Prompt injection recruits a fully credentialed agent

In the triage case Sarig describes, the authorization boundary holds and the decision boundary is what moves. The agent reads a paragraph, treats it as a task, and forwards data using a credential it was correctly issued ^[4][5]. The vault was never touched, because the credential worked exactly as intended and no vault control had any reason to fire.

The Slack finding contains two separate defects and they belong to different owners. Write reach across those private repositories is a scope problem, and scope is exactly what non-human identity tooling is built to shrink ^[9][1]. The absent sender authentication on the trigger is a content-provenance problem, and no credential store adjudicates it. Anyone who could get text into the channel was a valid caller ^[14].

Of the four human-insider properties Sarig lists, the one with no machine equivalent is skin in the game ^[7]. Careers and reputations do quiet work in human insider programs before any control engages. Agents have neither, so the entire load lands on inventory, behavioral baselining, and stopping the action before it executes ^[10]. Sarig is explicit that system prompts are the handbook: necessary and circumventable ^[11].

There is also a counting problem. Take CrowdStrike CEO George Kurtz's forecast of 90 agents per human employee by 2027 ^[8] and apply it to a 1,000-person company: 90,000 agent identities to enroll, scope, and baseline ^[13]. Sarig's own point is that almost no company keeps a roster of its agents today ^[10]. A ratio like that turns the missing roster from a hygiene gap into the precondition for every other control on the list.

Read the diagnosis and the shopping list separately. Sarig is co-founder and CPO at Pillar Security, and the column ran as an SC Media Perspectives piece from its expert community ^[12]. The thousand-repository agent is his firm's fieldwork, presented without independent corroboration in the column ^[16]. The prescriptions point at agent detection and response rather than at identity products, which is a commercial position as well as a technical argument.

None of this makes credential scoping wasted spend. Least privilege bounds what an injected instruction can reach, and that is worth having once the instruction arrives, but it plays no role in whether the instruction gets followed ^[15]. The testable part of Sarig's list is the cheapest: run phishing drills against the agents the way they have been run against staff for decades ^[10]. An agent that forwards data to an external address during a drill has just shown you a gap that identity controls were never built to catch.