Securing AI agents

Key takeaways

1Treat everything an agent reads as untrusted input: indirect prompt injection through emails, documents and web pages is the defining attack on agents.
2Give every agent its own identity and the narrowest permissions that work. An agent should never hold more access than the person it acts for.
3Red-team the whole system, model, tools, memory and data, before production and after every significant change.

What changes with agents

A chatbot can only say something wrong. An agent can do something wrong: send money, change records, email customers, run code. It plans, calls tools, keeps memory and increasingly talks to other agents, often through standard connectors such as the Model Context Protocol (MCP). Each of those is a new path for an attacker.

The OWASP Top 10 for Agentic Applications

Published by the OWASP GenAI Security Project in December 2025, this is the first community taxonomy of agent-specific risk.

ASI01 Agent goal hijack: instructions hidden in content the agent reads redirect what it is trying to do.
ASI02 Tool misuse and exploitation: legitimate tools used in harmful ways or with harmful parameters.
ASI03 Identity and privilege abuse: agents inheriting or escalating access they should not have.
ASI04 Agentic supply chain: compromised models, plugins, tools or MCP servers.
ASI05 Unexpected code execution: agents generating and running code an attacker influenced.
ASI06 Memory and context poisoning: corrupting what the agent remembers or retrieves.
ASI07 Insecure inter-agent communication: spoofed or tampered messages between agents.
ASI08 Cascading failures: one agent's error amplified across a chain of agents and systems.
ASI09 Human-agent trust exploitation: people over-trusting an agent's confident output.
ASI10 Rogue agents: agents acting outside their intended scope.

Controls that work

Identity: a distinct, auditable identity per agent, with short-lived credentials, never a shared service account or a user's own token passed through.
Least privilege: scope every tool to the minimum (read-only where possible, limits on amounts and recipients), and require human approval for irreversible or high-value actions.
Input handling: separate instructions from data, label untrusted content, and filter or constrain what retrieved content can trigger.
Output handling: validate tool calls against policy before execution; treat model output as untrusted when it reaches other systems.
Isolation: run code execution in sandboxes; segment agents' network access.
Monitoring: log every prompt, tool call and decision so incidents can be reconstructed and anomalies caught.
Supply chain: vet and pin models, tools and MCP servers like any other dependency.
Red-teaming: test with adversarial content in every channel the agent reads, not just the chat box.

For language-model applications generally

The OWASP Top 10 for LLM Applications (2025 edition) remains the baseline: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. MITRE ATLAS catalogues real-world attack techniques against AI systems for threat modelling.

Sources

General information, not legal or regulatory advice. Standards and deadlines move; check the primary source before relying on a date.

Securing AI agentsSecuringAIagents