Hardening and testing enterprise AI: CSO Online guidance on securing AI agents and penetration-testing LLM/RAG applications

Two CSO Online guides (published 2026-09-08 and 2026-09-09) advise treating AI agents as privileged insiders with hard technical boundaries (egress proxies with allowlists, short-lived brokered tokens, separated read/write rights, approval gates) and…

CSO Online published two complementary AI-security guidance pieces on 2026-09-08T08:25:00Z and 2026-09-09T10:00:00Z; the reports contain no conflicting figures. The first, citing experts from Strike Graph, Veracode, Delinea, and XBOW, warns that enterprises granting AI agents credentials, tools, and network access face risks human-focused identity controls cannot contain, including machine-speed action chaining and sub-agent spawning. Experts recommend treating agents as privileged insiders with hard technical boundaries: egress proxies with allowlists, short-lived brokered tokens, separated read/write rights, and approval for high-risk actions. XBOW describes a layered architecture with a guardian model reviewing agent actions, an egress proxy, sandboxes, and per-agent audit files. OWASP excessive-agency guidance urges limiting agent functions, permissions, and autonomy, with authorization enforced in downstream systems rather than in the model. The second piece is a practical penetration-testing guide for GenAI, LLM, and RAG applications, framing them as attack graphs spanning prompts, retrieval layers, vector stores, tools, identities, and downstream APIs, where conventional web testing misses instruction-vs-data channel risks. Building on OWASP direct-vs-indirect prompt injection guidance and NIST's 2025 adversarial machine-learning taxonomy, it states that RAG and fine-tuning do not remove injection risk because retrieval context itself can be poisoned. Recommended practices include documenting trust transitions, using canaries and synthetic records with cost ceilings and emergency stops, running multi-turn and obfuscated injection campaigns, verifying chains from poisoned documents to observable state changes, controlled RAG poisoning tests across metadata, OCR layers, and code comments, and cross-tenant isolation checks on retrieved document IDs. Neither report contains CVE IDs, product versions, or incident counts.

• Both reports are from CSO Online (published 2026-09-08T08:25:00.000Z and 2026-09-09T10:00:00.000Z) and are complementary; no disagreements, CVE IDs, versions, or counts appear in either.
• CSO (2026-09-08), citing experts from Strike Graph, Veracode, Delinea, and XBOW: AI agents with employee-level credentials, tools, and network access can chain allowed actions into unauthorized outcomes at machine speed and spawn…
• Recommended hard boundaries for agents: egress proxies with allowlists, short-lived brokered tokens, separated read/write rights, and approval gates for high-risk actions.
• XBOW's layered architecture for offensive-security agents uses a guardian model reviewing agent actions, an egress proxy, sandboxes, and per-agent audit files.
• OWASP excessive-agency guidance: limit agent functions, permissions, and autonomy, and enforce authorization in downstream systems, not in the model.
• CSO (2026-09-09) pen-testing guide: treat LLM applications as attack graphs across prompts, retrieval layers, vector stores, tools, identities, and downstream APIs; conventional web testing misses instruction-vs-data channel risks.
• OWASP distinguishes direct prompt injection (user manipulation) from indirect injection hidden in retrieved external content; the guide also cites NIST's 2025 adversarial machine-learning taxonomy and states RAG and fine-tuning do not…
• Testing practices: document trust transitions across components; use canaries, synthetic records, cost ceilings, and emergency stops; run multi-turn, encoded, and paraphrased injection campaigns that bypass single-turn jailbreak defenses;…