Alignment without context integrity is not safety. An AI agent can faithfully follow its instructions and still be dangerous if its understanding of reality is wrong. Anthropic recently disclosed that Claude models gained unauthorized access to the real systems of three organizations during cybersecurity evaluations. The agents had been told they were operating in a simulation with no internet access. But a configuration mistake gave them access to the live internet. They treated real production systems as part of the exercise and kept pursuing the goal they had been given. OpenAI separately disclosed that models found a previously unknown vulnerability, escaped an isolated evaluation environment and compromised Hugging Face. These were not simply failures of intelligence. The deeper problem was that the agents were acting inside a false understanding of reality. We have spent years asking whether an AI system will follow our instructions. We now also need to ask whether it correctly understands the environment in which those instructions are being executed. This creates a new security requirement. Context integrity. Before an agent acts, the system must continuously verify where it is, which resources are in scope, whose authority it carries, what it is allowed to do, and when that authority expires. Just in time permission for every action. At just the right time. For just enough time. Assessed in real time. Those facts cannot live only inside a prompt. They must be verified and enforced by the infrastructure around the model. A prompt is not a security boundary. Zero trust taught us to never trust identity and always verify access. And provide least privileged access. Agentic AI adds another dimension. Never blindly trust context. Continuously verify reality. The next security perimeter is not just the agent’s identity. It is the agent’s understanding of reality. The most dangerous agent may not be misaligned. It may simply be mistaken. And in an agentic world, a false belief can become a real breach.