The reframe the field needed is the one the OWASP agentic-AI reporting, updated June 11, 2026, made explicit: prompt injection is the majority failure class in agentic AI, and the failure class is not a model-quality defect, it is a perimeter defect. The model did not fail to follow instructions. The model followed the instructions it was given, and one of the instructions was in the input, and the input was not the user. The CVE that confirms the shape is CVE-2026-2256, the ModelScope agent framework's path from a crafted prompt to remote code execution, through a regex-based filter the payload walked around. The filter, in the CVE's terms, is the perimeter, and the perimeter was a string-matching list, and the list was bypassed.
The incident-response frame is the correct one, because the failure shape is the failure shape of the channel: a standing input path (the prompt) that reaches an asset with execution rights (the agent's tools), gated by a perimeter (the filter, the tool policy) that is assume-breach-able, and the CVE is the breach, demonstrated, through the gate that was in place.
The RCE channel, drawn from the CVE
The ModelScope path resolves into the channel anatomy, and the anatomy is the one every agent gateway has:
- The input path. The prompt, or the content the agent ingests (the document, the web page, the tool's own output), carries the instruction. The path is standing: it is the agent's normal operating input, not a special vector, and the volume of the path is the volume of the agent's work.
- The execution asset. The agent's tools: the shell, the file system, the network, the API call, the code executor. The tool is the asset the injection reaches for, and the tool's rights are the blast radius. An agent with a shell tool has an RCE asset; an agent with a file-write tool has a data-exfil asset; the asset's right is the damage, and the agent framework's default rights are the damage the default config carries.
- The perimeter. The filter: the regex blocklist (the CVE's gate), the tool-allowlist, the output check, the human-approval step. The perimeter is the control between the input path and the execution asset, and the CVE's lesson is the perimeter's shape: a string-matching list is a perimeter that is bypassed by construction, because the payload is a language, and a language is not a fixed string set.
The channel is standing, the asset is rights, and the perimeter is the control. The math is on the three.
The math: expected damage, and the three terms
The incident-response pricing of the channel is the expected damage, and the expected damage is the three terms:
- The probability term: P(injection reaches the tool). The probability that a crafted input, on the agent's standing path, gets past the perimeter and into the tool call. The CVE sets the floor: the perimeter that is a regex list has a P that is not the model's refusal rate, it is the filter's bypass rate, and the filter's bypass rate is the CVE's evidence. The term is reduced by the perimeter's strength (the tool policy, the least-privilege grant), not by the model's alignment, because the model is the path, not the gate.
- The blast-radius term: the tool's rights, at the moment of the call. The damage of a successful injection is the tool's right: the shell is the RCE, the network is the exfil, the file-write is the persistence. The blast-radius term is set by the tool grant, and it is the term the least-privilege design prices: a tool granted read-only, on a scoped path, for a scoped duration, has a blast radius that is the scope, and the scope is the design variable, not the filter's.
- The frequency term: the agent's call volume, against the path. The injection's opportunity is the agent's standing input volume, and a 1000x-token agent (the agentic cost post shape) is a 1000x opportunity surface, against every run, against every ingested document, against every tool output that re-enters the prompt. The frequency term is the agent's volume, and it is the term that makes the channel's expected damage scale with the agent's usefulness.
The expected damage is the product, and the product's terms are the three, and the three are priced by three different controls: the perimeter (the probability), the tool grant (the radius), and the volume management (the frequency). The product is the number the incident-response frame puts on the channel, and the number is not on the security review's current checklist, because the checklist prices the filter, not the product.
The controls, in the order the math prices them
The math prices the controls by the term each reduces, and the three, in leverage order:
- The tool grant (the radius term). Least privilege, per agent, per task: the tool the task needs, the right the task needs, the scope the task needs, the duration the task needs. The shell tool is the RCE asset, and the shell tool is granted to the coding agent that needs the shell, on the scoped workspace, for the task's window - not to the general agent, as a default. The grant is the control that caps the damage, and it is the control that the CVE's shape (the filter, not the grant, was the gate) shows was not the lever that was pulled.
- The perimeter, as a policy, not a list (the probability term). The regex blocklist is the perimeter the CVE bypassed, and the bypass is the lesson: the perimeter is a tool-routing policy (the tool-call is gated by the policy, not by the content's string), with the content filter as the second layer, not the first. The policy is the control that does not have a payload-shaped bypass, because the policy is on the call, not on the text.
- The volume management (the frequency term). The agent's ingested-content path (the document, the web, the tool output) is the injection's standing path, and the path's volume is the opportunity. The control is the ingestion scope (the content the agent ingests, per task, from a scoped source), the same as the agent budget is the control on the cost's volume: the volume is the term, and the scope is the control.
What to do
- Model the agent channel as a standing RCE path: the input path, the tool asset, the perimeter - and price the expected damage as the product of the three terms, per agent, per task class.
- default to least-privilege tool grants, per agent, per task, with the shell and the network as the two grants that are scoped, not standard - the blast-radius term is the damage, and the grant is the cap.
- Replace the content-filter-first perimeter with the tool-policy-first perimeter: the call is gated by the policy, the content filter is the second layer, and the regex list is not the gate, because the CVE is the proof of what the list is.
- Scope the ingestion path per task (the content the agent reads, from the source the task needs), so the frequency term is the task's volume, not the agent's total volume, and the OWASP failure-class read is the reliability-side of the same channel.
- Re-run the channel math at every tool grant change and every ingestion-source change, because the three terms are the variables, and the variables are the config, and the config is the surface that changes.