The Evidence Can Talk Back

Security tools used to treat a file, log entry, or network capture as material to parse. An agent also treats language inside that material as something that may deserve obedience. That changes the boundary. A comment buried in a payload can compete with the analyst's task, the system's policy, and the evidence surrounding it.

The first attempts will look ridiculous. That is not comforting. Crude attacks are reconnaissance: they reveal which instructions survive parsing, which phrases change a classification, and how much repetition turns deception into a signal. The useful question is not whether today's obvious trick worked. It is whether untrusted evidence was ever allowed to enter the same decision channel as trusted control.

Our position is blunt: if an agent can inspect attacker-controlled material, prompt injection is not a chatbot nuisance. It is part of the threat model. Treating it as a wording problem leaves the attacker inside the control plane with better wording still available.

A model that refuses dangerous work may reduce misuse at a public interface. The same refusal can stop a defender from reproducing an exploit, decoding a capture, or understanding what happened inside systems the defender owns. One policy is being asked to distinguish two identical technical actions by intent, urgency, and authority. That distinction does not live in the bytes.

The predictable response is an escape hatch: another model, a lower refusal boundary, a local deployment, or a privileged access program. Every one of those routes creates a second operating mode exactly when the organization is under pressure. If that mode is assembled during the incident, its permissions, evidence handling, and output checks are being invented while the attacker still has the clock.

You cannot outsource that boundary to a vendor's refusal message. Decide before the incident which work is authorized, who can authorize it, what the agent may touch, and how the result will be verified. Safety policy can be one layer. It cannot be the whole containment system.

An investigative agent has two different jobs hiding behind one interface. It must form a judgment from incomplete, adversarial evidence. Then somebody or something may act on that judgment. Joining those steps turns a plausible classification into production authority.

That is where machine speed becomes dangerous on both sides. An attacker can make many attempts at changing the analysis. A defender can make many rapid containment decisions before the evidence is settled. Fast detection paired with poorly calibrated action does not create safety. It creates a machine that can correctly notice danger and still damage the system while responding.

Separate the paths. Let one component collect and normalize evidence. Let another reason over a bounded representation. Require a distinct policy layer to grant actions, with narrower authority for destructive or availability-changing operations. Record the proposed action and the evidence that supported it before execution. Confidence is useful context. It is not a permission token.

Buying a stronger model does not close this gap. The model still needs tools, telemetry, identity, memory, budgets, and a route from findings to action. Those connections decide what it can observe, what hostile material can influence, and what happens when it is wrong. The surrounding factory is not integration work after the security product. It is the security product.

Build that factory as if every input may be trying to steer it. Preserve raw evidence, but do not hand raw instruction-shaped content directly to every downstream agent. Label provenance. Strip capabilities from analysis stages that do not need them. Use separate contexts for investigation and execution. Put deterministic checks around consequential outputs, and make the system prove that those checks actually examined the artifact in question.

Then attack the seams on purpose. Place deception beside the data the classifier must read. Test whether a refusal blocks an authorized investigation. Feed contradictory telemetry. Remove a required log source and confirm the system fails closed instead of becoming certain on less evidence. A guard that survives only clean demonstrations is scenery.

None of this is an argument for keeping people in every investigative loop. Human availability is too slow and inconsistent to perform continuous, repeatable inspection across a modern system. Agents will do more of that work because they can watch more surfaces, retain the operating procedure, and execute it whenever the evidence arrives.

The jobs change anyway. People should choose the acceptable consequences, define escalation policy, approve exceptional authority, and decide when the system's assumptions no longer hold. Agents should collect, correlate, reproduce, and propose inside mechanically enforced limits. That removes a great deal of routine security work. Pretending otherwise will not preserve it.

The winning defense will not be the model with the friendliest refusal or the longest context window. It will be the factory that keeps evidence from becoming authority, keeps safety policy from becoming a dead end, and keeps every consequential action answerable to proof outside the investigating agent. The evidence can talk back. Your system does not have to obey.