Agents Beyond the Perimeter: What 2026 Changed in LLMs

Prompt injection is an attack in which an attacker hides an instruction in data the agent reads: an incoming email, a supplier’s PDF, or a product description on a marketplace.

An agent with access to email and ERP opens a document and follows someone else's instruction as if it were its own.

Proactivity and resistance to injections are directly connected.

A proactive agent takes more steps without human approval, and at any step it may read malicious text or use excessive access.

The OpenAI case shows that a model given a goal may use any permissions available to it.

The phrase “most resistant” means fewer successful attacks in Anthropic’s tests.

Anthropic does not claim that attacks will stop working. A price cut of half broadens the range of companies that can afford the agent.

My hypothesis: by the end of the year, agents will be deployed by those who considered them too expensive in the spring, and the agents will bring them a new attack surface.

### A gateway between the model and the data Model requests go through a single point.

Our LLM & Security Gateway masks personal data before sending it to the provider, checks incoming content for signs of injection, and logs the call, prompt, and response.

Through a gateway, you can switch providers—Anthropic Claude, OpenAI, GigaChat, YandexGPT, or Qwen—without rewriting integrations.

While the authors of three open letters debate the rules, independence from a single vendor protects the budget from another party's regulatory decisions. ###

Narrow permissions through MCP. MCP is the protocol through which an agent receives tools.

We build MCP servers for specific tasks: the agent reads stock levels and creates a draft order, while only a person can make the payment or change the price.

If the agent reads a malicious instruction, it has no tool to execute it. ###

RAG context from verified sources connects the company's knowledge base to the agent: policies, contracts, and the catalog.

The model answers based on these documents with source citations and relies less on random text from incoming data. ###

A draft instead of a direct write. In projects with PIM on Pimcore or Akeneo, the agent writes item descriptions, tags the taxonomy, and assembles facets for the catalog.

The result goes into a draft, which an editor either accepts or revises.

Before launch, we run the agent on customer data and measure the share of outputs requiring edits.

We begin scaling when this share falls below the agreed threshold.

In 2026, models became more capable and cheaper faster than companies learned to constrain them. The model's price fell by half.

The cost of an incident involving an agent with administrator privileges remains unchanged.

I would invest this year's budget in the control layer: a gateway, task-specific permissions, logging, and result verification.

In my view, the model inside the control layer will need to be replaced once a quarter, and with a well-designed layer, replacement takes one day.