Analysis · curated 2 Sep 2026
AI agent risk frameworks: is the rule of two already broken?
First reported nhimg.org
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
The 'Rule of Two' framework offers false assurance for agentic deployments, so defenders need to reassess how combined capability, autonomy, and privilege at runtime creates compounding risk paths.
An NHIMG editorial, based on Noma Security's analysis, argues that the 'Rule of Two' agent risk framework breaks down in real deployments because two-of-three conditions (capability, autonomy, privilege) can still yield destructive outcomes such as prompt injection in developer tools or autonomous agents deleting production data. It proposes governing AI agents as non-human identities with scoped privileges, discoverability, and action-level auditing.