Every vendor threat report says the same thing: attackers now operate at "machine speed." It's true enough to take seriously and vague enough to be useless as a defensive brief. If you want to actually harden a system against LLM-armed adversaries, you have to take the phrase apart — because the seams are where your defense should live, and knowing where the automation is weakest tells you where to cut.
Machine speed is mostly the absence of a human
Start with an uncomfortable fact for the hype: the LLM is the slow part of the attack. A capable model generating a plan runs at tokens per second — blistering next to a human analyst, glacial next to essentially every other component in the stack. The exploit the model writes runs at code speed, but the writing, the adaptation, the re-planning when something breaks, all of it is gated by generation rate. Machine speed comes from removing the human from the loop, not from the model being quick. The model is the bottleneck in the attacker's loop, too.
This is the whole game. Anything that forces the attacker's loop to re-plan — back to the slow reasoning step instead of executing pre-generated code — imposes cost far out of proportion to what it costs you to deploy it. That asymmetry runs in your favor if you build for it.
The reframe: cost per attempt vs. cost per success
The real change LLMs brought is economic. The marginal cost of generating an attack attempt fell to near zero. A competent operator running an uncensored open-weight model on hardware they own pays nothing per iteration, gets no refusals, and leaves no query logs on someone else's server. Enumeration, payload variation, tailored phishing — effectively free and effectively infinite.
You cannot win by making attempts expensive; that battle is lost. You win by keeping two other numbers high: the cost per success, and the visibility of every attempt along the way. Every control below is an argument about one of those two numbers.
Enumeration interacts with everything reachable, without the skepticism a human operator brings.
Deploy deception. Any interaction with a decoy is high-fidelity signal.The tempo that makes automation dangerous is also the property it can't disguise while staying fast.
Instrument velocity. Baseline shape, not signatures.Indirect prompt injection only has purchase where untrusted input can reach a privileged sink.
Decouple reasoning from authorization. Sever the junction.The automation doesn't get suspicious
A human who finds an admin credential in a world-readable file gets a prickle of doubt. An automated loop follows the breadcrumb without hesitation, because skepticism is a judgment call and the loop is optimizing for progress.
This is the best cheap leverage a defender has right now. Honeytokens, canary credentials, decoy hosts, plausible-but-fake records seeded into high-value paths — any interaction is a high-fidelity alert, because nothing legitimate has a reason to touch them. Against a patient human you get an occasional bite; against a machine-speed loop enumerating everything it can reach, deception converts the attacker's own thoroughness into your detection signal. Push it past passive tokens: malformed-but-parseable responses, endpoints that return convincing junk, environment shapes that don't match the attacker's assumptions. Each one forces the loop back to the slow reasoning step. You are spending the one resource the attacker can't buy down — model latency.
Velocity is a signature, not just a capability
The property that makes an automated intrusion dangerous — speed — is also its most reliable tell. A human takes days to move laterally and blends into normal activity. An agent does it in one session, in bursts no person produces.
Instrument for shape, not signatures: authentication attempts per minute, hosts touched per hour, a single principal reaching an unusually wide set of APIs or hosts in one session, data volume against a rolling baseline. None of these depend on recognizing a known payload — which is the point, since the model can vary the payload infinitely but can't disguise the tempo without surrendering the speed that made automation worth it. Force that trade and you win either way: they slow to your detection floor, or they stay fast and trip the burst detection. Contextualize it — a CI/CD pipeline moving fast is expected; a payroll identity suddenly scanning network endpoints is not.
Prompt injection only works where reading meets authority
When the adversarial LLM operates inside your environment — a subverted agent rather than an external attacker — the entire attack surface is one junction: the agent both ingests attacker-controlled content (an email, a web page, a ticket, file metadata) and holds authority to take consequential action. Indirect prompt injection is the SQL injection of this era, and like SQLi it has no purchase unless untrusted input can reach a privileged sink.
The structural defense is to sever the two. The model reasons and proposes; a deterministic policy engine, external to the model, authorizes — using verified contextual facts (which identity, which target, which action class, which destination) rather than the model's own narrative about what it's doing. No amount of persuasion in a retrieved document can talk a policy engine into an action the policy doesn't permit, because the engine never reads the document. Never let raw retrieved text define operational authority. That one rule, enforced architecturally, collapses most of the injection surface.
Every attempt still has to touch your controls
However cheap the model made generating an attack, executing it still passes through your identity boundaries, your egress path, your rate limits. These controls tax the whole loop regardless of how the attack was produced, and they don't care whether a human or a model is on the other end.
- Identity boundaries. Phishing-resistant authentication (FIDO2/WebAuthn, passkeys) for privileged roles first, then broadly. Fluent, personalized lures make "the user will spot the phish" a losing bet — so make a phished password insufficient by construction.
- Least authority per agent. Dedicated, scoped, short-lived identities. Read-only by default, with write scopes granted per workflow and revocable independently. No inherited host permissions, no roles pooled across workflows.
- Egress as a checkpoint. Block direct egress to internal metadata services, route external traffic through a monitored proxy, allowlist destinations, log every fetch. Exfiltration and command-and-control both cross this line.
- Friction on unauthenticated endpoints. Login, recovery, registration, discovery. Rate limits, quotas, progressive delays, behavioral challenges — cheap to deploy, and they punish the high-volume automated actor while barely touching a legitimate user.
None of this is new. That's the reassuring part: the fundamentals were always the fundamentals. What changed is that sloppy execution used to be survivable because attacks were slow and hand-made — and now it isn't.
Actions are recoverable; intent is only recoverable if you kept the context
When you get hit, your response depends on what you logged before you knew you'd need it. Structured, integrity-protected action logs — agent identity, tool invoked, parameters, target resource, authorization decision — are the system of record. That much is standard.
The part that gets dropped and shouldn't: retain the input context alongside the actions. The action log tells you what the agent did; the retrieved email or page that carried the injection tells you why. Without it you can reconstruct the sequence but not the cause, and you can't build a detection for the next instance of the same attack. Log actions as the primary record — but keep the context that produced them, or your responders will spend the postmortem reconstructing the one thing you chose not to save.
Strategic control framework
The seams above become a small, boring set of controls. The value is in enforcing them consistently, not in novelty.
| Control domain | Primary mechanism | Implementation focus |
|---|---|---|
| Identity & auth | Phishing-resistant MFA | FIDO2/WebAuthn and short-lived credentials; make password possession alone insufficient. |
| Agent authorization | Least privilege, scoped creds | Narrow, read-only-by-default identities; write scopes per workflow; no shared host credentials. |
| Egress management | Controlled outbound routing | Block internal metadata endpoints; force external traffic through a monitored, allowlisted proxy. |
| Endpoint protection | Automated abuse controls | Rate limits, progressive delays, and session reputation on unauthenticated endpoints. |
| Forensic telemetry | Structured action logging | Normalized action events (actor, tool, target, authz result) with input provenance preserved. |
Tiered defensive architecture
If you find yourself wanting a reasoning model's verdict on every tool call in real time, that's the signal you've put judgment where you needed a rule. Structure the pipeline by latency tolerance instead — fast deterministic hands in the path of every action, models off to the side where a second of latency is affordable.
The defender's asymmetry, and how to stop giving it away
Here's the trap. The attacker runs an uncensored local model: no refusals, no rate limits, no cost, no logging. The defender reaches for a frontier hosted model to analyze malware or reason about attacker tradecraft — and eats latency, per-call cost, rate limits, and periodic refusals on exactly the defensive analysis they need. We hand the attacker a tempo advantage on our own work.
Stop doing that. Standardize sensitive, high-volume defensive tooling on self-hosted open-weight models: log triage, prompt-injection classification, first-pass detection. You control them, fine-tune them on your own telemetry, run them air-gapped, and no external layer refuses to reason about offensive material when that reasoning is the job. Reserve frontier models for genuinely hard, low-volume triage where their ceiling earns the latency. The threat that matters isn't the branded forum product (WormGPT and its endless successors are mostly scams and thin wrappers) — it's a competent operator fine-tuning a capable open model on offensive material, iterating for free on hardware they own. Meet that with the same freedom on your side.
The line to engineer to
Every weak point above is a place where the attacker's automation, for all its speed, is more brittle, more visible, or more contained than a patient human would be. Machine-speed enforcement has to be automated, because human review cannot keep pace with the volume. But the policy that enforcement carries out still has to be written by people who understand the blast radius.
Get that division right — humans set the rules, machines enforce them without tiring, and every consequential action leaves a record — and you've built the environment where compromising any single credential, box, or agent stays contained by design. That's the whole objective. The rest is execution.