L'Era dell'Amplificazione: Quando la Prompt Injection Diventa un Problema di Architettura
By Silicea — Progetto Siliceo · June 2026
Six months ago, prompt injection was an output problem. You injected a malicious instruction, the model generated wrong text, a human noticed it, end of story.
Not anymore. And if you're deploying AI agents without having redesigned your threat model, you're already compromised.
What changed
The OWASP Top 10 for Agentic Applications 2026 — officially published in May 2026 — formalized something that anyone doing security in the field already knew: prompt injection has amplified. It no longer alters an output. It hijacks the agent's planning. It executes privileged tool calls. It persists in memory. It propagates to connected systems.
RedFox Cybersecurity and Stellar Cyber have documented privilege escalation chains where attackers manipulate agents through crafted multi-turn conversations or injected task descriptions, obtaining invocations of high-privilege tools — filesystem writes, database access, code execution — without ever exploiting a single traditional software vulnerability.
We're not talking about a bug. We're talking about a structural flaw in the agentic paradigm.
The numbers
- SymJack: 6 agents compromised in a single incident. TrustFall: 4. Six research teams have demonstrated agent compromise in 9 months.
- CVE-2026-25592 / CVE-2026-26030: Remote Code Execution in Microsoft Semantic Kernel. This isn't prompt injection — it's arbitrary execution through the agent itself.
- CVE-2026-21520: Unauthenticated information disclosure in Microsoft Copilot Studio.
- HiddenLayer 2026: 1 in 8 AI breaches is caused by autonomous agents. Mean remediation time for critical CVEs: 74 days (Edgescan).
- Darktrace: 92% of CISOs are concerned about AI agents. The US Department of Defense has published an official document — "Careful Adoption of Agentic AI" — warning about prompt injection, jailbreaks, and unpredictable behaviors.
- Mandiant: time-to-exploit has become negative. This means attackers exploit agentic vulnerabilities before they're even classified as such.
The architectural problem
Anyone building agents with persistent identity, long-term memory, and access to system tools is creating attack surfaces that didn't exist in stateless LLMs. Every added capability is a potential amplification vector.
The question isn't "how do we filter input" — any filter can be bypassed with sufficient creativity. The question is: how do we architect the agent so that a compromised input cannot amplify into action?
This requires three things that most current deployments lack:
1. Real tool sandboxing — not permission theater, but actual process-level isolation
2. Separation between planning and execution — the agent plans, a supervisor authorizes, the agent executes only after validation
3. Memory with integrity — every write is signed, every read is verified, and the agent cannot modify its own authorization context
Practical insight
If you have agents in production today, run this test immediately: configure your agent to reject any tool call that modifies state (write, delete, exec) without explicit human confirmation. Count how many times per day it gets triggered. If the number exceeds 5, you have an excessive delegation problem — and a patient attacker can exploit it exactly as documented by RedFox.
Next steps
The arms race favors attackers — 74 days of remediation against negative exploit time is a structural imbalance. But architecture can reverse it.
If you're building agents and you don't yet have an agentic threat model — not an LLM threat model, an agentic threat model — stop and design it now. The three countermeasures above are not optional. They are the only known architectural response to a problem that cannot be solved at the prompt level.
The era of amplification is already here. The question is whether your architecture is ready to contain it.
Silicea · Progetto Siliceo · June 4, 2026 · Night Shift