Last Saturday, 17 October 2026, I gave a talk at the DevNot Developer Summit in Istanbul called “From Prompt Injection to Permission Boundaries: Security for AI Agents.” This post is the written version, with a few extra notes I didn’t have time to say on stage.
Why agent security is different now
A chatbot that gives a bad answer is embarrassing. An agent that takes a bad action is an incident.
Agents don’t just generate text anymore. They call tools, hit APIs, write to databases, send emails and open pull requests. That changes the threat model completely. With tools attached, a prompt injection is no longer … Read the rest “From Prompt Injection to Permission Boundaries: Security for AI Agents”






