AWS, SANS, OWASP and NIST warn: system prompts aren’t a security boundary

Amazon Web Services (AWS), the SANS Institute, the Open Worldwide Application Security Project (OWASP), and the U.S. National Institute of Standards and Technology (NIST) are now saying that if you’re deploying AI agents, you can’t treat system prompts as a real security boundary. That shift puts prompt injection and runtime controls back at the center of the conversation.

OWASP still lists prompt injection among the top large language model (LLM) risks in its updated Top 10, because attacker-controlled content can steer models into exposing sensitive files or taking actions they shouldn’t. NIST’s 2026 Agent Standards Initiative came after research that, according to NIST, found task hijacks worked 81% of the time. OWASP has also added an Agent Control Standard.

If you’re running agents across internal tools, support, development, or operations, the warning from AWS, SANS, OWASP, and NIST is pretty direct. Put controls in place when an agent reads data, calls tools, or executes actions. Give the agent the same permissions as the user, or fewer. Start from deny, not allow.

You can see the gap in recent adoption data. Deployed agents doubled in four months. Thirty-eight percent of organizations are running more than 100, and more than 80% say they could stop unauthorized data access. Even so, nearly 9 in 10 still reported an agent-related incident, including a 2026 OpenAI plugin ecosystem supply-chain attack that affected 47 enterprises, along with compromises in multi-agent infrastructure.

The latest guidance and standards from AWS, SANS, OWASP, and NIST are available in their published reports and security documentation.