AI Agent Security: What to Check Before Launch
AI agent security is about limiting what an agent can reach, what it can do and how much harm results if it gets tricked. You should assume that it will make mistakes and that someone will eventually try to manipulate it. Then design so that neither causes serious damage.
This differs from securing a chatbot. A chatbot produces text, while an agent has credentials and tools, so a bad decision can become a real action.
The main risks
Prompt injection. An agent reads text from emails, documents and web pages. Attackers can hide instructions in that text, and a model can't reliably tell them apart from yours. For example, a support email could contain a hidden instruction to forward customer data.
Excessive agency. OWASP uses this name for what happens when an agent has too much functionality, too many permissions or too much autonomy. It's what turns a mistake into an incident.
Data leaks. An agent may reveal information to someone who shouldn't see it, especially if it holds broader access than the person it's serving.
Unsafe tools. Every tool or connector you add, including third-party ones, is new code your agent trusts.
Runaway actions. A loop can repeat an action many times, or run up a large bill, before anyone notices.
Pre-launch checklist
Identity and access
- The agent has its own identity, not a shared admin account
- It has only the permissions this job requires
- It acts with the permissions of the user it serves, where relevant
- Secrets are stored outside prompts and can't be read by the model
- Credentials are short-lived and can be revoked quickly
Untrusted content
- Everything the agent reads from outside is treated as untrusted
- Agents that read untrusted content have limited ability to act or send data out
- You've tested with hidden instructions in realistic emails and documents
Actions and limits
- Limits are enforced in code, not only in the prompt
- Inputs to tools are validated before the action runs
- High-impact actions need human approval
- There are caps on steps, spend and time per task
- Any code the agent generates runs in a sandbox
Visibility and response
- Every read, decision and action is logged
- Unusual behavior triggers an alert
- A person can shut the agent off quickly
- You know who gets called when something goes wrong
Tools and vendors
- Each third-party tool or connector has been reviewed
- You know where your data goes and how long it's kept
The most useful principle
Assume the model will be fooled at some point, because no filter catches every prompt injection. So ask a different question: if this agent were fully tricked right now, what is the worst it could do?
If the answer is "send one incorrect draft to a reviewer," you're in good shape. If it's "email all of our customers" or "delete production data," reduce its permissions until the answer becomes acceptable. This is more dependable than trying to write a prompt that resists every attack.
Prompts can guide behavior, but they aren't a security boundary.
For the wider rules around who approves what, see AI agent governance.
Talk to us
Building an agent, or concerned about one you've already launched? DPR Software Labs builds agents with clear limits on what they can do. We can go through this checklist with you.