AI Agent Security
Focused ai agent security articles with clear context, practical examples, source links where needed, and honest limits.
10 articles in this section.
Test agent permissions with deny-first scenarios
Agent tests must prove that disallowed actions fail, because successful happy-path tests say nothing about the permission boundary.
Prevent secret leakage through AI tool error messages
Tool errors returned to a model should contain actionable categories but not raw headers, connection strings, tokens, or private database values.
Handle partial failure in multi-step AI agent plans
An agent plan is not a transaction; completed external actions may need explicit compensation when a later step fails.
Record an audit trail for every agent tool call
Agent logs should connect user intent, model decision, approved parameters, tool result, and final state without storing unnecessary private prompt content.
Protect multi-agent workflows from confused-deputy bugs
One agent must not borrow another agent’s stronger permissions simply by writing a convincing message into shared context.
Sandbox coding agents without giving them production secrets
A code agent should operate in an isolated workspace with minimum credentials, restricted networking, and no default path to production.
Add human approval gates to high-impact agent actions
Approval should show the exact action, target, and changed data at the moment before execution rather than asking for vague permission at the start.
Stop prompt injection from documents reaching agent tools
Retrieved text is untrusted data, not authority, and must never grant itself permission to call tools or reveal secrets.
Design MCP tool schemas that agents cannot misunderstand
A precise tool schema narrows ambiguous actions by using enums, bounded values, descriptive fields, and separate preview and commit operations.
Authenticate an MCP server before exposing private tools
An MCP connection is not trusted merely because a client can reach it; the server must authenticate the caller and authorize every tool independently.