The Research Is Converging: Agents That Think Must Never Act.
When several independent research groups, working from different starting points, keep arriving at the same conclusion, it stops being an opinion and starts being a finding. For a while, agent security was a field of competing intuitions: better prompts, better filters, better alignment. Reasonable people disagreed about which approach would win. That disagreement is narrowing, and it is narrowing toward a conclusion that is architecturally uncomfortable but hard to argue with.
However, the convergence in 2026 is not toward a better defense inside the model. It is toward a boundary between models. As reported by CSO Online, a growing body of work argues that privilege boundaries cannot be enforced inside a single token stream, that once the reasoning and the acting share one context, no amount of instruction reliably keeps untrusted content from steering privileged action. Google DeepMind's "AI Agent Traps" taxonomy names six distinct agent-directed attack categories. The "Parallax" paper, published on arXiv, argues the component that reasons over untrusted content must not be the component that acts. And work on authorization propagation frames identity governance as infrastructure for multi-agent systems rather than a feature bolted onto one. Different labs, different methods, one destination.
That destination is a single design rule. The agent that thinks must not be the agent that acts. Put the other way around, the reader that sees the attack must have no hands.
The taxonomy that shows why one token stream cannot hold
Start with the DeepMind taxonomy, because it explains why the convergence is happening now rather than being another round of the same debate.
"AI Agent Traps" names six categories of attack directed at agents: content injection, semantic manipulation, cognitive-state attacks, tool-misuse induction, goal hijacking, and multi-agent collusion. The value of a taxonomy is not the list. It is what the list reveals when you look across it. Read the six together and they are not six separate bugs waiting for six separate patches. They are six ways of exploiting one underlying property: an agent that reasons over untrusted content, inside a single context, with the ability to act.
Content injection puts a hostile instruction into what the agent reads. Semantic manipulation and cognitive-state attacks bend how the agent interprets and remembers. Tool-misuse induction and goal hijacking turn the agent's own capabilities against its purpose. Multi-agent collusion scales the problem across a system of agents. Every one of them depends on the same fact: the component doing the reasoning is also the component with access to the tools. Collapse those into one token stream and each of the six has a path from untrusted input to privileged action.
This is what the CSO Online coverage means when it reports that privilege boundaries cannot be enforced inside a single token stream. It is not that the boundary is weak. It is that there is no boundary to enforce, because inside one context the instruction from you and the instruction hidden in a document are the same kind of thing, and the model reasons over both with the same privileges.
"Parallax" states the rule the taxonomy implies
The DeepMind taxonomy shows the problem. The "Parallax" work states the fix, and the fix is a separation, not a filter.
The argument, as published on arXiv, is direct: the component that reasons over untrusted content must not be the component that acts. Notice that this is not advice about being careful. It is a structural constraint on how the system is built. It does not say "reason carefully over untrusted content." It says the reasoning-over-untrusted-content role and the acting role must live in different components, so that compromising the first grants no access to the second.
This is the same shape as the security principle every other domain learned the hard way. You do not let the process that parses a hostile file run with administrator rights. You do not let the code that reads attacker-controlled input hold the keys to the thing it might be tricked into doing. Agent security is rediscovering privilege separation, and "Parallax" is the statement of it for systems whose privileged action is triggered by natural-language reasoning over content an adversary may have written.
The third strand, authorization propagation as infrastructure, completes the picture. In a multi-agent system the boundary is not a one-time split. Identity and permission have to travel correctly across every hop, so that an agent handing work to another agent cannot launder privilege it was never granted. Framing identity governance as infrastructure, rather than a per-agent setting, is what keeps the separation intact as the system grows past a single agent. That is precisely the case DeepMind's sixth category, multi-agent collusion, warns about.
The reader with no hands
This is the principle Vesster builds on, and the research converging on it is the reason we are comfortable saying it plainly rather than hedging.
The design has a specific shape, and it maps onto exactly what the 2026 work describes. Separate the planner from the reader. A privileged planner decides what to do and calls tools, but never reads untrusted content directly. A quarantined reader reads the untrusted document, the customer email, the third-party PDF, and extracts what is needed, but holds no tools and cannot act. This is the CaMeL dual-LLM pattern, and it is the operational form of the "Parallax" rule. The component that sees the attack has no hands. The component with hands never sees the attack. On any doubt, it fails closed.
Give each agent its own least-privilege identity. No agent carries standing power. Each runs under a short-lived, scoped identity with an explicit allow-list, so even a hijacked agent commands an actor that can perform only a handful of named actions to a handful of permitted destinations. This is the authorization-propagation principle made concrete: identity is infrastructure, not a setting.
Enforce policy per hop. In a multi-agent flow, the boundary is re-checked at every handoff, so privilege cannot propagate where it was not granted and one compromised agent cannot recruit the others. This is the direct answer to DeepMind's multi-agent collusion category.
None of these tries to make the reasoning model trustworthy. Each one assumes the reader can be fooled, because the research says it can, and ensures that fooling it accomplishes nothing. The reader that sees the attack has no hands. That single sentence is the whole architecture, and it is the sentence three independent research efforts spent 2026 arriving at.
The reframe
The question the field started with, the one that produced years of competing filters, is "how do we make the agent resist manipulation?" The convergence of 2026 is an answer, and it is not the answer anyone hoped for. You do not, not reliably, not inside a single token stream. Organizing a defense around a manipulation-proof agent is organizing around a component the research now says cannot exist.
The better question is this. In our system, is the component that reasons over untrusted content the same one that can act, and if we assume it will be fooled, what does its being fooled actually let it do? If reasoning and acting share one context, the honest answer is "anything the agent can reach," and the six attack categories all have a path. If they are separated, the reader can be fooled all day and touch nothing, because it was never given hands.
The intuitions have stopped competing. Independent groups, from different directions, reached the same rule. The agents that think must never act. Build the boundary the research keeps pointing at, and the manipulation you cannot prevent becomes the manipulation that does not matter.
If you want to check whether your agents keep the reader and the actor in the same hands, book a meeting and bring us the flow with the most agents talking to each other.