What Most AI Security Still Misses

Most AI security today is built the way network security was built twenty years ago: hard perimeters, access control lists, rule-based guardrails. Can this agent reach this system — yes or no. That model works against attacks that look like attacks: a malicious command, an unauthorized request, a clear rule violation.

It does not work against an attack that looks like a fact.

An agent doesn't need to be tricked into doing something forbidden today. It only needs to be given a plausible, well-formed claim — a paper's exaggerated finding, an offhand Slack message, a vendor's self-reported compliance status — and record it as true. Nothing forbidden happens. No rule is broken. The claim simply becomes part of what the system believes, and months later, a different agent retrieves it as established fact and acts on it. By then the original uncertainty, the source, the context — all of it is gone. Only the claim remains.

This is a formally recognized risk category now — OWASP added it to its 2026 Agentic AI Top 10 as ASI06: Memory and Context Poisoning. It's new enough that very few practitioners can assess for it with real technical fluency yet.

Semantic Defense, Not Just Hard Guardrails:
Hard guardrails ask: is this agent allowed to do this? Semantic defense asks a harder, more useful question: should this agent believe this, and can we trace where the belief came from?

That's the actual methodology behind this work — not a single control, but a layer applied across how agents are scoped, what they're allowed to trust, and how claims move between them:

Provenance-aware memory. Every piece of information an agent retains carries its origin and its confidence level with it — not just the claim itself. A fact extracted from a single unverified source is treated differently than one confirmed by multiple independent ones, and that distinction survives every summarization and hand-off between agents, rather than getting quietly stripped away.

Domain-scoped agents, not general-purpose ones. A common failure pattern: one agent given broad access across every data "pocket" in an organization — finance, HR, resident records, vendor contracts — because it's simpler to build that way. That convenience is the vulnerability. Each agent here is scoped to exactly the domain it needs and nothing else, so a claim poisoned in one context has no path into another.

Trust-weighted retrieval. When an agent pulls information to act on, not all sources are weighted equally. Provenance and confidence metadata shape what gets trusted, not just what's most recent or most retrievable.

Temporal auditing. Because this attack works by decoupling the plant from the payoff — a claim recorded today, acted on months later — defense has to work the same way: reviewing what's been absorbed into memory over time, not just what's happening in a single session.

Why This Is Different From What Most Vendors Offer
Most AI vendors securing agentic systems are still solving yesterday's problem: can this agent be jailbroken, can this prompt be injected. Those defenses matter, and they're part of the foundation here too. But they don't address what happens when nothing looks like an attack at all — when the system is simply, quietly, taught to believe something it shouldn't.
This is a new enough category that almost no one is assessing for it yet. That's not a marketing claim — it's a genuine gap in how most organizations are securing their agentic AI right now, and it's the specific gap this work is built to close.