- 01Alexa Research responded to 47 AI agent incidents across our customer base in the past 12 months. Three root causes dominate; two prevention patterns would have eliminated most of them.
- 02Root causes: excessive agency (the agent had broader tool access than the use case required), indirect prompt injection (content the agent retrieved or processed contained instructions), output mishandling (downstream systems trusted agent output without validation).
- 03Excessive agency dominates — 60% of incidents trace to over-broad tool grants. Pattern is consistent: 'we will lock it down later.' The 'later' arrives as an incident. Examples: summarize-emails agent given send-email, draft-document agent given share-with-anyone, query agent given write access.
- 04Capability tokens with narrow scope and short lifetime would have prevented or contained 70% of incidents. Output validation that fails closed before downstream systems consume agent output would have prevented another 20%. The remaining 10% required architectural separation between trusted-input and untrusted-input contexts.
Alexa Research responded to 47 AI agent incidents across our customer base in the past 12 months. Three root causes dominate; two prevention patterns would have eliminated most of them.
Root causes — three categories
- 01Excessive agency — the agent had broader tool access than the use case required
- 02Indirect prompt injection — content the agent retrieved or processed contained instructions
- 03Output mishandling — downstream systems trusted agent output without validation
Excessive agency — the dominant cause
60% of incidents trace to over-broad tool grants. An agent designed to summarize emails was given send-email; an agent designed to draft documents was given share-with-anyone permissions; an agent designed to query data was given write access. The pattern is consistent: 'we will lock it down later.' The 'later' arrives as an incident.
Prevention patterns that would have helped
Capability tokens with narrow scope and short lifetime would have prevented or contained 70% of incidents. Output validation that fails closed before downstream systems consume agent output would have prevented another 20%. The remaining 10% required architectural separation between trusted-input and untrusted-input contexts.