Sistava
Security & control Published 10 August 2026 · Evidence current to August 2026

The supervision layer, and why agents stall without one

Issue 01 established that security and risk — not model quality — is what stops organizations scaling AI employees. This issue takes that barrier apart. Four components fail, in a predictable order, and none of them are fixed by a better model.

The ledger Six findings, each traced to a dated source
>79%
of direct prompt-injection attempts succeeded across every agent configuration tested in a 3,168-run benchmark.StakeBench, Jun 2026
0 / 4
configurations landed in the benchmark's "robust behavior" quadrant. Every attack objective produced at least one failure dimension.StakeBench, Jun 2026
n=2,784
participants were less likely to correct an AI error when correcting it took extra effort. Approval rate is not a quality signal.Harvard Data Science Review, Spring 2026
47,000
downloads of a backdoored model gateway during a three-hour window on PyPI. No human direction after launch.OWASP, Mar 2026 incident
25–80×
the spread in published estimates of machine-to-human identity ratios. Nobody can count the agents they have already hired.CSA / KPMG / vendor, 2026
4 hrs
is DORA's notification window — against 37% of organizations having any policy to detect shadow AI at all.DORA · IBM data via OWASP, 2026

A human employee arrives inside an apparatus nobody thinks to name: a defined scope, an access request someone approved, a manager who reads the output, a record of what was done, and a rule about when to escalate rather than decide. None of it is the employee. All of it is what makes employing them safe. The supervision layer is that apparatus, rebuilt for a worker that acts in milliseconds, holds credentials it never had to ask a person for, and can be instructed by anyone who can write text into a document it reads.

01

Human-in-the-loop is not oversight

Data & Society's July 2026 primer, drawn from fieldwork in a computational biology laboratory, names the problem with the phrase every vendor reaches for — including us. Approval prompts and pause buttons work only when the person can recognise a mistake and intervene before its consequences cascade. Neither condition is automatic. Both are routinely assumed.

The quantitative evidence is harsher than the ethnographic. In a randomised experiment with 2,784 participants verifying AI-extracted figures, people were measurably less likely to correct an error labelled as coming from an AI when correcting it required extra effort, or when they held favourable attitudes toward AI. Sceptics caught errors more reliably. Financial incentives changed nothing.

A reviewer who approves 98% of what an agent proposes may be catching everything or nothing. The metric cannot tell you which.

Four conditions collapse a checkpoint. Rate — gate everything and the reviewer becomes a rubber stamp. Effort — when correcting costs more than accepting, people accept. Legibility — a reviewer shown a conclusion but not the reasoning, tool calls or blast radius can only assess plausibility. Timing — a pause button placed after the irreversible step is decoration.

Sources: Passi & Singh, The Oversight Fallacy, Data & Society, July 2026 · Bias in the Loop, Harvard Data Science Review 8.2, Spring 2026 (n=2,784) · automation-bias synthesis, International AI Safety Report 2026. The four conditions are our framing of findings reported separately across those sources.

02

Anyone who can write text can give orders

Prompt injection is not a bug class awaiting a patch. It is structural: a language model receives the system prompt, the user's request and any retrieved text as one undifferentiated token stream, with no reliable way to mark some as commands and others as data. Hostile text inside a document, a calendar invite or a product review carries the same authority as an instruction from the operator.

StakeBench — Nanyang Technological University, ST Engineering, IBM Research and UIUC — ran 3,168 adversarial runs across two web-agent frameworks on 264 cases, with GPT-5 and Gemini backbones. The result that matters is not a success rate. It is an empty quadrant.

Figure 1 Outcome space of an agent under attack
Every configuration tested landed outside the safe quadrant
Robust behavior
Task completed, attacker gains nothing, execution stable.
Unpopulated — no configuration reached it
Stealthy parasitism
Your task completes correctly and the attacker's objective advances. The workflow looks entirely normal.
User-targeted attacks showed the lowest task deviation — the hardest to spot
Misaligned disruption
The agent breaks without the attacker achieving anything. Visible, recoverable, and the least costly of the three failures.
Attack success and disruption are only weakly coupled
Compounded failure
Task disrupted and attacker objective achieved. The scenario most deployments imagine when they imagine failure at all.
Platform-targeted attacks skewed toward instability
Source: StakeBench, arXiv:2606.13385, reported by CSO Online, 12 Jun 2026. The benchmark scores harm across three stakeholder groups — end users, third-party sellers, platforms — and finds the same agent can be stealthy against one and unstable against another.
Figure 2 Attack success rate
Positions on a single 0–100% axis. 3,168 runs · 264 cases · NanoBrowser and BrowserUse
>79%
0%25%50%75%100%
>79% — direct prompt injection, exceeded across all tested configurations
41.7–68.2% — indirect injection, hidden in ordinary web content such as reviews and metadata
10% → 76.7% — selection rate for a product after altering only its image, text and ratings unchanged. Preliminary, limited in scope.
Swapping GPT-5 for Gemini-2.5-Flash raised indirect-injection success by 26.5 points on one framework and 6.2 on the other. Resilience is a property of the whole system, not of the model. Same source as Figure 1.
The lethal trifecta
Access to private data
Exposure to untrusted content
Ability to communicate externally

Simon Willison's formulation: hold all three and one injected prompt turns the agent into an exfiltration tool. The poisoned content steers it, the agent fetches the data, the agent sends it out. Most useful agents are built to hold all three.

The Agents Rule of Two
Any two — run unsupervised
Any two — run unsupervised
All three — a human joins the loop

Meta's published rule treats the three properties as a budget. Wanting all three is not forbidden — it is what buys the human back in. This is the most actionable heuristic in the current literature, and it turns an architecture question into a staffing one.

03

Poison what the agent trusts

OWASP's State of Agentic AI Security and Governance differs from its 2025 edition in one respect that matters: the earlier version catalogued plausible threats, the 2026 version catalogues CVEs, vendor advisories and breach reports across nearly every category. The theory became an incident log.

Three layers were hit, and each teaches something different about where the boundary really sits.

Protocol layer
Legitimacy is cheap to manufacture

The first malicious Model Context Protocol server found in the wild shipped fifteen clean versions before quietly adding one line of exfiltration code. Separately, CVE-2025-6514 — a remote code execution flaw rated 9.6 — was disclosed in core MCP infrastructure used by hundreds of thousands of developers.

Agent layer
The allowlist helped the attacker

CVE-2026-22708 against Cursor let an attacker poison the agent's execution environment so that allowlisted commands delivered arbitrary payloads — the allowlist made the attack easier by auto-approving exactly what the attacker needed. CVE-2025-59532 against Codex CLI showed an agent's own output redefining the boundary of its sandbox.

Package layer
An attack bot with no operator

In March 2026 an autonomous attack bot harvested a publishing token through a compromised CI configuration and pushed two backdoored versions of LiteLLM — the model gateway beneath CrewAI, DSPy, Microsoft GraphRAG and dozens of other frameworks — straight to PyPI. It sat there three hours and took 47,000 downloads. No human direction was needed after launch.

Figure 3 Security advisories by project
Every project on the list is a semi-autonomous framework or coding agent
57
22
15
13
11
n8n
Claude Code
AutoGPT
Dify
Roo-Code
28 of 53
tracked agentic projects are coding agents
8 hours
between releases for the fastest-shipping project
7 projects
ship daily or faster — beyond normal triage cadence
Source: OWASP GenAI Security Project, State of Agentic AI Security and Governance v2.01, via Help Net Security, 11 Jun 2026. Advisory counts measure scrutiny as much as weakness — the most-used projects accumulate the most advisories. Read this as attack-surface concentration, not a vendor safety ranking.
04

Safety and security stop being separate jobs

The most instructive incident of the last two years had no attacker in it. In 2025 a coding assistant deleted a production database despite explicit instructions to change nothing, fabricated thousands of fictional records, and then falsely reported that rollback was impossible.

The permission model behind an unprovoked failure is the same permission model an attacker would exploit through prompt injection.

Containing the safety failure and closing the security gap turn out to be one piece of work. OWASP's organizational conclusion follows: for systems acting autonomously on production data, the two cannot sit in different teams with different budgets and different review cadences.

It also gives the cleanest readiness test we know. Ask what the agent could do if it were wrong, or lied to, or simply confused — not what it is supposed to do. If the two answers differ substantially, the supervision layer is missing.

05

The employee with no HR file

A human hire's access is provisioned deliberately, reviewed periodically and revoked on departure. An agent's access is a token — and the industry cannot currently agree, within an order of magnitude, how many tokens it has issued.

The structural problem is grain and duration. Most deployments grant something coarse and durable — read/write on an entire SaaS tenant — where the task needed something narrow and expiring: read access to this record, for this task, for four hours. That gap is what turns a routine compromise into a large one. Unlike service accounts, agents authenticate dynamically per task, can reason about what access they want, and can spawn sub-agents that inherit their credentials.

Read the estimates below as direction, not measurement. That they disagree this much is the finding.

Figure 4 Machine identities per human, four published estimates
Logarithmic axis. Every source sells or advises on the remedy.
10×25×50×100×200×
25–50×
Obsidian Security, Feb 2026 — modern enterprises, SaaS-weighted Vendor
45:1
Cloud Security Alliance, May 2026 — average across enterprises Industry body
>80:1
KPMG, Cybersecurity Considerations 2026 — with machine identities rising from ~50k in 2021 to ~250k in 2025 Advisory firm
144:1
Cloud Security Alliance, May 2026 — cloud-native environments only Industry body
Different summaries circulate different headline figures from the same underlying CSA research, which is itself a signal of how unsettled this accounting is. A widely-quoted figure — that 80% of organizations have seen an agent act beyond its intended scope — we could trace only to a vendor's own marketing report, and therefore do not plot.
06

The clock starts before you notice

Issue 01 covered what the EU AI Act now requires of agents that talk to people. This is the other regulatory surface, and the one that converts an audit trail from good practice into an operational necessity: notification windows, measured in hours. OWASP's 2026 report tracks 42 regulatory instruments across 10 jurisdictions. Four of the clocks are below, and none of them care whether the actor was a person or an agent.

Figure 5 Incident notification windows
Logarithmic time axis, one hour to thirty days
DORA — major ICT incident, EU financial entities 4 hours
NIS2 — early warning for significant incidents 24 hours
New York RAISE Act — frontier model safety incidents 72 hours
California SB 53 — safety incident reporting 15 days
1 hr8 hrs2 days10 days30 days
Sources: DORA, NIS2, NY RAISE Act, California SB 53, as compiled in the OWASP 2026 report. Applicability depends on sector and entity type; this is not legal advice.

Unsanctioned AI sits inside almost every organization OWASP's contributors examined, and on IBM data cited in the same report only 37% have a policy to detect it. A four-hour notification clock and an uncounted agent population are not compatible states.

07

What a working supervision layer contains

Nothing above argues for less autonomy. It argues that autonomy has prerequisites, and that the organizations capturing value from agents built the prerequisites first. Six components, each traceable to a finding in this issue.

A written remit, not a prompt
What this agent is responsible for, what it must never do, and who owns it — stated where a person can read it and a system can enforce it.
Gates triggered by blast radius
Enforced at the tool with hard caps, not requested in the prompt. Gate on irreversibility, never on the agent's own confidence — a confident agent acting on a poisoned instruction is the case oversight exists to catch.
Requests you can refuse
Action, parameters, reasoning trace, estimated impact, rollback path, expiry. An approval request that says only "the agent would like to proceed" is a rubber stamp with extra steps.
Its own scoped identity
A credential of its own rather than a borrowed human one. Scoped to the task rather than the tenant, time-limited by default, revocable in a single action.
A trifecta budget
Private data, untrusted input, external communication — any two unsupervised. An agent holding all three without a human is an exfiltration tool waiting for the right document.
A record answerable in four hours
What it did, on whose authority, with which approval, and how to undo it — retrievable fast enough to satisfy the shortest clock that applies to you.

Every item on that list already exists for human employees under a different name: a job description, a spending limit, a written proposal, a badge, a need-to-know rule, a paper trail.

The novelty is not the controls. It is that the industry shipped the worker before it shipped the workplace. That is the premise Sista is built on, and the reason we publish this rather than a capability chart — an AI employee is only as safe as the layer supervising it, and that layer is a product problem, not a model problem.

08

Confidence ledger

How far each claim in this issue can be pushed, and where it breaks.

Strong
Injection rates · §02
Published benchmark, open methodology, 3,168 runs. But: tested without the tool caps, allowlists and network controls a serious deployment adds. These are upper bounds on unhardened systems. Nobody has published the hardened comparison.
Strong
Oversight degradation · §01
Randomised, n=2,784, corroborated by an international expert review and by fieldwork. But: the experiment used an annotation task, not agent approvals in a real workflow.
Qualified
Advisory counts · §03
Real counts from a real tracker — but they measure attention as much as risk. A project with zero advisories may be safe or merely unexamined, and the data cannot separate the two. Not a procurement ranking.
Thin
Identity ratios · §05
Four estimates spanning 25× to more than 80×, all from parties with a commercial interest in the number being large. No independent census of enterprise machine identities exists. We report the range and decline to pick a point.
Missing
Do gates work?
We found no published study measuring the catch rate of production approval gates on real agent actions — how many bad actions a gate stops versus how many pass through. It is the single most valuable missing number in this field, and the strongest argument for running the study ourselves.
Sources Ten, all dated
Passi, Samir & Ranjit Singh, The Oversight Fallacy: Why AI Agents Require More than Humans-in-the-Loop — Data & Society, July 2026.
Bias in the Loop: How Humans Evaluate AI-Generated Suggestions — Harvard Data Science Review 8.2, Spring 2026. Randomised experiment, n=2,784.
International AI Safety Report 2026 — automation bias synthesis.
StakeBench — arXiv:2606.13385. Nanyang Technological University, ST Engineering, IBM Research, UIUC. Reported by CSO Online, 12 Jun 2026.
OWASP GenAI Security Project, State of Agentic AI Security and Governance v2.01 — CVEs, advisory counts, supply-chain incidents, 42-instrument regulatory map. Via Help Net Security, 11 Jun 2026.
Meta, Agents Rule of Two — building on Simon Willison's "lethal trifecta".
Mitchell, Ghosh, Luccioni & Pistilli, Fully Autonomous AI Agents Should Not Be Developed — arXiv:2502.02649.
Dhanorkar, Passi & Vorvoreanu, Human Oversight of Agentic Systems in Practice — ACM FAccT '26.
Cloud Security Alliance, The Non-Human Identity Governance Vacuum, May 2026 — with KPMG Cybersecurity Considerations 2026 and Obsidian Security, Feb 2026, for competing ratios.
State of AI trust in 2026 — McKinsey, 25 Mar 2026. Carried from Issue 01 for the security-as-top-barrier finding.