Summary: The structural limits every mitigation source in this vault either concedes or reveals — no prepared statements, defender asymmetry, verification that does not scale, controls whose own mechanism is an attack surface, and coverage gaps mistaken for coverage.
Sources: synthesis across raw/MITRE-ATLAS/, raw/Agentic/, raw/Data-poisoning/, raw/Supply-chain-attacks/, raw/AI-incident-response/, raw/Laws/
Last updated: 2026-07-29
Control catalogues read as if the problem were solved and only the implementing remained. It is not. These are the limits, each stated by a source rather than inferred.
1. There are no prepared statements
“Prompt injection is the SQL injection of the AI era, except we don’t have prepared statements yet. There’s no single fix. Instead, you need layered defenses.”
(source: StackHawk, via securing LLM applications)
The analogy is right and its limit is the important half. SQL injection was closed by a structural fix — separating code from data at the parser. Nothing in this corpus does that for prompt injection. Every layer in defense-in-depth raises cost; none closes the class.
OWASP’s agentic work names the same root cause from the other direction: T6 exists because of “the lack of separation between data and instructions in AI agents.”
Consequence: budget for defence in depth and for the assumption that it will eventually be beaten, not for a fix.
2. The defender asymmetry
“The identified vulnerabilities create an asymmetric threat landscape, in which attackers need to compromise only a few hundred samples, while defenders must secure all data entry points.”
(source: health care poisoning review, via poisoning defences)
Compounded by 6–24 month detection lags, and by supply chain being the highest-impact class — “a single vendor compromise can affect hundreds of institutions.”
The source’s own conclusion is architectural, not procedural: safety “may require a shift from opaque, high-performance models toward more interpretable and constraint-driven architectures with verifiable robustness guarantees.” That is a capability/security trade-off, the same one NIST describes when it says trustworthiness characteristics must be balanced rather than individually maximised.
3. Verification does not scale
The clearest concession in the agentic material. T5’s mitigations, per OWASP itself:
“This will face the same constraints of scaling AI as discussed in Overwhelming Human In the Loop and would require similar approaches.”
The trap has three exits and all are bad: validate every AI claim with a human and you have removed the reason for the agent; validate with another agent and you have added a hallucination source to the cascade; validate nothing and the cascade runs. T10 is the threat that makes the first exit an attacker-controlled variable — they choose the request rate.
Risk-tiered triage is the prescribed answer and it moves the exposure rather than removing it, into the automated path where T2 and T15 operate. No source addresses whether the risk classifier itself can be manipulated by the same attacker.
4. Controls whose mechanism is an attack surface
Spotlighting. Delimiter-based context isolation is exactly what T07 End Sequences and T48 Special-Token Injection attack, including “near-neighbor strings” to the real control tokens. Worth deploying, not worth trusting.
Consensus verification. Prescribed by ASI as a mitigation for T12 and T1 — and T12’s own Scenario 5 is Consensus Mechanism Exploitation, subtly perturbing decision logic to introduce artificial disagreement. Any design leaning on agent voting has to answer this.
Human approval gates. PITAX T42 line jumping lands its payload “at tools/list time, before any tool is approved.”
Logs. T5 Scenario 1 has misinformation accumulating in long-term memory and logs, so the audit trail becomes a poisoning vector. T8-adjacent scenarios have attackers erasing or obscuring the records that would reveal them.
5. Guardrails bypassed by architecture, not by cleverness
Two paths in the agentic material route around the entire defensive stack without defeating any individual control:
- Protocol-layer invocation. MCP and A2A tool calls “may bypass user interfaces, consent flows, or direct human oversight” (T16).
- Stolen persistent agent identity. Enables “privileged, long-term API access that bypasses the agent’s conversational interface and its guardrails” (T9).
Nearly every control described as “require approval” or “human in the loop” sits on the conversational path. Both of these are second paths with none of it. This is the most under-appreciated finding in the corpus — it means the defensive posture of an agent system is set by its least-guarded invocation route, not its primary one.
6. Coverage gaps read as coverage
97 of 173 ATLAS techniques (56%) have zero mapped mitigations.
ATLAS is “far more complete as a threat taxonomy than as a control catalogue.” Using it as a posture checklist produces a badly false picture: an unmitigated technique is not one you have handled, it is one where MITRE has no published answer.
The same applies to the seven ASI threats with no Top 10 counterpart and to CoP Appendix 4’s silence on the agentic surface. Absence of a control is a finding.
7. Prescribed controls that do not exist
Roughly a third of the ASI playbook bullets name capabilities with no reliable implementation. The source is honest about one — “cryptographic attestation mechanisms for LLMs do not yet exist” — and silent about the others: probabilistic truth-checking, behavioural consistency analysis, truthfulness verification models, agent trust scoring, deception detection.
Supply chain has its own version: “difficulty in obtaining assurance due to lack of metrics and standards for assured service provision.” Contractual security requirements are only as good as your ability to verify them, and that verification layer does not exist.
See the full list in control-catalogue.
8. Detection cannot distinguish attack from drift
Named twice, independently:
- MEDLEY’s acknowledged difficulty — “temporal ensemble approaches face the challenge of distinguishing poisoning-induced shifts from natural model drift.” Evolving practice creates “legitimate divergences that may resemble poisoning.”
- Microsoft’s ambiguous root cause — “problematic behavior can emerge from the interaction of training data, fine-tuning choices, retrieval inputs, and user context. Investigation may narrow contributing factors without isolating a single defect.”
Every anomaly-detection control in control-catalogue inherits this. It is why telemetry-and-logging matters more than the detectors built on top of it: lineage lets you reconstruct afterwards what no detector could classify at the time.
9. Response is legally constrained and architecturally undefined
“Should you roll back to a previous model version? Purge poisoned memory? Rebuild your vector database?” (CoSAI). There is no generic answer — containment is architecture-specific.
And AI Act Art 73(6) forbids investigation that alters the system in ways affecting subsequent evaluation before notifying authorities. All three of CoSAI’s options are such alterations. The sequencing has to be pre-decided.
Microsoft’s warning on the tactical layer: “Use tactical allow-block lists as triage tools, not durable solutions.”
What this adds up to
Not that defence is futile — Tier 1 of control-catalogue is real, cheap relative to the risk, and agreed across independently-built frameworks. But three honest expectations:
- Assume compromise and instrument for reconstruction. Provenance and lineage beat detection wherever the artifact is not inspectable — CMU reaches this for training data, Google for model weights, ASI for agent memory. Three domains, one answer.
- Defend the least-guarded path, not the primary one. Protocol invocation and stolen agent identities decide your posture.
- Treat every “control” naming a capability as a research item until you can point at an implementation.
Related pages
- control-catalogue — including what is named but unsolved
- defense-in-depth — per-layer failure modes
- mitigation-frameworks — the coverage gaps by framework
- telemetry-and-logging — the control that survives these limits