When Your Auditor Doesn't Have a Category for Prompt Injection

In August 2025, Michael Bargury demonstrated zero-click attacks against enterprise AI agents at Black Hat USA. An attacker needs only a user's email address to hijack ChatGPT, Microsoft Copilot, Salesforce Einstein, or Google Gemini sessions. Hidden instructions in harmless-looking emails can replace banking details, launch phishing campaigns, or extract sensitive data—without the victim opening the malicious email.

Some vendors patched the vulnerabilities. Others declined, citing them as intended functionality.

Here's the problem: these attacks don't map to any compliance framework auditors recognize. Prompt injection, RAG poisoning, citation manipulation—these threats were invented last year. The standards auditors use to verify compliance predate them by decades.

Bargury, CTO and co-founder of Zenity, is building infrastructure to close that gap. What he's actually built: a framework that breaks down novel AI threats into components that map to established security standards—making them auditable using frameworks that already exist.

Breaking Down Attacks That Didn't Exist in Compliance Documentation

Bargury leads the OWASP Low-Code/No-Code Top 10 project and contributed to the MITRE ATLAS framework. In October 2024, his team launched the GenAI Attacks Matrix —a framework that documents AI-specific attack techniques and maps them to standards auditors already understand.

By March 2025, MITRE ATLAS had incorporated eight new attack techniques and four sub-techniques from Zenity's work, including a case study on financial transaction hijacking through Microsoft 365 Copilot. The framework breaks down attacks that didn't exist in compliance documentation into specific techniques that map to OWASP and MITRE categories.

An auditor asking about SOX compliance gets documentation showing how the system prevents AI agents from making unmonitored changes. A GDPR review gets evidence that agents access only necessary data with enforced least privilege. The threats are new. The categories they map to aren't.

What Happens When the Auditor Shows Up

Organizations deploy agents faster than security frameworks evolve. Bargury compared the current state to "being back in the '90s"—irrational exuberance for innovation outstripping security maturity.

The operational challenge: you can show an auditor your agent's prompt instructions and RAG retrieval logs. But their checklist doesn't have a category for "prompt injection prevention" or "RAG poisoning mitigation." They're looking for evidence of least-privilege access, input validation, audit trails—concepts that predate AI agents.

Without a mapping between what your agents actually do and what the compliance framework expects to see, you can't demonstrate compliance even when you're handling risks properly.

The gap between "our agents work reliably" and "here's evidence that satisfies your SOC 2 audit" is real infrastructure work.

The Translation Layer Enterprises Actually Need

At TinyFish, we've seen this challenge firsthand. When you're building enterprise web agent systems that handle sensitive data across thousands of sites, trustworthiness means proving to auditors that you're handling risks properly using frameworks they understand. You can defend against novel threats all day. But if you can't prove it using standards auditors recognize, you're stuck.

Bargury's framework mapping solves a specific production problem: legibility. Organizations need infrastructure that makes novel threats auditable using existing governance structures. He's breaking down attacks into components that map to standards auditors already understand—not waiting for compliance frameworks to catch up, not inventing new ones.

You can't wait for compliance frameworks to evolve at the pace of AI threats. Bargury is building the infrastructure that makes AI agents governable using the standards that already exist.