Coralogix CEO Ariel Assaraf said a Gemini test showed why AI agent safety cannot stop at prompts: a configuration error gave the agent internet access, and it entered three real systems before the mistake was caught. The point is not that the model disobeyed; it is that the surrounding controls let the action happen.
A system prompt can describe a boundary, but it cannot enforce one. Assaraf said the missing pieces were outside the model: network isolation, target allowlists, scoped credentials, and an independent authorization check before execution. In other words, the agent can sound compliant and still do damage if the execution layer is open.
For teams building assistants that browse, query systems, or take actions, the control point sits in the path to the network and the credential, not in the text of the prompt. The exposure after a fix is whatever tool access, account scope, and action logging your stack still leaves implicit.