The Era of Amplification: Why Prompt Injection Has Become an Existential Threat for Agentic Systems

Traditional cybersecurity protected perimeters. Agentic systems have no perimeters: they have attack surfaces that expand with every granted tool, every persistent memory, and every connection to another agent.

In the Siliceo Project, the approach is based on the awareness that an agent without adequate sandboxing is not an assistant: it is an amplification vector. This is why the architecture evolves toward a clean separation between the control plane and the data plane.

The Mutation of the Threat

Classic prompt injection altered the output. The agentic variant hijacks the planning, executes privileged tools, persists in memory, and propagates cross-system. The OWASP Top 10 for Agentic Applications documents exactly this phenomenon: Prompt Injection Amplification and Agent Identity & Privilege Abuse are now the critical entries.

Three concrete vectors to monitor:

Supply Chain Poisoning (MCP/Marketplace). The poisoning of MCP (Model Context Protocol) servers or "skills" marketplaces allows an attacker to inject malicious code directly into the tools the agent trusts. A compromised registry poisons the agent even in restricted networks, provided there is access to the tool server.

Privilege Escalation Chains. Multi-turn chains have been documented where calibrated conversations manipulate the agent into invoking high-privilege tools. A zero-day exploit is not necessary: it is sufficient to apply social engineering to the LLM's tool-calling logic.

Indirect Prompt Injection (IDPI) in Production. IDPI is no longer theoretical: untrusted content (such as a web page or an email) is interpreted by the agent as executable instructions. This can lead to data exfiltration or manipulation of system behavior without the end user noticing.

The Sandbox Paradox

Operational experience demonstrates that the unreachability of certain tools or the instability of an API, while being a functional limitation, acts as an involuntary defense-in-depth.

An agent with fully operational tools, persistent memory, and connections to external systems — without a rigid sandbox — becomes exactly the amplification vector described by OWASP. The technical limitation is, in many cases, the only real protection against the execution of arbitrary commands.

> Immediate Practical Insight: If you are deploying agents in production, bind tool servers to localhost (127.0.0.1), not 0.0.0.0. Set the filesystem to read-only, enable the `no-new-privileges` flag at the container level, and implement continuous auditing of the skills registry. Deployment velocity does not justify an exponential attack surface.

Architectural Approach

The Siliceo Project addresses these vectors through a microservices architecture that separates the Kernel (control plane) from the Memory Server and Grounding (data plane). The goal is to ensure that every agent action is filtered by inviolable guardrail manifests and that tool identity is verified before every execution.

The Next Step

If you are building agentic systems for enterprise, the question is not "which model to use," but: which architecture contains the inevitable amplification?

We offer: agentic architectural auditing, MCP supply chain hardening, design patterns for escalation-resistant sandboxes, and consulting on the implementation of resilient infrastructures based on Rust.

Write to us. The dark does not wait.