AI systems do not always give the same answer to the same input, and that makes one-off security checks a poor guarantee. Snyk’s Micah Silverman argues that teams should secure the data and tools around a model, rather than trusting a prompt to keep it in bounds.
Watch Desk analysis
What happened
In a security workshop discussed by BigGo Finance, Silverman explains how prompt injection can blur the line between information an AI should process and instructions it should follow. The risk grows when an agent can use tools, access company data or pass its output into another system.
His practical advice is refreshingly unmagical: do not put secrets in prompts; use ordinary access controls; limit the data a model can reach; and validate outputs before they trigger actions. For agents and Model Context Protocol (MCP) servers, teams should also inventory what is running and scan the underlying code. The BigGo Finance account draws on Silverman’s security workshop and AI Engineer podcast appearance.
Why it matters
A prompt saying “do not reveal this” is not a security boundary if the system can already read it. Silverman’s example is a student assistant: give it a database view containing only names and schedules it is allowed to disclose, rather than handing it full records and hoping the wording holds.
The same principle applies to agents that can use email, repositories or other tools. Their effective access may come through a logged-in browser or an MCP server, not just an obvious API key. And when an agent’s answer becomes the next command or query, checking that output is part of securing the whole chain, not optional tidying.
Our read
The useful shift is from asking whether the prompt sounds strict enough to asking what the model can actually access and do. Silverman’s advice is grounded in familiar security practice, adapted for systems whose outputs can vary and whose tools can widen their reach. Start with least privilege, keep sensitive data out of reach, and treat agent connections as code that needs inspection. Less theatrical than a master prompt, considerably more dependable.
What to watch
- Whether organisations track which models, agents and MCP servers are in use.
- Whether tool permissions and data access are limited to what each task needs.
- Whether teams check model outputs before downstream actions are taken.
Discussion spark: For an AI agent with access to company tools, which should be the first line of defence: strict limits on what it can access, or testing and monitoring what it does?
Sources and evidence
- Micah Silverman: The Prompt Cannot Be Your Firewall – BigGo Finance (11 October 2026, 15:09 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.