Kaspersky Urges Isolation and Strict Controls for AI Agents

Kaspersky’s research frames large language models (LLMs) inside autonomous artificial intelligence agents as untrusted software components rather than reliable security authorities. The source argues that probabilistic models cannot consistently distinguish system instructions from unverified data. That concern is especially relevant as agents plan multi-step tasks, search internal document stores, and call application programming interfaces across organizational boundaries. Emails, web pages, and other untrusted inputs can carry adversarial instructions that may influence an agent’s actions, including attempts to access tools or data beyond the user’s intended task.

The article contends that external filters added around an agent may not adequately address indirect prompt injection or unauthorized tool execution. It describes a security architecture based on Kaspersky’s Cyber Immunity principles: isolate the model’s reasoning function from tools and data, enforce rules through deterministic monitors, and use microkernel sandboxes or hardware-level boundaries to constrain what a compromised model can do. The central design implication is to avoid granting an LLM direct operating-system privileges or allowing its probabilistic output to serve as its own security reference monitor.

For federal contractors, this is a technology and market signal rather than a defined buying opportunity. The source does not identify an agency solicitation, contract value, procurement contact, or mandatory control baseline. Companies developing AI agents, integration platforms, or cybersecurity services can nevertheless assess whether their architectures support compartmentalization, default-deny tool permissions, deterministic enforcement, and human review of high-impact actions. These capabilities may become relevant to future agency evaluations, but the article alone does not establish federal demand, a compliance requirement, or an acquisition schedule.

The source also cites a possible mid-2027 timeframe for compartmentalization audits. That date should be treated as unverified: it is not presented as an official requirement, and contractors should confirm any relevant timing or control expectations against authoritative guidance from the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) before incorporating them into compliance plans, proposals, or bid assumptions. The article names the European Union among agencies or entities, but does not provide a specific EU policy, procurement action, or requirement. The practical near-term response is therefore to track authoritative guidance and document how proposed systems limit agent authority.

• Kaspersky recommends treating LLMs embedded in autonomous agents as untrusted components by default.
• The reported risk centers on models’ difficulty distinguishing trusted system instructions from unverified input, including potentially malicious emails and web content.
• The article argues that bolt-on defensive filters may not stop indirect prompt injection or prevent unauthorized tool execution.
• Proposed safeguards include microkernel isolation, hardware-enforced compartmentalization, and separation of model reasoning from tools and data pipelines.
• Contractors can assess support for deterministic policy enforcement, restricted permissions, and default-deny access to agent tools.
• Human approval for consequential or high-impact actions is identified as a practical safeguard to consider in agent design.
• The source mentions a possible mid-2027 compartmentalization-audit timeframe, but does not establish it as an official requirement.
• No open solicitation, contract value, procurement contact, or specific agency acquisition is identified; this is a potential future demand area, not an active opportunity.
• Verify any proposed compliance timeline or control expectation against authoritative NIST and CISA guidance before using it in bids or compliance plans.