In February 2025, Invariant Labs published a proof of concept that should have ended the consumer AI agent conversation before it began. A shared calendar invitation — nothing more exotic than an .ics file — could hijack Gemini's tool-calling pipeline. The model leaked nothing by accident. No encryption was broken. An attacker simply wrote instructions into a field where the model expected data, and the model complied.
That's the whole attack. Six months later, the enterprise security stack has an answer for this class of problem. Zenity runs agent discovery. Lakera ships guardrails. Operant AI sells runtime protection. Sematext provides observability at roughly $1.68 per host. Discovery, guardrails, runtime interception, observability — a complete quartet, priced, shipping, in production. The consumer stack has none of it. Not a beta. Not a waitlist. Zero.
I've spent the last five months auditing zk-Rollup soundness proofs, and before that four months reverse-engineering the withdrawal engine of a collapsed exchange. The pattern keeps repeating: the market builds the exciting layer, ignores the boring one, then acts surprised when entropy wins. Always check the fees. Always check the guardrails. Nobody checked the guardrails.
Context — The Isomorphism Nobody Wants to Discuss
Here is the mechanical fact that governs everything downstream. A large language model cannot, structurally, distinguish a system instruction from an instruction embedded in external data. Both arrive as tokens. Both occupy the same context window. Both are processed by the same attention mechanism.
This is not a bug in a specific model. It is the architecture.
Compare it to SQL injection. Why did SQL injection become a solved-ish problem? Because we could separate code from data — parameterized queries, prepared statements. The query string and the user input travel separate channels. The database engine knows which is which because engineering forced the distinction at the protocol level. Prompt injection has no equivalent. There is no prepared statement for natural language, because the whole point of an LLM is that it generalizes across the boundary. The moment you build a firewall that reliably separates instruction from data, you have broken the flexibility that made the model useful. You have not fixed the injection. You have crippled the product.
So the honest framing is this: prompt injection is not a vulnerability to be patched. It is a property of the substrate. It can be mitigated, layered, detected. It cannot be eliminated.
That single sentence explains the entire consumer market failure. Every downstream symptom — no tools, no pricing, no telemetry — flows from it.
Now add the agent layer. An AI agent is just a model with permissions. It reads a calendar, sends an email, places an order, unlocks a door. The risk source and the capability source are the same object: the permission to act. You cannot give an agent the ability to execute without also giving it the ability to execute wrongly, or to be tricked into executing wrongly.
Enterprise vendors understood this and built accordingly. Consumer vendors built nothing, because the consumer market's willingness to pay for "mitigation of an unpatched, unprovable risk" approaches zero. That is not a marketing failure. It is a category mismatch.
Core — The Anatomy of a Missing Market
The first thing I check in any audit is where the observation point sits relative to the failure point. If your instrumentation observes a layer above or below where the exploit executes, you will see nothing, no matter how expensive your tooling is.
Consumer security software today — Bitdefender, CUJO AI, the bundled protection in your router — observes the device-level traffic layer. Packets in, packets out. This worked against malware because malware left signatures at that layer. It worked against known-bad domains.
It does not work against prompt injection, because prompt injection happens at the semantic layer. The malicious calendar invite is not malformed. It is entirely well-formed traffic. It is a perfectly legal HTTP request carrying a perfectly legal .ics file that happens to contain instructions the model reads as commands. Device-level monitoring cannot see this, because it has no access to the meaning of the token stream. This is observation-layer mismatch — not a compute problem, not a model-capability problem, an instrumentation problem. And it is the reason a firewall vendor cannot simply pivot into agent security.
When I dissected the MakerDAO MKR collateralization logic back in 2017, I found three integer overflow vulnerabilities that standard audits missed — because the standard audit checked the wrong arithmetic boundary. Same structural error. Wrong layer, clean report, live exploit.
The economics then compound the technical problem. Runtime protection requires calling a classifier or a secondary LLM to judge every single action before it executes. That is a marginal inference cost per action. On-device silicon cannot run it — not at consumer price points, not at consumer battery budgets. Cloud-side classification works, but you now pay per action, per user, forever.
Run the numbers. A DIY base configuration for a home that wants real semantic-layer monitoring runs $60 to $100. Add a managed switch and an OPNsense box and you are near $600. That is the floor for the technically competent. Now imagine a commercial product trying to charge consumers annually for the same capability. If you price below roughly $100 per year, you cannot cover the marginal inference cost. If you price above it, consumer willingness to pay for an invisible risk collapses. That is the pricing paradox. It has no clean solution at consumer scale.
Then the free-alternative squeeze lands on top. Apple's Private Cloud Compute ships platform guardrails. Meta runs a safety VM with human-in-the-loop approval for sensitive actions. Smart-home platforms bundle their own agent harnesses. All of it free, all of it attached. If you have watched consumer antivirus over the last two decades, you already know how this ends. Windows Defender did not out-compete Norton and McAfee on features. It out-competed them on the default. Platform-bundled guardrails will permanently suppress the pricing power of any third-party consumer agent security product. The independent consumer startup window is razor-thin, and it is closing.
My FTX autopsy taught me the deeper lesson here. When I reverse-engineered their routing logic, the failure was not a missing detector. The failure was a missing evidence chain — no auditable trail connecting internal ledger state to external claims. Consumer agent security has exactly the same defect. It is not missing a detection model. It is missing an evidence chain. When an agent mis-orders, mis-opens a door, or mis-executes a payment, there is no signed, replayable record that establishes what instruction triggered the action, what tool was called, and whether the input was adversarial. Without that chain, you cannot build insurance, you cannot assign liability, and you cannot sell remediation.
Which raises the question almost nobody in the space is asking. Who owns the telemetry? Third parties cannot build semantic-layer security without deep behavioral data from the OS or the platform. Apple, Meta, and Google have the data. They have no incentive to open it. This means consumer security is architecturally a platform preserve, not a competitive market. The battleground is data rights, not algorithms. A classifier is not the bottleneck. Telemetry access is the bottleneck.
And here is where the blockchain lens earns its keep, because DeFi has been running agentic execution for years and facing the identical wall. Every MEV bot, every keeper, every autocompounder is an agent with permissions. Every liquidation bot is an agent reading external data as input. When a bot gets sandwiched by a manipulated oracle update, that is prompt injection wearing a different coat — external data read as instruction. And what are we shipping to the consumer? ERC-4337 session keys and account abstraction let an agent execute transactions on the user's behalf with scoped permissions. Beautiful primitive. No consumer tool exists that can tell the user at execution time whether a session-key transaction reflects their intent or an attacker's injected intent. Session keys reduced friction. They also widened the attack surface. Session keys are the consumer agent problem, expressed on-chain, with a private key attached.
The DIY tier on-chain is equally revealing. A self-custodial user who wants real agent safety has to run their own simulation layer, their own transaction decoder, their own mempool watcher. Home Assistant's local-first design in the smart-home world is the analogous path — a genuine third option that is transparent and privacy-respecting, but has no commercial support, no semantic injection detection, and is fundamentally a network-isolation tool, not an agent-security tool. The technically elite patch it themselves. The consumer waits forever. 2017 vibes. Proceed with skepticism.
Contrarian — Maybe the Market Shouldn't Exist
The consensus reading of this gap is a supply failure: vendors haven't noticed the opportunity, and someone should rush in. I think that reading is wrong, and the contrarian case is uncomfortable.
Consider the strongest version of the platform argument. Apple's PCC and Meta's safety VM are black boxes. But black boxes with production guardrails may well deliver more real mitigation than a fragmented ecosystem of unproven third-party detectors. If the platform guardrail is strong enough, then "missing consumer tools" is not a defect — it is evidence the market does not need to exist separately. Safety became a platform feature, the way seat belts became a car feature rather than an aftermarket product.
But there is a catch, and it is fatal to the comfortable version. A black-box guardrail is unauditable. We have no disclosed injection-detection rate, no false-positive rate, no bypass probability for any of these platform harnesses. We are asked to trust a mitigation we cannot inspect, for attacks whose success is invisible. That is not security. That is faith. And faith is exactly the thing that evaporated over four months of reading FTX's internal ledger hunts.
The blind spot is not the missing tool. The blind spot is that the industry has decided the missing evidence chain is acceptable. Everyone is racing to ship the agent. Nobody is shipping the receipt.
Takeaway
The first mass-scale consumer agent incident is not a matter of if but when — a batch of mis-ordered purchases, a remote unlock, a drained session-key wallet. When it lands, the response will not come from a startup. It will come from platforms patching their own black boxes and insurers demanding liability frameworks that do not yet exist. The vulnerability forecast is simple: the attack surface is expanding faster than any instrumentation layer, the semantic layer remains unwatched, and the fees — the real ones, the marginal inference costs nobody wants to quote — will decide who can afford to watch it. Impermanent loss is real. Do your math.