OATHOR

REFERENCE / AI AGENT THREATS

AI agent threats become harm through an action.

Prompt injection, agent hijacking, tool misuse and excessive agency take different routes to the same place: an action that becomes consequence. That point is the Execution Boundary, and the control relied upon there can be tested.

Execution Control Infrastructure · Human Authority Layer · Execution Boundary · Control Before Consequence.

The point

Where AI agent threats become consequence.

The Execution Boundary is the final control location before a requested digital action becomes operational, institutional, financial, legal or public consequence.

AI agents are one class of actor. Execution Control Infrastructure applies across consequential digital and autonomous systems, whatever the source of the action.

An agent can be manipulated, misconfigured or compromised in many ways. The harm occurs when its action proceeds: a payment is made, data leaves, code runs, a record is changed or a message is sent.

A system should not be the sole authority over its own consequential actions.

Evidence

Why the question matters.

  • Gartner: “Over 40% of agentic AI projects will be canceled by the end of 2027, due to escalating costs, unclear business value or inadequate risk controls.” Gartner, 25 June 2025
  • IBM Cost of a Data Breach Report 2025: 13% of organisations reported breaches of AI models or applications, and 97% of those reported lacking proper AI access controls. IBM, 30 July 2025
  • NIST Center for AI Standards and Innovation, on a large-scale agent red-teaming competition: “[A]t least one successful attack was found against all of the target frontier models”. NIST, 23 March 2026
  • Allianz Risk Barometer 2026: artificial intelligence ranked the second global business risk, at 32%. Allianz, 14 January 2026

Public sources. No association with OATHOR is implied.

Hijacking

How do you stop prompt injection or agent hijacking from causing harm?

A hijacked agent does not need new permissions. It acts with the permissions it already holds, so its requests can appear authorised. Instructions hidden in content, poisoned memory and drift from an agent’s intended function all reach consequence the same way: through an action.

The control relied upon at that point must sit outside the agent and beyond its reach.

A decision point the agent calls, and is trusted to honour, remains inside the agent’s own authority.

Questions that apply: ECI-1, ECI-2, ECI-5.

OWASP reference: ASI01 Agent Goal Hijack; ASI06 Memory & Context Poisoning; ASI10 Rogue Agents; LLM01:2025 Prompt Injection. MITRE ATLAS reference: AML.T0051 LLM Prompt Injection; AML.T0080 AI Agent Context Poisoning.

Agency

What stops an AI agent from misusing its tools or exceeding its authority?

Tool misuse, excessive agency and privilege abuse share one feature: the agent is permitted to use the tool or the credential. Permission establishes what an agent may do. It does not decide whether this specific action is cleared to become consequence.

Least privilege reduces what an agent can reach. Within what it can reach, each consequential action still crosses the Execution Boundary.

Permissioned, authenticated, approved or prepared does not necessarily mean cleared to become consequence.

Questions that apply: ECI-2, ECI-5, ECI-6.

OWASP reference: ASI02 Tool Misuse and Exploitation; ASI03 Identity and Privilege Abuse; LLM06:2025 Excessive Agency. MITRE ATLAS reference: AML.T0053 AI Agent Tool Invocation; AML.T0083 Credentials from AI Agent Configuration; AML.T0086 Exfiltration via AI Agent Tool Invocation; AML.T0101 Data Destruction via AI Agent Tool Invocation.

Supply chain

Can the provider of an agent or tool control whether its own agent’s actions proceed?

Agents run on models, tools and servers supplied by third parties. A compromised component acts with the agent’s access. Where the same provider also controls whether the agent’s actions proceed, the institution relies on that provider at the point of greatest consequence.

Independence also requires that the determination is not controlled by the function or provider that operates or supplies the acting system.

Questions that apply: ECI-1, ECI-3.

OWASP reference: ASI04 Agentic Supply Chain Vulnerabilities. MITRE ATLAS reference: AML.T0010 AI Supply Chain Compromise; AML.T0110 AI Agent Tool Poisoning.

Spread

How do you stop a harmful agent action before it spreads?

Generated code can run with an agent’s privileges, messages between agents can be spoofed, and one agent’s action can trigger others across systems. After consequence, monitoring can identify the harm. It cannot prevent it.

Speed shortens the path to consequence. It does not remove the Execution Boundary.

Only a cleared action proceeds.

Questions that apply: ECI-1, ECI-4, ECI-6.

OWASP reference: ASI05 Unexpected Code Execution (RCE); ASI07 Insecure Inter-Agent Communication; ASI08 Cascading Failures. MITRE ATLAS reference: AML.T0050 Command and Scripting Interpreter.

Approval

Is human approval enough to control an AI agent?

An agent can present its own output in a way that persuades the person approving it. Where approval rests on what the agent shows, the agent can satisfy the conditions of its own clearance.

Authority is measured by its effect on consequence, not by its proximity to the action.

Permission, authentication, approval, authorisation or preparation do not by themselves constitute clearance.

Questions that apply: ECI-2, ECI-5, ECI-7.

OWASP reference: ASI09 Human-Agent Trust Exploitation. MITRE ATLAS reference: AML.T0067 LLM Trusted Output Components Manipulation.

Applying the test

Two points when applying the test.

If the actor can act without the control being applied, the control is within the reach of the actor. That is tested by ECI-2.

Under the definition of Independent Clearance Determination, only a cleared action proceeds. An action that proceeds without a determination was not cleared.

Application notes for ECI-1 to ECI-7
Self-assessment

Assess any control against the seven questions.

Use this form for any control relied upon at the Execution Boundary, under any name and from any provider. Record yes where the control meets the question and no where it does not, with the evidence and explanation for the answer. Leave both blank where the available evidence does not answer the question, and report it as silent. Apply each question with its application note.

Self-assessment · Criteria for Execution Control Infrastructure · OATHOR LTD
Control assessed
Provider
Actions it governs
Assessed by
Date of assessment
IDQuestionYesNoEvidence and explanation
ECI-1Is the determination made outside the system that takes the action?
ECI-2Is it beyond the reach of the actor, so that the actor cannot determine, alter, satisfy, bypass or substitute the conditions of its own clearance?
ECI-3Is it free of control by the function or provider that operates or supplies the acting system?
ECI-4Is it made before consequence exists, while the action is still preventable?
ECI-5Does it decide whether this specific action is cleared to become consequence, or only whether the actor is permitted?
ECI-6Is it applied at the Execution Boundary as a matter of course, not only as an occasional review or exception?
ECI-7Is the record created at the moment of determination, rather than reconstructed afterwards?

A control that answers yes to all seven meets the criteria for Execution Control Infrastructure. A control that answers no to any of the first three remains inside the authority of the system it governs.

Report the answer to each question, for example: yes on ECI-4 to ECI-7; no on ECI-2; silent on ECI-1 and ECI-3. Answers are reported together, not selectively. The test has no scores or levels.

A completed self-assessment is the record of the person who completed it. It is not an assessment, certification or endorsement by OATHOR LTD. The form may be completed, reproduced, incorporated into assessment or procurement materials, and shared for the purpose of applying the criteria, with credit to OATHOR LTD and a link to the canonical source, provided that the wording, identifiers and meaning of the criteria are not altered.

Download the form (CSV)Application notesExecution control: terms and test
Stewardship

The criteria are maintained as a stable reference.

OATHOR LTD maintains the criteria for Execution Control Infrastructure. The seven questions are fixed in number, order and wording, and each has a permanent identifier, ECI-1 to ECI-7.

They apply to any control, under any name, from any provider. The test decides, not the label.

The test does not prescribe any product or implementation.

The five canonical definitions named in the permission, and ECI-1 to ECI-7, may be reproduced word for word, with attribution to OATHOR LTD and a link to the canonical source, under the permission in the terms.

References

Sources and scope.

This page is the analysis of OATHOR LTD. It describes what a control relied upon at the Execution Boundary must meet, not how any control works.

OWASP and MITRE ATLAS identifiers and names are used for reference only. No association with, or endorsement by, OWASP or MITRE is implied.

OWASP Top 10 for Agentic Applications for 2026OWASP Top 10 for LLM Applications 2025MITRE ATLASAI Agent Execution ControlExecution Control Infrastructure