Your AI stack as a human body: why stopping at LLM + RAG leaves it without an immune system

There is a simple way to understand an AI stack: as a human body. The language model is the brain, RAG is the brain with a library, MCP is the nervous system, skills are muscle memory and the agent is the brain with hands. The analogy works, but it is missing one organ, the one behind almost every incident we see in our AI audits: the immune system. Most companies build the first two layers and stop. The ones that keep going plug in tools and automate actions with nothing in place to detect, isolate or stop an attack. This article walks the five layers, the typical weak spot of each according to the OWASP Top 10 for LLM Applications 2026, and the check-up worth doing before building further.

The language model only knows what it learned in training and what you put in its context. It is where almost every company starts: an assistant to draft, summarize or answer questions.

Retrieval-augmented generation (RAG) looks up your documents before answering and grounds the answer in your own data. It is the natural second step and, for many companies, the last one.

The Model Context Protocol (MCP) is an open standard for connecting AI applications to files, databases, APIs and tools; its authors describe it as the USB-C port for AI. This is where the stack stops merely answering and starts touching real systems.

A skill is a folder with an instructions file that the agent loads only when a task needs it; it is an open format already adopted by several products. It is convenient: repeated know-how is packaged and versioned.

The agent plans the steps and uses tools to act, not just to answer. It sends email, opens tickets, changes records and runs commands. It is the layer with the most value and the most consequences.

A body with a brain, a library, nerves, muscle memory and hands, but no immune system, does not survive the first infection. In AI the immune system is AI security and governance: knowing which AI exists in the company, what each layer can touch, testing it in a controlled way and having rules and owners. The fact that excessive agency climbed to third place in the OWASP Top 10 2026 says a lot about where incidents are heading. This is how T.I. RESCUE covers it: