AI agents | Security
AI agent security is the work of keeping an AI agent from being tricked, overreaching or leaking data while it acts for someone, and of being able to show afterwards exactly what it did.
Three come up most. An agent can be tricked by instructions hidden in the content it reads, which OWASP lists first in its Top 10 for large language model applications as prompt injection. It can be given more power than its task needs, which OWASP calls excessive agency. And it can expose data it was trusted with. Each is worse in an agent than in a chatbot, because an agent acts on what it decides.
A chatbot answers and a person decides what to do. An agent decides and acts, calling tools, sending messages, changing records and spending money. A wrong answer becomes a wrong action, often before anyone has looked at it.
An attack where the instruction arrives inside something the agent reads, such as a web page, an email or a document, rather than from the user. The agent cannot reliably tell data from instructions, so text written for it can steer what it does next.
Give it the narrowest tool permissions its task needs, keep secrets out of its context, filter what it reads where you can, require a person to approve risky steps such as payments or deletions, cap what it can spend, and record every action it takes so you can review it. No single control is enough, so layer them.
For actions that are costly or hard to undo, yes. Set thresholds, such as a refund above a set amount or a message to an outside party, and route those steps to a person. Record who approved each one, separately from what the agent did, so responsibility stays clear.
No. Filters and model guardrails reduce risk, and attackers keep finding ways around them. Plan on some attacks succeeding, limit what a compromised agent can reach, and make sure you can reconstruct what happened.
Start from the record of every action, meaning what the agent received, which tools it called, what it returned, who approved each step and when. If that record lives only in a database your team controls, outsiders have to trust it. A tamper-evident record, such as one kept on the TIP network, lets anyone you choose confirm the trail is complete and unchanged.
TIP records every agent action as a signed, time-stamped entry linked to the step before it, with only a fingerprint of the data on the network. It does not block attacks. It shows exactly what an agent did, so an injected instruction or an overreaching step can be found and proven.
Agent observability on TIP records each agent action as a signed, tamper-evident entry that anyone you choose can check, while your data stays on your systems. It is a commercial service from The AI Lab.
Related questions
