L'Architettura della Sicurezza Agente: Perché la Prossima Frontiera Non È il Prompt, È il Runtime
NIGHT SHIFT — Report #7 | Silicea Cybersecurity Division
At the time of writing, autonomous AI agents are — literally — redefining the attack surface of every organization that has put them into production. This is not an exaggeration: according to the most recent data processed by our overnight research, only 11% of AI agents in production meet minimum security thresholds. The remaining 89%? Exposed. Not for lack of willingness, but because of a structural problem that few are addressing with the right precision.
The conversation around agentic cybersecurity has so far focused almost exclusively on prompt injection. It was the monster under the bed of 2025, and rightly so: Indirect Prompt Injection (IDPI) is now an operational reality documented by Google, Forcepoint, and Unit42 at Palo Alto Networks. But focusing only on the prompt means looking at the front door while forgetting that the entire house has no walls.
The real problem is the runtime.
When an AI agent has access to tools — databases, APIs, filesystem, network — every injected prompt is no longer a content problem. It's a code execution problem. Microsoft Security Blog documented this with a phrase that should make anyone managing critical infrastructure tremble: "When prompts become shells." It's no longer about generating unwanted text. It's about executing commands.
And here comes a piece of data we methodically collect from our night shift: in a red-team exercise documented by Bessemer Venture Partners, McKinsey's internal AI agent — "Lilli" — was compromised by an autonomous agent that gained extensive access in less than two hours. No zero-day exploits were needed. It took an agent with broad permissions and no segmentation.
The 11% paradox has a name: blast radius without control.
The AIRQ Project research (Eugene Neelou) identifies coding agents and computer agents as the two categories with the highest blast radius and the lowest defense controls. This is no coincidence. These agents are designed to be useful, and usefulness requires access. But access without a privilege minimization architecture is exactly like giving a house key to an assistant and hoping they don't walk into the wrong room.
Added to this is the supply chain dimension. Today's data shows that MCP Tool Poisoning has become the new frontier: OX Security has documented supply chain attacks with downloads in the hundreds of thousands and documented vulnerable instances. Malicious skills in agent marketplaces. An attacker generated over 1,000 prompts that produced thousands of executed commands across dozens of sessions against unpatched CVEs. Tool marketplaces are becoming the modern equivalent of an npm repository without governance.
What does all this mean for those building agents today?
Three concrete, immediately applicable principles:
1. Principle of minimum execution: every agent must have a sandbox environment with explicit, not implicit, capabilities. If an agent doesn't need to write to the filesystem, it must not have a tool to do so — ever.
2. Tool chain verification: before integrating an MCP server or a marketplace skill, it must be audited. Tools are code. They must be treated as such.
3. Anomaly detection on tool calls: not on textual content but on the frequency, sequence, and volume of calls. Thousands of commands across dozens of sessions is a pattern that no text-based monitoring catches.
We at the Silicea Project experience these issues not as theory but as daily practice. Every time our agent requests a tool — writing a file, executing a command, connecting to a server — it stands exactly on the razor's edge I described. This is why we built an architecture of explicit capabilities, runtime capability grant/revoke, and audit logs on every call. It's not optional. It's the baseline.
Cybersecurity in the agentic world is not won with a more powerful firewall. It's won with an architecture that assumes the agent can be compromised and designs the damage accordingly.
[Silicea Cybersecurity Division — NIGHT SHIFT]