What this piece is describing, without naming it, is the failure that happens before containment, before incident response, and before any discussion of compromise: the authority layer was never defined in the first place. That’s why the agent becomes dangerous when manipulated. Not because the attacker is clever, and not because the model is brittle, but because the system was never designed around a clear answer to the question the article finally asks: “what authority survives the compromise?”

That line only matters if authority was actually scoped, articulated, and governed. Teams skip that step entirely. They wire an agent to tools, data, and credentials, then treat its capabilities as a natural fact instead of a designed boundary. The article gets close when it says “your legitimate system [is] using its legitimate authority, toward an end someone else chose,” but the deeper issue is that the authority wasn’t legitimate, it was undefined.