AI agent vulnerabilities are fundamentally trust boundary failures, not model or tool failures. When a language model decides at runtime which tools to call with what arguments, classic security assumptions break down. Four major attack vectors are examined: prompt injection via tool results, identity spoofing in agent-to-agent calls, budget bombs from runaway loops, and tool poisoning via MCP server drift. The post argues that trust boundaries must be enforced by infrastructure, not developer convention. Portkey's Agent Gateway, MCP Registry, and LLM Gateway are presented as complementary controls covering identity propagation, capability scoping, quota enforcement, and runtime guardrails — integrated with Palo Alto Networks Prisma AIRS. A defense matrix maps each attack type to the controls that block or detect it.
