AI Agents Can't Tell Instructions From Data—And Authentication Won't Fix That

Etay Maor is Vice President of Threat Intelligence for Cato Networks, a leader of advanced cloud-native cybersecurity technologies.

AI agents improving operational workflows is the kind of news that doesn’t surprise anyone. What also doesn’t come as a surprise these days is news about AI agents deleting production databases, wiping hard drives or emptying inboxes. It would be wrong to assume these agents were hacked. Agents were authenticated, the sessions were legitimate and yet they did something no one wanted.

This is worrying for security leaders. The controls underpinning the security posture can’t catch AI risk. Two main problems explain many of these incidents. First, an AI agent can’t reliably distinguish an instruction from a piece of data. Second, we’re checking what the agent is, not what it’s about to do.

Everything Looks Like An Instruction

Regular software keeps code and input at a safe distance from one another. The login field demands a username. If the user types a database command instead, secure-coding practice stops it from running. Language models have no such boundary. Everything they receive, whether a developer’s instructions, a user’s question, the text of a webpage, the body of an email or something else, arrives as the same stream of text. The model isn’t told whether this is a command or something it just needs to read.

This is the weakness that prompt injection exploits. Attackers can simply place a malicious command somewhere where the agent will read it. This can take the form of:

● Hidden text inside emails can trick AI summary tools into showing wrong numbers. Key problems include hidden commands, invisible words and bad data. The AI reads these secret parts and shares erroneous data.

● A command hidden inside a URL can cause an AI-enabled browser to treat it as an instruction.

● A calendar invite with a hidden instruction can convince an AI scheduling assistant to forward the user’s full week of meetings to an external address.