On August 4, 2026, Cloudflare gave AI agents an identity and a wallet. Accounts get a stable web address that works as an ID, owners extend that identity to specific agents, and a merchant receiving a request can see exactly who authorized it. Matthew Prince framed it in one line: when an agent shows up at your door, you need to know who sent it.
He's right that you need to know. He's describing a solved problem.
Okta and Anthropic shipped the enterprise version of the same thing weeks earlier — Cross App Access and ID-JAG went stable in MCP on June 18, 2026, and Claude managed agents now import into Okta's directory with human owners attached. That is real authorization engineering. Scoped token exchange, centralized policy, lifecycle governance, revocation that actually revokes.
Every one of those controls answers the question who. None of them answers the question that decides whether the transaction should happen.
Authentication ≠ Authorization. Every identity engineer knows that one.
Authorization ≠ Intent. That's the term the industry stopped one short of, and it's where the entire attack class lives.
A prompt injection that triggers a purchase is authenticated, authorized, in policy, correctly attributed, and signed by the owner. Every control in the stack returns true. It's still not what the owner asked for. The signature is valid and the intent is forged, and no identity layer built on top of a language model can tell those two apart, because the thing being forged never passes through the identity layer at all.
I keep seeing people reach for SQL injection as the analogy. I've used it myself. It's the wrong one — or rather, it's the comfortable one, because it comes with a happy ending. Parameterized queries exist. The comparison that actually fits is one where the fix shipped in silicon, worked exactly as designed, and still didn't end the class.
What the NX bit actually was
Before 2003, an x86 CPU could not tell a string from shellcode. Both were bytes in a page. Overflow a stack buffer, overwrite the saved return address, point it at your own bytes, and the processor executed your text — not because anything was misconfigured, but because nothing in the architecture marked those bytes as non-executable. The page table had a read bit and a write bit. There was no third bit.
The fix was not better input validation, and it was not a scanner. PaX shipped NOEXEC emulation in 2000. AMD put a real permission bit in hardware with Athlon 64 in 2003 — bit 63 of the page table entry, enabled through bit 11 of the EFER MSR. Intel shipped the same thing as XD. Microsoft turned it on for consumers as DEP in XP SP2 in 2004.
The mechanism matters more than the date. The MMU checks that bit on instruction fetch. The check is a comparator. It is boolean, it runs on every fetch, it has no training distribution, and it produces zero false negatives. It does not evaluate the bytes. It does not care what they mean, how convincingly they're written, or what surrounds them. Page says no execute, fetch faults. That is what a security boundary is.
Now hold that definition next to what an LLM has.
The context window is pre-NX memory
A context window is flat, homogenous address space. System prompt, user turn, retrieved document, tool output, a paragraph from a scraped webpage — one sequence, one embedding space, one attention mechanism conditioning on all of it. There is no privilege bit per token. There is no fetch-time check. There is a very good next-token prediction over the whole thing.
This is no longer just my framing. In June 2026, "On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models" (arXiv:2606.27567) proved that perfect prompt injection prevention is impossible inside shared-embedding architectures that lack enforced control-data separation. The proof rests on three results: shared representations prevent reliable origin classification, untrusted content enters control-relevant computation through shared attention, and finite training cannot certify encoding invariance across infinite semantic-equivalence classes. The paper places prompt injection in the same lineage as buffer overflows, and lists the same defensive sequence — bounds checking, stack canaries, ASLR, NX, control-flow integrity — as the model for what containment looks like.
So the diagnosis is now formal. Which raises the operational question, and it's the only one I care about: where is the bit?
The labels already exist. Labels were never the hard part
The reflexive objection is that plenty of people are working on exactly this. True, and worth being specific about, because the specificity is what kills the objection.
OpenAI's instruction hierarchy (Wallace et al., 2024) trains models to prefer system-level instructions over content that arrives lower in the stack. Microsoft's spotlighting marks untrusted spans so the model can recognize them. StruQ (USENIX Security 2025) enforces a structured query interface with separate prompt and data channels. SecAlign (CCS 2025) fine-tunes against preference pairs to make injected instructions less attractive than legitimate ones. ASIDE (arXiv:2503.10566) goes furthest — it applies a fixed 90° orthogonal rotation to data-token embeddings, giving the model explicit role information from the first layer, with no extra parameters and no safety fine-tuning required.
ASIDE is genuinely an architectural element, and it's the closest thing in the literature to the shape of the thing I'm asking for. It still isn't the bit.
Every one of these produces a label. Not one produces an enforcement mechanism. The label says "these tokens are data." What consumes the label is attention — weights fit to a distribution. So the boundary holds where inputs resemble training data and degrades where they don't, and the degradation curve is an attacker's search space.
That's not a theoretical worry. ASTRA (arXiv:2507.07417) attacks the attention matrices directly rather than optimizing over token strings, and takes SecAlign and StruQ — both hardened against GCG and AdvPrompter — to attack success rates as high as 70% with a modest token budget. The defenses did not fail because they were sloppy. They failed because the separation they enforce is expressed in the same weights the attacker is optimizing against.
Here is the whole point in one comparison. NX is a comparator you cannot argue with. Instruction hierarchy is a disposition you can argue with, and gradient descent argues very well. A boundary that moves under optimization pressure is not a boundary. It is a filter with a good pass rate, and pass rates are what attackers price.
That's the answer to the title. There is no NX bit. There are five good proposals for a label, one formal proof that the label can't be enforced inside the representation, and one attack that walks through the best-labeled defenses at 70%.
And NX is the optimistic case
NX worked exactly as designed, and it did not end memory corruption — it ended one technique. Attackers stopped bringing their own code and started chaining code the defender had already marked executable: ret2libc in 1997, generalized as return-oriented programming at CCS 2007, with W^X holding perfectly throughout. The agentic version of that move is already available, because an attacker doesn't need their text treated as an instruction — they need it believed as a fact, and a fact is exactly what every separation defense is built to let through.
I've given that class its own treatment in Return-Oriented Prompting, including the gadget taxonomy and why current benchmarks score it as a failed attack. For this article, one implication is enough: the bit everyone is waiting for is necessary and it is not sufficient, and the precedent for that claim is the last time the industry shipped a real one.
So what did Cloudflare and Okta actually ship
Against that, look at the announcements again.
The identity half is not security. It's attribution, and it's being sold in security's vocabulary — trust, accountability, knowing who you're dealing with. Attribution tells a merchant which human is behind an agent. It says nothing about whether that human wanted this.
The real control in the Cloudflare release is the boring half nobody quoted: spend caps and merchant whitelists. Those live outside the model. They're comparators. Injection can burn the cap and cannot exceed it, and no amount of persuasive text moves a merchant off the list. That is the correct architecture — the model proposes, something deterministic disposes. It's also the shape of the serious system-level work in the literature: CaMeL (Debenedetti et al., 2025), FIDES (Costa et al., 2025), and Composable Trust (arXiv:2607.13149, July 2026), all of which enforce policy outside the language model rather than inside it.
The problem is granularity. A dollar limit and a merchant list, against an action space the size of the web. That's chmod 700 on one directory and calling the host hardened.
The inversion
There's a second-order effect that I haven't seen anyone price, and it's the reason I stopped treating this as merely overhyped.
Identity doesn't just fail to fix the confused deputy. It upgrades the consequences.
Before agent identity, a fraudulent agent transaction was an unattributable event that the merchant or the payment network absorbed. Chargeback exists precisely because human deputies get talked into things and somebody has to eat the loss.
After agent identity, the same transaction is cryptographically attributable to a named principal, executed by an agent that principal registered, inside limits that principal set — and on Cloudflare's rails, settled in stablecoins with no chargeback path. Every dispute process on earth reads a valid signature as evidence of intent.
We built non-repudiation on top of a decision procedure that is remotely programmable by anyone who can place text in its context. That is not a neutral addition. It moves a security failure into the liability column and removes the one control that historically protected people from deputies who got talked into things.
What a real bit would need
Being against something is cheap, so here's the specification I'd hold a claimed solution to. Four properties:
- Provenance is carried, not inferred. Trust level attaches at ingestion — at the fetch, the tool call, the retrieval — and travels with the content. Any design where the model classifies what it's looking at has already lost, because classification is the thing under attack.
- Enforcement lives outside the weights. A comparator, not a disposition. If the check can be improved by fine-tuning, it can be defeated by optimization. Composable Trust (arXiv:2607.13149) is the closest existing instantiation — a deterministic monitor outside an unmodified model, binding operations to the highest integrity ring, with a proved boundary that holds under adaptive red-teaming and a measured genuine-leak defended rate of 27% to 94%.
- The check fires at the action boundary. Token-level labeling is the wrong altitude. The security-relevant event is the effectful call, and the decision to permit it has to be made by something that is not a language model. CaMeL and FIDES have this shape.
- It has to survive the reuse move. Trust must attach to asserted facts, not only to instructions. This is the unsolved one, and properties 1–3 are worth very little without it.
Nothing shipped this summer satisfies more than one of those. Cloudflare's spend caps satisfy the second and a thin slice of the third. That's it.
The reason the analogy runs out
The NX bit worked because the CPU has no opinion about what the bytes mean. That indifference is the whole mechanism. Execution is a property the hardware grants, never a property the content earns.
A language model's entire function is to have an opinion about what the bytes mean. Meaning is the product. You cannot mark a reader non-executable.
Which lands where my work has been pointing for years. Models learned language from people, and inherited the trust reflexes encoded in it — authority, urgency, social proof, the assumption that a stated fact arrived in good faith. Social engineering and prompt injection are the same attack class on different substrates.
Humans don't have an NX bit either. That's not a coincidence, and it's not a metaphor. It's why the class transferred in the first place, and it's why identity infrastructure — the badge, the verified name, the audit trail — has never once stopped a good pretext from walking through the front door of a building.
We just issued badges to the agents.
Frequently Asked Questions
Is prompt injection just SQL injection for LLMs?
No — and that's the comfortable-but-wrong analogy. SQL injection has a real fix (parameterized queries). The closer precedent is the NX bit: a fix that shipped in silicon, worked exactly as designed, and still didn't end the class. Prompt injection lives in a shared-embedding space with no enforceable control/data boundary, which arXiv:2606.27567 proves cannot be closed inside the representation.
Does giving AI agents an identity (Cloudflare, Okta) stop prompt injection?
No. Identity answers who authorized a request; it never answers whether the request is what the owner intended. A prompt-injected purchase is authenticated, authorized, in-policy, correctly attributed, and owner-signed — every control returns true, and the intent is still forged. Worse, cryptographic attribution moves the loss into the liability column and removes the chargeback path that used to protect deputies who got talked into things.
Why isn't instruction hierarchy (or spotlighting, StruQ, SecAlign, ASIDE) enough?
Each produces a label, not an enforcement mechanism. What consumes the label is attention — weights fit to a distribution — so the boundary holds where inputs resemble training data and degrades where they don't. ASTRA optimizes against those weights directly and walks the best-labeled defenses at up to 70% ASR. A boundary that moves under optimization pressure is a filter with a good pass rate, not a comparator.
What would a real 'NX bit for LLMs' require?
Four properties: provenance carried at ingestion (not inferred by the model), enforcement outside the weights (a comparator, not a disposition), the check firing at the action boundary (not token-level), and — the unsolved one — trust that attaches to asserted facts, not only to instructions. Nothing shipped so far satisfies more than one; Cloudflare's spend caps cover #2 and a sliver of #3.
References
- Cloudflare, "Cloudflare gives AI agents an identity and a wallet," press release, August 4, 2026.
- Okta, "Okta becomes a featured identity provider powering secure AI agent connections for Claude Enterprise," June 2026. MCP enterprise-managed authorization (XAA / ID-JAG) stable June 18, 2026.
- "On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models," arXiv:2606.27567, June 2026.
- Zverev, Kortukov, Panfilov, Volkova, Tabesh, Lapuschkin, Samek, Lampert. "ASIDE: Architectural Separation of Instructions and Data in Language Models," arXiv:2503.10566.
- "May I Have Your Attention? Breaking Fine-Tuning Based Prompt Injection Defenses Using Architecture-Aware Attacks" (ASTRA), arXiv:2507.07417.
- "Composable Trust for Language Models: A proven boundary and a measured defense." arXiv:2607.13149, July 2026.
- Chen et al. "StruQ: Defending Against Prompt Injection with Structured Queries," USENIX Security 2025.
- Chen et al. "SecAlign," CCS 2025.
- Wallace et al. "The Instruction Hierarchy," 2024.
- Hines et al. "Defending Against Indirect Prompt Injection Attacks With Spotlighting," Microsoft, 2024.
- Debenedetti et al. "CaMeL: Defeating Prompt Injections by Design," Google DeepMind, 2025.
- Costa et al. "FIDES," Microsoft, 2025.
- Shacham. "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls," CCS 2007.
- Solar Designer, return-into-libc, Bugtraq, 1997.
- OWASP Top 10 for LLM Applications, LLM01: Prompt Injection.