Guide

AI Agent Security.

Why agents introduce failure modes traditional software doesn't have, the real threat model — prompt injection, excessive permissions, data leakage — and the defenses that work.

01. Why Agent Security Is Different

Traditional software has a fixed set of code paths — an attacker has to find a bug to make it do something it wasn't designed to do. An agent's behavior is determined at runtime by a model reasoning over whatever input it's given, including input an attacker controls. That's a fundamentally different attack surface, and treating it like a normal application security problem misses the parts that actually matter.

The core shift: in traditional software, untrusted input can corrupt data. In an agentic system, untrusted input can corrupt decisions — and those decisions can trigger real actions on real systems.

02. The Threat Model

  • Prompt injection — instructions hidden in retrieved documents, emails, or web content that attempt to redirect the agent's next action.
  • Excessive permissions — an agent with broader tool access than its actual task needs, turning a narrow failure into a wide one.
  • Data leakage — sensitive information from one context surfacing in a response or action where it shouldn't, especially across multi-tenant retrieval systems.
  • Compounding error — a wrong interpretation early in a multi-step run that the agent treats as fact for every step after it, producing a confidently wrong outcome.
  • Tool and supply-chain risk — a compromised or misconfigured third-party tool the agent calls, which extends your attack surface to that tool's own security posture.

03. Core Defenses

  • Least-privilege tool scopes — grant exactly what the workflow needs, nothing "just in case."
  • Treat all retrieved and user-supplied content as untrusted input, the same way a web application treats form submissions.
  • Keep irreversible or externally visible actions behind human approval until the agent has a long track record.
  • Log every action, input, and output for audit and incident review — not just final outcomes.
  • Run regression evaluations before any prompt, model, or tool change ships to production.
  • Have the agent state its interpretation of ambiguous input before acting on it, and route low-confidence cases to a human.

These map directly onto the governance practices in our generative AI for business guide — security and governance are the same discipline applied to the same risk.

04. Checklist Before Production

  • Every tool the agent can call is scoped to the minimum access that workflow requires.
  • Every irreversible action has a human approval gate, or an explicit, documented reason it doesn't.
  • Retrieved and user-supplied content is treated as untrusted at every step, not just the first one.
  • Logs capture the full decision trail, not just the final output.
  • A regression suite runs automatically before any prompt, model, or tool change reaches production.

Fewer than four of these covered is a signal to slow down before granting the agent live access, not after.

05. Frequently Asked

What is prompt injection in the context of AI agents?

It's when untrusted content the agent reads — a retrieved document, an incoming email, a web page — contains instructions crafted to hijack the agent's next action. Because an agent acts on what it reads, a successful injection isn't just a bad response, it can be an unauthorized action. Treating every piece of retrieved or user-supplied content as untrusted input is the primary defense.

Can an AI agent be given too much access?

Yes, and it's the most common security mistake in early deployments. The instinct is to grant broad access so the agent 'can handle anything,' but every tool it can call is part of its attack surface. Scope access to exactly what the specific workflow needs, and expand it deliberately as the workflow grows — not upfront as a convenience.

How do you audit what an AI agent did?

Log every action, input, and output the agent produces, not just the final response. When something goes wrong, you need to reconstruct the exact sequence of tool calls and decisions that led there — a summary log of 'agent completed task' isn't enough to investigate an incident.

Cloudz Computing builds agents with least-privilege access and full audit trails from the first deployment, not retrofitted after an incident.

Request a private consultation