AI Engineer and Software Architect in Málaga, co-founder at Vortico. Over a decade spent on the systems that sit between a trained model and the people using it.
The failure I keep hitting isn't the agent going rogue, it's a tool call that succeeds before the transport dies. You can't tell whether the side effect landed, and the retry is where the real damage happens.
Feels like detection at the wrong layer. The injection is text but the damage is a tool call, so the thing worth constraining is which tools the agent can reach and under whose permissions. A detector at 95% still passes one in twenty straight through to an unconstrained tool.