System Prompts Are Not Security Boundaries for AI Agents, Experts Warn

As AI agents become increasingly integrated with business APIs and internal systems, relying solely on system prompts to enforce security rules is proving insufficient. Prompts function as instructions to AI models, not enforcement mechanisms, making them vulnerable to prompt injection attacks hidden in emails, PDFs, or tool results. Security researchers argue that a dedicated runtime security layer must independently verify identity, authorization, and risk at the moment a tool call is executed, rather than trusting the model's interpretation of its instructions. An open-source tool called KeelBase has been released to demonstrate this approach, sitting between AI agents and business systems to re-check permissions before any action runs. The key distinction drawn is that prompts define what an AI should do, while runtime enforcement determines what it is actually allowed to do.