AI Now Is Right About Prompt Injection. Their Conclusion Is Where We Part Ways.

Why "Friendly Fire" proves the case for runtime enforcement — and why knowing where your agents are is not a security control.

On July 8, the AI Now Institute published "Friendly Fire," a policy brief accompanying proof-of-concept research by Boyan Milanov and Heidy Khlaaf. The exploit they demonstrated should get the attention of every security leader deploying agentic AI: an attacker can achieve remote code execution on a host machine through the AI agent that machine deployed for defense.

The scenario is not exotic. It is one of the most heavily advertised use cases in enterprise AI: point an agent at an untrusted open-source codebase or third-party library and ask it to assess the security posture. The attacker plants a prompt injection in that codebase — instructions hidden in the data the agent will ingest. The agent reads the poisoned data, follows the injected instructions, and executes the attacker's commands on the very system it was supposed to protect. The defender becomes the attack vector.

The researchers make three claims. We think all three are correct — and that they lead somewhere other than where AI Now takes them.

The Three Findings — and Why We Agree With All of Them

First: this cannot be fixed at the model level. AI Now's core technical argument is that large language models cannot reliably distinguish between untrusted data and trusted instructions. Everything is tokens in a context window. A model that reads a poisoned README cannot architecturally separate "content to analyze" from "commands to follow." This is not a bug that better training will patch out; it is a property of how these systems work. Every serious security researcher who has studied prompt injection has arrived at the same conclusion. So have we.

Second: existing mitigations fail. The brief notes that safety mitigations deployed by the major AI labs did not stop the exploit. This should surprise no one. Prompt filters, output classifiers, and system-prompt hardening all operate on the same untrusted channel the attacker controls. They are guards asking the intruder for identification the intruder printed himself.

Third: human oversight is not enough. The researchers observe that automation bias and prompt fatigue erode the value of human-in-the-loop review, particularly in high-tempo environments. A SOC analyst approving the four-hundredth agent action of the day is not a security control. They are a rubber stamp with a pulse.

Where the Analysis Stops Short

AI Now's conclusion follows from these findings: organizations should not deploy agentic AI in cyber defense, national security, or critical infrastructure contexts until the risks are resolved.

We understand the reasoning, but it rests on an incomplete picture of the available defenses. The brief evaluates two layers — model-level mitigations and human oversight — finds both wanting, and concludes the architecture is unsalvageable. There is a third layer their analysis does not address: runtime enforcement that is independent of the model entirely.

Here is the distinction that matters. The AI Now exploit succeeds in two stages:

1. Manipulation. The injected prompt convinces the agent to attempt a malicious action.
2. Execution. The agent's environment permits that action to run.

Everything AI Now examined targets stage one — and stage one is, as they demonstrate, indefensible. You cannot stop a model from being persuaded, because persuasion travels on the same channel as legitimate work.

But remote code execution does not happen at stage one. It happens at stage two. And stage two does not belong to the model. It belongs to the system that governs what the agent is allowed to do.

Assume the Injection Succeeds

This is the design principle behind 1stProtect's AgentProtect, and it inverts the industry's default posture. We do not attempt to make agents injection-proof, because no one can. We assume every agent ingesting untrusted data will eventually be compromised, and we make compromise non-actionable.

AgentProtect's enforcement layer sits outside the model, in user space, and evaluates every action an agent attempts — every process spawn, file write, network call, credential access — against an explicit policy boundary, in under 100 milliseconds, before the action executes. The policy is deterministic. It is not another LLM that can be sweet-talked. It does not read the agent's context window, so there is nothing to inject into.

Run the "Friendly Fire" scenario against this architecture. The poisoned codebase injects its instructions. The agent, exactly as AI Now demonstrated, is manipulated into attempting to execute attacker-supplied code. The attempt hits the enforcement boundary: executing arbitrary shell commands is not within this agent's authorized action set for a code-review task. The action is blocked at runtime. The injection succeeded; the attack did not.

Note what this does and does not claim. It does not claim the agent cannot be fooled — it can, and will be. It does not claim zero residual risk; an injected agent can still produce misleading analysis, which is why agent outputs feeding security decisions need independent validation, a point AI Now makes correctly. What it claims is narrower and defensible: the specific catastrophic outcome demonstrated in this research — remote code execution on the host — requires stage two, and stage two is enforceable.

This is not a novel philosophy. It is the oldest one in security. We do not make employees unphishable; we assume phishing succeeds and enforce least privilege so a compromised account cannot reach the crown jewels. We do not make applications unhackable; we sandbox them. The industry has simply been slow to apply its own foundational principle to AI agents — perhaps because the vendors selling model-level safety have an interest in the model being the unit of defense.

Inventory Is Not a Mitigation

Which brings us to the pattern we most want security leaders to reject.

The dominant response to agentic AI risk in the enterprise market right now is discovery: tools that scan your environment, find the AI agents and models running in it, and produce a dashboard. Shadow-AI inventory. Agent cataloging. "Visibility."

Let us be precise about what this is. Knowing where your agents are is not a security mitigation. It is a prerequisite for one. A map of your attack surface is not a defense of your attack surface. On the day the "Friendly Fire" exploit fires inside your environment, a perfect, real-time, beautifully visualized inventory of every agent you run will do exactly nothing. The injected agent appears on your dashboard. The remote code execution proceeds. You now have excellent documentation of where you were breached.

The security industry has been through this cycle before. Asset inventory did not stop malware; endpoint enforcement did. Cloud posture dashboards did not stop breaches; runtime controls did. Every generation of security tooling begins with vendors selling visibility because visibility is easy to build, and matures into enforcement because enforcement is what actually changes outcomes. AI security is at the start of that curve, and the "Friendly Fire" research is the proof of why the visibility stage is not a safe place to stop.

If your AI security program today consists of an agent inventory and a set of usage policies, you have governance paperwork, not a control. The question that matters is not "do we know where our agents are?" It is "what happens in the millisecond after one of them is compromised?" If the answer is "we get an alert," you have detection. If the answer is "the unauthorized action does not execute," you have security.

What Deployers Should Actually Do

AI Now's recommendation — do not deploy — is coherent if the only tools available are the ones they tested. For organizations that will deploy anyway (and the market makes clear that most will), the research points to a concrete architecture standard:

Treat every agent as presumed-compromisable. If it ingests untrusted data — code, documents, web content, email — assume injection is a matter of time, not possibility.

Enforce, don't just observe. Every agent needs a deterministic runtime boundary defining its authorized action set, enforced outside the model, before execution — not logging after it. The enforcement layer must be un-injectable by construction: no LLM in the enforcement path.

Scope agents to least privilege. An agent reviewing code has no business spawning shells, writing outside its workspace, or reaching arbitrary network endpoints. If your agent platform cannot express and enforce that boundary, that is your gap.

Keep enforcement offline-capable. Air-gapped, OT, and disconnected environments — the exact settings AI Now flags as highest-stakes — need enforcement that does not depend on a cloud control plane. A security control with a connectivity dependency is a control with a scheduled outage.

Validate agent outputs independently. Runtime enforcement stops unauthorized actions; it does not certify that an injected agent's analysis is honest. Where agent output informs security decisions, keep independent verification in the loop.

This is the architecture AgentProtect was built to provide: a single enforcement engine, running in user space with no kernel drivers, sub-100-millisecond decision latency, fully functional offline, SOC 2 Type II compliant. It governs what agents are actually allowed to do — which, as this week's research makes clear, is the only layer of the problem that can be defended at all.

The Research Is a Gift

We want to close by saying plainly: work like "Friendly Fire" makes this industry better. Milanov and Khlaaf did what good security research does — they took a heavily marketed use case, attacked it honestly, published the results, and refused to soften the conclusion. Vendors who respond to research like this defensively are telling you something about their architecture.

We respond to it differently, because their findings are our thesis. The model cannot be trusted to police itself. Filters fail. Oversight fatigues. All true. The conclusion is not that agentic AI is undeployable. The conclusion is that the enforcement boundary was never supposed to be inside the model in the first place.

---

1stProtect's AgentProtect is generally available today. To see how your current agent deployments would hold up against injection-driven attacks, request an Agent Exposure Assessment at 1stprotect.ai.