Parallax: the argument that reasoning and acting should be separated by construction
A paper argues that agents which reason should not be the same component that acts — separating deliberation from execution at an architectural level rather than trusting a single system to police itself.
The reasoning is straightforward once stated. A component that both decides and executes has no boundary an attacker must cross; convincing it is sufficient. Split them and an injection has to survive a second component that was not exposed to the poisoned context.
It is the same separation that operating systems make between user space and kernel space, and for the same reason: not because the deciding component is untrustworthy, but because a boundary that has to be crossed is checkable and a judgement call is not.
The cost is capability. Every constraint on what the acting component will accept is a constraint on what the system can do, and that is precisely the tradeoff most agent products are currently resolving in the other direction. Authorization propagation is the same argument from the identity side.
arXiv — Parallax: why AI agents that think must never act → · The Register — Prompt injection isn't the bug, AI agent frameworks are → · Infosecurity Magazine — Prompt injection remains unsolved, OWASP researcher warns →