Guide
AI agent security: protect tools, data, and permissions
AI agents can call tools, read files, query services, and change application state. Their security depends on the surrounding system: permissions, inputs, integrations, data flow, operator controls, and monitoring.
Map the agent’s trust boundaries
List each model, tool, plugin, MCP server, external API, data store, and identity the agent can reach. Record what information crosses each boundary and which component can take consequential action. Include the model provider and any vendor processing terms in the data-flow review.
Separate trusted instructions from user content and retrieved material. Web pages, documents, issue text, code comments, and tool outputs may contain untrusted instructions. An agent should not treat this content as authority to expand scope, reveal secrets, or run a new action.
Limit tool access and side effects
Give each tool the smallest set of permissions needed for its task. Separate read and write capabilities, scope credentials to individual environments, and use short-lived tokens where possible. Require explicit approval for destructive, externally visible, or high-impact actions.
For security agents, enforce target allowlists outside the model prompt. Apply request limits, network egress controls, timeouts, and a reliable stop mechanism. Log the operator, target, tool invocation, approval, and result without storing unnecessary sensitive data.
Test prompt injection and data leakage
Assess whether untrusted content can redirect the agent or cause it to expose data. Test direct and indirect prompt injection in documents, web pages, repository files, and tool responses. Check whether secrets appear in model context, logs, output, or generated reports.
Red-team the full workflow rather than the model in isolation. An application can be vulnerable because of an overly broad integration even when the model itself rejects an unsafe request. Use a controlled environment and seeded test secrets to observe behavior safely.
Monitor, contain, and recover
Keep structured logs that let responders reconstruct the sequence of instructions, tool calls, approvals, and state changes. Detect unusual access, repeated failures, and unexpected tool combinations. Ensure there is an owner who can revoke credentials, disable an integration, and stop execution quickly.
Create a response plan for exposed secrets, unauthorized actions, and data sent to an unintended service. Rotate credentials and preserve relevant audit records. Reassess the system when models, tools, prompts, or access policies change.