For most of computing history, hacking required some degree of technical expertise. Attackers searched for vulnerable code, compromised credentials, installed malware, or exploited networks. Generative AI has introduced a strange new attack surface: Sometimes the weapon is simply a cleverly written sentence.
Inc. calls prompt injection a “Jedi mind trick” for AI. An attacker gives a chatbot or agent instructions designed to override the policies its developer intended it to follow. Elia Zaitsev, former CTO of CrowdStrike, summarizes what makes this threat unusual: An attacker doesn’t necessarily need to know how to write malware. They may only need to know how to write words.
That sounds almost trivial until we consider what enterprises are beginning to allow AI agents to do.
The Attack Surface Is Moving From Software to Behavior
An early example became famous in 2023 when someone persuaded a car dealership’s chatbot to agree to sell a Chevrolet Tahoe for $1. The dealership didn’t honor the transaction, but the incident demonstrated something important: The chatbot’s intended instructions could be displaced by instructions supplied by the customer.
Now give that same vulnerability actual authority.
Inc. describes scenarios in which manipulated agents could close accounts, open new ones, transfer money, expose confidential information, or potentially turn against a company’s own infrastructure. Employees can create similar insider threats by manipulating internal AI systems into retrieving information or performing actions they aren’t supposed to access.
The more useful agents become, the larger this problem gets. An agent that can recommend a payment is useful. An agent authorized to execute the payment is considerably more valuable. It also creates a much larger “blast radius” if someone succeeds in manipulating it.
That creates a new relationship between capability and security. Every additional action we allow an agent to perform increases the importance of controlling the conditions under which it can perform that action.
The Most Dangerous Instruction May Never Come From the User
Indirect prompt injection makes the problem considerably harder.
An attacker doesn’t necessarily communicate with the AI at all. Instead, they place instructions somewhere the AI will eventually encounter them: A document, email, website, résumé, image, audio file, or another source of external information.
Inc. cites a Duke University study examining 200,000 résumés that found approximately 1% contained hidden keywords or instructions, including commands telling AI recruiting systems to ignore previous instructions and mark the applicant as qualified.
The human recruiter may never see the instruction.
The AI does.
Now extend that scenario beyond hiring. Imagine an autonomous agent reading invoices, contracts, customer emails, insurance claims, medical records, vendor communications, or webpages while simultaneously possessing the authority to take actions inside enterprise systems.
Every piece of external information becomes a potential behavioral attack surface.
Guardrails Inside the Model Have an Inherent Weakness
This exposes a fundamental architectural problem with relying exclusively on prompts to control AI behavior.
The company gives the model instructions. Then an attacker gives the model different instructions. Ultimately, the probabilistic model is being asked to determine which instructions it should follow.
The security boundary therefore depends partly upon the judgment of the system being attacked.
Traditional cybersecurity generally avoids architectures like this. We don’t ask an employee to decide whether their own credentials should allow them to access a database. The authorization system decides. We don’t tell an application, “Please don’t spend more than $10,000.” A transactional system enforces the limit.
AI needs the same architectural separation between intelligence and authority.
The model can determine what it wants to do next. A separate control system should determine whether that behavior is permitted.
This Is Where VERN OS Fits
VERN OS was designed around deterministic runtime control outside the underlying LLM.
That distinction becomes extremely important in the context of prompt injection. If someone persuades the model to abandon its role, violate a policy, manipulate a user, or pursue an unauthorized behavioral path, the organization’s boundaries should not disappear simply because the model changed its mind about which instructions mattered.
VERN OS allows those behavioral requirements to remain independent of the probabilistic reasoning taking place inside the model.
This doesn’t eliminate the broader cybersecurity problem of prompt injection. Organizations still need strong identity management, least-privilege access, data security, input inspection, transaction controls, and traditional cybersecurity architecture. Inc.’s experts specifically recommend minimizing the information and authority available to agents.
But behavioral governance becomes another necessary layer of defense.
The objective is defense in depth: Even when the model is manipulated, the attacker still encounters controls determining what the system is allowed to do.
AI Security Is Becoming a Question of Authority
The most important sentence in the Inc. article may be remarkably simple: “The more things you let the agent do, the greater the risk.”
Enterprises aren’t going to solve that problem by preventing agents from doing anything useful. The economic value of agentic AI comes precisely from allowing systems to perform work.
The challenge is determining how much authority they receive and placing enforceable boundaries around how that authority can be exercised.
That changes the AI security question from Can someone manipulate the model? to something more useful: What can a manipulated model actually do?
We should assume attackers will continue finding clever ways to influence probabilistic systems. The enterprise architecture around those systems should be designed so that manipulating the model does not automatically mean controlling the business.
