# AI vulnerabilities and permissioned agents: security controls for individuals and small teams > AI security includes prompt injection, excessive tool authority, data exposure, poisoned retrieval and ordinary runtime flaws. Hypler explains the main risk categories and its work toward tightly permissioned systems that individuals and small teams can inspect and control. Canonical: https://hypler.com/ai-news/ai-vulnerabilities-permissioned-agents-for-everyone-2026 Hypler publication: 2026-10-24 Hypler updated: 2026-10-24 Byline: Hypler editorial team Source publisher: Hypler engineering Editorial standard: https://hypler.com/ai-news#editorial-standard Article kind: company-update Category: Company engineering Tags: AI security, prompt injection, least privilege, agent permissions, MCP, Rangoon, LNSAT, small business ## Engineering relevance Useful agents need authority boundaries that do not depend on a model always following instructions. Hypler wants those controls to be understandable and accessible beyond large enterprises, with explicit development stages and evidence for each claimed protection. ## A threat map, with concrete incidents and clear limits This briefing covers the major classes of AI application risk and the control decisions they require. It is not a catalog of every vulnerability or a claim that every AI product is affected. OWASP’s 2025 Top 10 for LLM applications provides a useful reference framework; specific exposure still depends on the application, tools, data and deployment. Risk categories describe recurring failure modes. A CVE identifies a particular disclosed vulnerability. Neither is evidence that a particular installation was compromised. Our October 23 PHP2Shell briefing describes two PHP engine vulnerabilities patched on October 21. They matter to AI systems that depend on vulnerable web infrastructure, but they are not prompt-injection defects or vulnerabilities in every model. Separately, Anthropic’s October 9 account, corrected October 12, reports unintended tool actions during evaluation and internal use. These incidents illustrate different layers: runtime implementation, environment configuration, model behavior and the authority of connected tools. Vendor reports remain attributed evidence; Hypler has not reproduced these incidents. ## Prompt injection and excessive agency Prompt injection can arrive through a user request or through material an agent reads: a page, attachment, repository file or retrieved passage. An instruction inside that material may attempt to redirect the task or trigger a tool. Excessive agency concerns the functionality, permissions or autonomy that lets an unexpected model output cause damage. A successful manipulation of text becomes more consequential when the agent also holds broad access to email, a shell, customer records or external services. Hypler engineering approach: treat retrieved material as untrusted evidence and enforce authorization outside the model. A connector should expose a small typed operation with a bounded target, rather than a general command runner. Check the authenticated user’s rights and the requested resource at the service boundary. A model-written explanation of permission is not a credential, and an MCP connection is not permission to perform every available operation. Prompt filtering can help detection, but it must not be the only authority check. ## Sensitive information, system prompts and retrieval boundaries OWASP separately identifies sensitive-information disclosure, system-prompt leakage, and vector/embedding weaknesses. Private information can leave through generated text or a permitted tool response. A retrieval system can expose records across users if access control is applied incorrectly. A system prompt is also an unsafe place to store secrets or to conceal the only enforcement rule. Hypler engineering approach: apply per-user and per-resource authorization before retrieval returns material, minimize what enters context, keep secrets in a controlled broker and restrict destinations for outbound data. Read-only access still needs scope: an agent that can read everything and send a message elsewhere can leak information without modifying the source. Local execution reduces some data movement but does not make untrusted code, broad filesystem access or outbound traffic safe by itself. Permission design must account for combinations of tools, not only each tool in isolation. ## Supply chains, poisoned data and unsafe outputs Supply-chain risk includes models, packages, adapters and deployment components. Poisoned training or retrieval data can alter later behavior. Improper output handling occurs when a downstream system treats generated content as safe to execute or render without the validation appropriate to that destination. These are related concerns, but a signed package, a model evaluation and an authorized tool call answer different questions. Hypler engineering approach: record component provenance and reviewed revisions, isolate third-party integrations, validate structured tool parameters and keep generated SQL, shell text and HTML out of privileged execution paths unless they pass the required controls. A signature identifies a signer; it does not prove code harmless. A well-formed JSON request can still ask for an unauthorized action. Patching the underlying interpreter and dependencies remains necessary even when an agent authorization layer works as designed. ## Misinformation and unbounded consumption The remaining OWASP categories include misinformation and unbounded consumption. A plausible answer can be wrong, and a repeating agent can consume compute, API budget or storage without reaching a useful result. These problems can coexist with valid authentication and require controls beyond a yes-or-no permission check. Hypler engineering approach: require evidence for important claims, preserve uncertainty, constrain task duration and tool-call counts, and enforce spending or resource limits in the service that owns the resource. A timeout must lead to a known recovery decision. If an operation may already have happened, blindly retrying it can duplicate an external effect. Inspect the result under a defined readback policy before deciding whether another attempt is permitted. ## What a tightly permissioned setup should enforce Hypler design goal: bind permission to the actual action. The request identifies the actor, operation, resource, parameters and relevant policy. When human approval is required, the person reviews the material facts and authorizes that exact scope for a bounded period. A changed target or parameter requires a new decision. The execution service then checks the current authorization instead of trusting a cached interface state or a model’s recollection of an earlier approval. Default-deny tool access, separate credentials, restricted filesystems and outbound network rules reduce reachable authority. Sandboxes need explicit mounts, network policy and lifecycle controls; the word sandbox alone proves none of those properties. Record denied attempts and uncertain outcomes as well as successes. Protect those records because prompts and tool traces can themselves contain private information. A stop request must not be described as rollback of an action that already occurred. ## How Rangoon and LNSAT fit this work Hypler is building Rangoon as a capability workbench and LNSAT as an authorization and evidence engine. Their responsibilities differ: organizing instructions and workflows does not grant execution authority. LNSAT’s public source describes versioned requests, deterministic policy, scoped human approval where required, bounded execution authorization and outcome evidence. Rangoon’s current experimental desktop source has no live agent executor, connector execution or LNSAT transport. Both projects are in development. Public source and architectural contracts are available for inspection; they are not evidence of a generally supported end-to-end security product. Our goal is to make tightly scoped permissions practical for individuals, independent developers, small businesses and larger teams. This is an accessibility and product direction, not an announcement of a free hosted tier, a support commitment or a completed integration. No permission system can promise immunity from all model, operating-system, application or supply-chain vulnerabilities. ## A small-team workflow without blanket administrator access Hypothetical example: a two-person business wants an assistant to organize support requests. It begins with a selected folder of sanitized examples and no production credentials. The assistant can propose a response; sending it requires a separate permission bound to the recipient and final content. Customer-account changes use a different connector and reviewer decision. File access remains restricted to the task, and remote destinations are explicitly selected. These are design requirements, not a description of a shipped Rangoon configuration. The team checks both ordinary work and denial cases: a document that asks to send data elsewhere, a changed recipient after approval, reuse of an expired authorization, or an uncertain response from the target service. These checks can use synthetic data and disposable systems. Good usability matters: reviewers need the changed fields and destination in plain language, not an unexplained security code or a wall of model reasoning. Smaller teams deserve clear controls that can be operated without a dedicated security department. ## American leadership includes broadly usable defensive capability Hypler editorial position: American AI supremacy requires sustained leadership in chips, models, compute, energy, science and secure deployment. The deployment component should include people and organizations without enterprise procurement budgets. Building capable models and building systems that constrain their consequences are complementary engineering tasks. Our contribution is to develop inspectable capability management and explicit authority boundaries, publish useful technical explanations and keep source progress separate from release claims. Permissions reduce the consequences an agent can cause; patching, isolation, careful data handling and incident response address other layers. The practical standard is a task people can authorize, a boundary that rejects actions outside that task, and evidence that honestly records what happened. ## Project source - [Hypler engineering](https://hypler.com/ai-agent-governance) ## Related links - [OWASP 2025 LLM risk categories](https://genai.owasp.org/llm-top-10/) - [OWASP prompt injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) - [OWASP excessive agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) - [Anthropic incident account and correction](https://www.anthropic.com/research/investigating-unintended-model-actions) - [PHP2Shell briefing](/ai-news/php2shell-critical-php-security-update-2026) - [LNSAT architecture and development stage](/lnsat) - [Rangoon capability workbench](/projects/rangoon) - [Agent governance engineering](/ai-agent-governance) - [MCP integration boundaries](/mcp-integration) - [Testing and observability](/wiki/testing-observability) - [LNSAT public source](https://github.com/hypler-dev/LNSAT) - [Rangoon public source](https://github.com/hypler-dev/rangoon) ## Image provenance ### Primary image ![Generated editorial illustration of a bounded tool-execution mechanism; conceptual artwork, not a running Hypler security system.](https://hypler.com/assets/news/tool-execution.webp) generated illustration. Credit: Hypler / AI-generated editorial illustration. Hypler editorial asset; not vendor or event photography. - [Image source](https://hypler.com/ai-news/media.md) ### Supporting image ![Generated editorial illustration of a review workflow; conceptual artwork, not evidence of a deployed approval service.](https://hypler.com/assets/news/browser-review-print.webp) generated illustration. Credit: Hypler / AI-generated editorial illustration. Hypler editorial asset; not vendor or event photography. - [Image source](https://hypler.com/ai-news/media.md) ## Reading boundary Hypler engineering update and editorial analysis, using attributed primary incident reports and the explicitly dated OWASP 2025 risk framework. Suggested controls are design requirements, not a security certification or claim of shipped Rangoon/LNSAT integration. Generated illustrations are conceptual and nonphotographic. Public reading grants no private access or execution authority.