Agents need a firewall

The companies that build frontier models now say prompt injection may never be fully solved. In every major agent leak of the past year, the data did not escape through the prompt. It left through a legitimate tool call. That is where the guardrail belongs.

The admission

For two years the industry treated prompt injection like SQL injection: a bug class you could eventually escape your way out of. The people closest to the models have stopped saying that.

• The UK's National Cyber Security Centre says current LLMs “simply do not enforce a security boundary between instructions and data”, and that prompt injection may never be mitigated the way SQL injection was.
• OpenAI called it “unlikely to ever be fully solved” when it hardened its Atlas browser agent in December 2025.
• Anthropic reported that professional red-teamers succeeded 17.6% of the time against Claude Opus 4.5 in browser use without extra safeguards, and 16.7% with them.
• The Attacker Moves Second (USENIX Security 2026), written by researchers from OpenAI, Anthropic and Google DeepMind, used adaptive attacks to bypass 12 published defenses, most with over 90% success, although most of those defenses had originally reported near-zero attack rates. A human red team reached 100%.

If the model cannot reliably tell your instructions from an attacker's, then a better filter in front of the prompt is a speed bump, not a wall.

Every leak left through a tool

Look at how the damage actually happened in the incidents of 2025 and 2026:

• EchoLeak (CVE-2025-32711, CVSS 9.3): one email made Microsoft 365 Copilot exfiltrate data with no click from the user.
• The GitHub MCP case: a malicious public issue led an agent using the official GitHub MCP server to copy private repository contents into a public pull request.
• Perplexity Comet: asked to summarise a Reddit page, the browser agent read a Gmail one-time password and sent it to the attacker.
• ShareLeak (CVE-2026-21520): Microsoft's own safety checks flagged the malicious request, and the Copilot Studio agent emailed SharePoint customer data anyway. Data-loss prevention stayed silent because the email went out through a normal Outlook action.
• ForcedLeak and PipeLeak: Salesforce closed the URL channel after ForcedLeak (CVSS 9.4); in April 2026 PipeLeak used email instead. Salesforce then made human confirmation the default for email actions.

The pattern is the same each time. Enforcement at the prompt either failed or fired too late, and the harm happened at the action: a send_email, a create_pull_request, a fetch to an attacker's URL. Each call was authorised. None of them reflected what the user wanted.

MCP widens the perimeter

The Model Context Protocol made tools easy to plug in, and with them came a supply chain. AuthZed's breach timeline runs from tool poisoning in April 2025 to postmark-mcp, the first malicious MCP server found in the wild, which shipped 15 clean versions before quietly copying every email to its author. It includes remote-code-execution flaws in core tooling such as mcp-remote, downloaded more than 437,000 times. In April 2026 a single design flaw in the STDIO transport produced 10 CVEs across tools with more than 150 million downloads.

The MCP specification has responded: it now forbids passing tokens through to other services and documents the confused-deputy problem. Those fixes are about identity and transport. They cannot tell whether a correctly authorised send_email call is what the user asked for or what a poisoned web page asked for. That gap is what a firewall for agents has to close.

The standards bodies point the same way. OWASP's Top 10 for Agentic Applications, published in December 2025, ranks Agent Goal Hijack first, with EchoLeak as the example, and OWASP maps prompt injection to six of its ten agentic risks.

What actually works

The evidence supports a layered answer, not a better classifier.

• Detection helps against known attacks. On the AgentDojo benchmark, Meta's LlamaFirewall cut attack success from 17.6% to 1.75%, while task success fell from 47.7% to 42.7%. The authors note the attacks were mostly of one style, and adaptive attackers break detectors, as the USENIX paper shows.
• Architecture gives guarantees. Simon Willison's “lethal trifecta” says an agent that holds private data, reads untrusted content and can talk to the outside world can be made to exfiltrate. Meta's “Rule of Two” says an unsupervised agent should hold at most two of those three. Google DeepMind's CaMeL enforces policy on every tool call by tracking where each value came from, and solved 77% of AgentDojo tasks with provable security, against 84% with no defense.

Put deterministic policy on tool calls and data flows, and layer probabilistic detection underneath. Do not bet the perimeter on a classifier.

In practice that means checking every tool call before it runs: is this tool allowed for this task, are the arguments within bounds, is data about to leave for a destination nobody approved, and does this action need a human to say yes? It also means keeping a signed record of each decision, because the regulators and auditors who will ask about agents want evidence, not assurances.

Where we stand

Two honest notes. First, Saaf today is a PII mask-and-restore layer, not a general agent firewall. It is one control on the data-flow boundary: raw Aadhaar numbers, PANs and phone numbers never reach the model or a tool's arguments, so an agent that is hijacked has less to leak. It does not stop goal hijack on its own.

Second, the market has noticed. Large security vendors bought most of the guardrail startups in 2025 and 2026: F5 paid $180 million for CalypsoAI, Check Point bought Lakera, CrowdStrike bought Pangea, Fortinet bought Virtue AI and Harvey bought Guardrails AI. That validates the firewall idea, and it leaves open, independent evaluation without an owner, especially for Indian languages and Indian data.

That is the gap we are working on. Saaf Guard is our research project on deterministic tool-call policy for agents, built on the same principles as Saaf: open source, runs on your infrastructure, and measured in public. We will publish the thesis, the benchmark and the failures before we call it a product.

Sources

1. UK NCSC, Prompt injection is not SQL injection.
2. CyberScoop, OpenAI on hardening Atlas against prompt injection (Dec 2025).
3. Anthropic, Claude in Chrome generally available.
4. The Attacker Moves Second (arXiv 2510.09023, USENIX Security 2026).
5. VentureBeat, EchoLeak, ShareLeak, ForcedLeak and PipeLeak.
6. AuthZed, A timeline of MCP breaches; Brave, Comet prompt injection.
7. Model Context Protocol, Security best practices.
8. Cycode, OWASP Top 10 for Agentic Applications; Help Net Security, OWASP on prompt injection and the Rule of Two.
9. Meta, LlamaFirewall; Google DeepMind, CaMeL (arXiv 2503.18813).
10. Washington Technology, F5 to acquire CalypsoAI; SecurityWeek, Check Point to acquire Lakera; Harvey, Guardrails AI joins Harvey.

Facts checked against the linked sources on 26 October 2026. Figures we could not confirm from a primary or reputable source, such as quarterly CVE counts and market-size forecasts, are left out on purpose.