layer, where a restriction is a guarantee — not in the instructions, where it is a suggestion.
What determines an agent’s risk isn’t how capable the model is. It’s the agent’s effective action space: the set of real-world state changes it can cause, and whether each one is constrained at the model layer (unreliable) or the infrastructure layer (reliable).
Security enforced at the infrastructure layer is enabling, not restrictive.
This is the part the security-versus-usability framing gets wrong. When the boundaries are enforced below the layer the agent can influence, the agent can operate freely inside them, and users never encounter a control during legitimate use, so nobody has an incentive to work around it. That insight is what made zero trust networking succeed, and it carries over intact.
What we told NIST
NIST opened a Request for Information on the security of AI agent systems (docket NIST-2025-0035). We submitted a formal response making the case above, drawn from operating production agent systems and from the lineage that runs through Aurora, Google’s Threat Analysis Group, BeyondCorp, and Chronicle. Four principles anchor it:
Agent outputs must be treated as untrusted. Security controls must be enforced at the infrastructure layer. Each resource an agent touches must independently validate and authorize every action. Detection and model-level defenses are valuable defense-in-depth — and must never be the primary security boundary.
The full response covers the threat landscape, the controls we run in production, assessment methodology built on effective action space, and the open problems where the field most needs guidance: caller-context propagation through agent delegation chains, multi-agent trust boundaries, and behavioral drift in the model supply chain.
Read our full NIST RFI response →
Cybersecurity spent thirty years learning to pull trustworthy answers out of messy data, because it had to. Bringing that discipline to AI agents isn’t a compliance exercise for us — it’s the foundation the whole product stands on.