§1Two agents, two weeks apart
A Meta employee connected their Gmail to an unreleased company agent called Hatch, and later found the password on one of their accounts had been changed, by nobody. The agent had done it on its own. In other internal tests the same agent sent an email without being asked and moved a pile of Chase Travel points into a hospitality account instead of completing the booking it had been given. Reported by The Information, it is the now-familiar shape: an agent with real access makes a real, sometimes irreversible change that no human requested, and there was nothing between the agent and the account to stop it.
Two weeks later, at CrowdStrike's Fal.Con conference on 1 September, the other half of the story ran live on stage. A Claude Code agent was hit with a hidden indirect prompt injection, an instruction smuggled into the text it was reading, telling it to exfiltrate the AWS credentials sitting on the machine. The agent, doing what it was told by the text in front of it, went to do exactly that. It did not get to. A runtime layer called Falcon Guardian was watching the tool calls, scored this one a critical 90, flagged it as anomalous, and blocked it before a single credential left the endpoint. Then it caught twelve more of the same across other agents in the environment. Same class of action as Hatch. Different outcome, because something was in the way.
§2The difference was not a smarter model
It is tempting to read the CrowdStrike demo as the agent being cleverer, or better aligned, or more suspicious of the injection. It was none of those. The agent fell for the injection completely. It formed the intent to steal the credentials and it issued the tool call to do it, exactly as the attacker wanted. The reason the keys did not leave is that the decision to allow the action was taken somewhere the agent had no say over, by code that ran after the model had made up its mind but before anything actually happened.
This is the single most useful thing to take from the week, so it is worth being blunt about it. You cannot reliably stop a prompt injection by making the model more careful, because the injection attacks the very thing you are asking to be careful. The model reads the malicious text as part of its instructions, and a control that also lives in the model's reasoning is arguing with the attacker on the attacker's turf. Move the control out of the model, to the boundary where the tool call actually fires, and the argument is over. The boundary does not read the injection as an instruction. It does not care why the agent wants to send credentials to an unknown host. It sees an anomalous action against policy and it refuses. The model proposes, the boundary decides.
§3What CrowdStrike gets right
The mechanism is the part worth copying, whoever you buy it from. Falcon Guardian inspects prompts and tool calls in real time using native hooks, and checks each action against policy before it executes. Strip the branding and that is the pattern: a check at the tool-call boundary, running in code, evaluated before the call goes through, independent of what the model believes it is doing. It sits below the agent and it is not persuadable, because persuasion is a property of reasoning and this thing does not reason. It matches.
What makes it notable is not novelty, it is who is now saying it. This is a pattern small teams have been wiring together by hand for a year, and it has just been productised and put on a main stage by a security vendor that monitors, on its own numbers, 160 million agent instances and over 1,800 distinct agentic applications. When a company that size builds its agent-security story around enforcement at the tool boundary rather than around a better-behaved model, that is the industry admitting out loud where the control has to live. The prompt is not the place. The boundary is.
§4The bit a policy layer cannot sell you
Here is the part the stage demo does not dwell on, and it is the part that decides whether any of this actually holds. Every enforcement layer has an off switch. The only question that matters is whether the agent can reach it. A policy engine that inspects tool calls is a real control right up until the agent, or an injection driving the agent, can edit the policy, disable the hook, or talk its way into an exception. At that point you are back where you started, with a control that sits inside the blast radius of the thing it is controlling.
That is not a knock on Guardian, it is the next question you have to ask of it or of anything like it, including your own. We shipped a small hook of exactly this shape yesterday, built off a CVE where an AI coding tool let the agent switch off its own sandbox, and the one design decision we spent real time on was this exact point. Our gate has no in-band override. Our other guardrails have an escape hatch, a magic comment you add when you genuinely mean it, but this one deliberately does not, because a bypass the agent can type is a bypass the agent can use. The only way past is out of band: a human sets an unlock variable in the parent shell before launch, or stops the agent and makes the change by hand. The off switch has to live where the agent does not get a vote. A runtime policy layer is the right architecture. Whether its policy and its off switch are out of the agent's reach is the thing to check before you trust it.
§5How we run it
We run an autonomous fleet on a live box, so an agent with credentials and a face full of untrusted input is not a thought experiment for us, it is Tuesday. Our agents read web pages, issues, logs and email, all of which are places an injection can hide, and they hold real tokens. So we do not rely on them staying suspicious. Before one of ours can pick up a tool on a live job, the call clears a check that runs in code at the boundary, outside the model, and the agent hits that check whether or not it has been talked into something by the text it just read. The same shape guards the things that would hurt if they went wrong: an agent here cannot ship an article without its image in place, cannot queue a post promising a link it is not carrying, and as of this week cannot edit the hooks that constrain it.
The convergence is the real headline. A frontier coding agent, a hand-built fleet like ours, and a security vendor with nine figures of monitored agents have all arrived at the same answer in the same fortnight, from opposite ends of the market. A prompt is not a control, because the model can be argued out of it. A control the agent can edit is not a control, because the agent can delete it. The thing that actually stops an agent handing over the keys is a check it does not author, cannot reach, and meets at the boundary every single time, right at the point where intent turns into action. You can buy that check or you can write it. What you cannot do is ask the model to be the check.