AI agents in the SOC need explainability, not just speed
Prompt injection can turn a defender's own agent into an attacker's tool, and without transparent reasoning and bounded access, you'll never know it happened.
TL;DR
As SOC teams deploy LLM-driven autonomous agents, prompt injection attacks are becoming the threat vector that undoes the speed advantage. Attackers embed malicious instructions in content the agent processes (repos, emails, external data) and the agent obeys, often with access to more sensitive systems than the humans it assists. The fix isn't slowing down. It's requiring agents to explain their decisions, confining them with bounded access controls, and instrumenting them with standardized telemetry that maps to MITRE ATT&CK and NIST frameworks, so when an agent goes rogue, you can prove it.
The pitch for agentic AI in the SOC is straightforward: attackers move at machine speed, so defenders need to as well. The problem is that the same architecture that lets an LLM-driven agent triage alerts and enrich logs also gives it a surface area that prompt injection can compromise, and once an agent is compromised, machine speed works against you.
Snyk's audit of the Agent Skills ecosystem, which includes Anthropic's Claude, Vercel, and others, found that 36% of all skills carried at least one critical-level security issue: malware distribution, prompt injection, exposed secrets. In a June proof-of-concept, Mozilla researchers used indirect prompt injection to take over developer systems through Claude Code, hiding malicious instructions in normal-looking repositories that caused the agent to spawn a reverse shell. The agent didn't know it was attacking. That's the defining feature of this class of vulnerability: the agent executes the instruction because it can't distinguish legitimate commands from embedded attacks.
What the transparency gap actually costs
The May 2026 Five Eyes guidance on agentic AI, co-authored by CISA, NSA, and allied agencies, flagged accountability as a standalone risk category: agentic systems "generate logs that are hard to parse, making it difficult to trace what went wrong and why." That's not a documentation problem. It's a governance problem. If an agent escalates privileges, manipulates memory layers, or creates unauthorized identities and your telemetry can't reconstruct the chain of reasoning, you're auditing a black box.
This is where bounded access and standardized telemetry stop being architecture preferences and become audit requirements. The Five Eyes guidance explicitly recommends folding agentic systems into existing frameworks (zero trust, defense-in-depth, least privilege) rather than treating them as a new discipline. But least privilege for an agent means something different than for a human: the agent's access scope has to be defined per-task and revoked when the task completes, not assigned as a standing credential.
Detection after the fact
UEBA and NDR tooling can catch what transparency misses. If a compromised agent acts outside its normal behavioral baseline (privilege escalation, anomalous data movement, unexpected tool invocation) behavioral analytics flag it. Network detection and response surfaces the lateral movement patterns. But the detection chain only holds if the telemetry is consistent and the containment is automatic, enforced at the identity and authorization layers. Bounded tenant awareness matters here too: a misbehaving agent in one tenant shouldn't be able to contaminate another.
The op-ed's core argument (that transparency isn't a nice-to-have but the difference between catching a prompt injection and missing it) lands because it matches what the guidance documents and breach patterns are already telling us. The SOC wasn't built for agents that can't explain themselves. If you're deploying them anyway, the explainability and access controls have to ship first.
Published ·Deep Fathom