Security firm ARMO published research this month arguing that a specific blind spot in agent guardrails lets injected instructions through undetected. The company’s proposal centers on what it calls a precedent gap: a tool call, or an argument inside one, that nothing in an agent’s own prior activity would explain.
The stakes are structural rather than incremental. Most production agents already run some form of input review and some form of action review. ARMO’s argument is that having both is not the same as covering the sequence between them, and that gap is exactly where a hijacked call can originate.
An AI agent typically works in a loop: it reads something, decides what to do, then calls a tool and reads the result before deciding again. Guardrail vendors have built two kinds of checks into that loop. One inspects content as it enters the agent’s context, before any decision gets made. The other inspects a proposed action against the user’s original request, once a decision has already been reached. Each check does real work, but each looks at a single instant, and the instants are different.
That leaves the interval in between effectively unwatched. A result returned by a tool the agent itself just called lands in its context and, within the same turn, feeds the next decision the agent makes. The content check already ran, on the result alone, with no visibility into what call would follow it. The action check has not run yet, and when it does it sees the new call on its own, cut off from whatever result prompted it. Neither check spans both halves.
This is where an original framing worth stating plainly comes in: agent frameworks largely inherited the old assumption that whatever a tool hands back is inert data, not something that can steer behavior. That assumption held when tools returned numbers, timestamps, and status codes. It stops holding once tools return free-text fields that anyone outside an organization’s trust boundary, a customer, a contractor, an inbound email parser, can populate. A support ticket, a pull request description, or a CRM note can carry adversarial instructions the same way a malicious web page can, except it arrives through a channel the agent already treats as its own.
ARMO’s proposed fix does not try to classify content as malicious before the fact. Instead, it treats each agent’s history, which tools it has called, with which arguments, in what order, as a baseline of normal behavior. A tool call that has no basis in that history, or a familiar tool suddenly invoked with an argument the agent has never used before, becomes the detectable signal, regardless of how the instruction that produced it got into the context window. An agent that has read internal tickets for months and then queries a customer database for the first time would trip that baseline even if no one could point to the exact sentence that caused it.
This is a security vendor writing about a class of attack that its own product is built to catch, and the framing should be read with that commercially motivated angle in mind. That does not make the underlying observation wrong. The screens ARMO describes, content classifiers and action checks against user intent, are real and widely deployed, and the timing gap between them is a legitimate architectural point independent of who is making it. What ARMO calls a precedent gap is a proposal for closing that gap, not a validated standard that other vendors or independent researchers have confirmed at scale.
For teams running agents with access to internal systems, ticket queues, code repositories, customer records, the practical takeaway is to inventory which tools an agent can call and which of their return fields accept free text from outside the organization. Pair that list against which tools can change state, send data externally, or touch credentials. Agents that combine both are the ones where a coerced call does the most damage, and they are the ones worth instrumenting first with some form of behavioral baseline, whether from ARMO or another vendor, rather than relying solely on content filters that were never built to see the call a piece of text eventually causes.
Ben Hirschberg detailed the precedent-gap concept on ARMO’s company blog on September 6, 2026.
