AI agents differ from earlier AI assistants in one important respect: they act. An agent might read email, query databases, update records, call external services or write and run code. That capability is what makes agents valuable, and it is also what makes them a new kind of security concern. A compromised chatbot gives a bad answer; a compromised agent can take a bad action.
Security teams therefore need to treat agents as a new class of actor in their environment — one that is neither a conventional application nor a human user.
Understand the threat landscape
Several risks are specific to, or amplified by, agentic systems:
- Prompt injection. Malicious instructions hidden in content the agent reads — a web page, a document, an email, a support ticket — attempt to redirect its behavior. Indirect injection through retrieved content is especially hard to spot.
- Excessive agency. Agents granted broad permissions or powerful tools can cause significant harm through error or manipulation, even without a malicious actor.
- Data exfiltration. An agent with access to sensitive data and the ability to send messages or call external services can be manipulated into leaking information.
- Tool and supply chain risk. Third-party tools, plugins and connectors may be vulnerable or malicious, and their descriptions can themselves carry injected instructions.
- Identity and privilege confusion. It may be unclear whether an agent acts with its own permissions or those of the user who invoked it, creating opportunities for privilege escalation.
- Unreliable outputs. Agents can misinterpret instructions or produce plausible but wrong results, leading to incorrect actions that look legitimate.
Resources such as the OWASP guidance on risks in large language model applications and the NIST AI Risk Management Framework provide useful reference points for structuring this analysis.
Apply least privilege rigorously
The most effective control is limiting what an agent can do in the first place:
- Give each agent its own identity, distinct from human users and other services
- Grant only the tools and data access needed for its defined task
- Prefer narrow, purpose-built tools over general ones — a tool that updates one field is safer than one that runs arbitrary queries
- Scope credentials tightly and use short-lived tokens
- Where an agent acts on behalf of a user, ensure it can never exceed that user's own permissions
Put humans at the right control points
Not every action needs approval, but some always should. Classify actions by impact and reversibility. Reading information and drafting content may proceed automatically; sending external communications, moving money, changing access rights or deleting data should require explicit human confirmation.
Approval steps only work if reviewers can understand what they are approving. Show the proposed action, the reasoning behind it and the data involved, in plain language. Watch for approval fatigue: if reviewers are asked to confirm too many low-risk actions, they will start approving without reading.
Treat all external content as untrusted
Design on the assumption that any content an agent reads may contain hostile instructions. Practical measures include separating trusted instructions from untrusted content in how prompts are constructed, filtering and validating inputs and outputs, restricting the destinations to which agents can send data, and preventing agents from acting on instructions that originate in retrieved content without confirmation.
No single technique is fully reliable against prompt injection today, so layer several. The goal is to ensure that even a successful injection cannot reach a high-impact action without passing another control.
Monitor, test and respond
Agents need the same operational security discipline as any production system, and then some:
- Log every step — prompts, tool calls, parameters, outputs and approvals — in a form that supports investigation
- Monitor for anomalies, such as unusual tool usage, access to unexpected data or sudden spikes in activity
- Red-team before launch and regularly after, including prompt injection scenarios that reflect your real data sources
- Maintain a kill switch that can suspend an agent or revoke its access immediately
- Include agents in incident response plans, with clear owners and playbooks
Governance that keeps pace
Bring agents into your AI inventory and risk-tiering process, recording the tools, data and permissions each one holds. Review these as the agent evolves, because scope tends to grow over time as teams add capabilities. Make a security review a standard step before an agent's autonomy or reach is expanded, and retire agents and credentials that are no longer needed.
Agents can deliver substantial value. Organizations that build security into their design from the start will be able to extend that value with confidence, rather than discovering the gaps after an incident.
Planning to deploy AI agents securely? Talk to our AI governance and engineering teams.
