Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →You cannot establish that an AI agent is universally “safe” by checking its model name or reading its final answers. Evaluate the actual configuration you plan to deploy: what it can read, what it can change, which credentials it uses, what untrusted content it encounters, and whether its actions can be constrained, observed, and investigated. Treat the result as a scoped risk decision—not a guarantee.
Start with the actions the agent could take
Before connecting an agent to tools, define the task and the consequences of mistakes. Agent systems can plan and take autonomous actions that affect real systems or environments; NIST’s January 12, 2026 request for information on securing AI agent systems discusses this broader risk. Ask not only whether the agent might answer incorrectly, but what could happen if it uses a tool incorrectly or outside the user’s intent.
As an Amazon Associate I earn from qualifying purchases.
- Task: What outcome is the agent meant to achieve?
- In-scope actions: Which reads, edits, messages, executions, or other actions are genuinely needed?
- Potential harm: Could a mistake expose data, change persistent state, communicate externally, or trigger a chain of further actions?
- Boundaries: Which actions must it never take, even if they seem useful for completing the task?
Describe the consequences in concrete terms. “Can access email” is less useful than “can read messages and send replies to external recipients”; “can use a database” is less useful than specifying which records it can read or modify.
Inventory tools, permissions, and environments
Make an inventory of every tool the agent can call, the resource each tool reaches, the data it can read, the changes it can make, the credentials it uses, and any limits on its actions. Include indirect access through connected services and delegated credentials. NIST’s August 5, 2025 workshop-informed taxonomy describes tool access using two dimensions: permission level and whether the operating environment is trusted or untrusted. NIST presents the taxonomy as a way to describe access patterns, not as a complete risk standard.
| Access pattern | What to establish | Evaluation question |
|---|---|---|
| Read-only | Which resources and data can the agent inspect? | Could sensitive information be exposed, or could content it reads influence later tool use? |
| Constrained-write | Which changes are allowed, and what limits or checks restrict them? | Can the agent stay within the permitted scope when requests or inputs are ambiguous? |
| Write | What state can the agent change, and how far can those changes reach? | Could an error or malicious instruction cause a consequential or difficult-to-reverse action? |
For each pattern, record whether the agent operates on resources you trust or on untrusted content or systems. Do not assume “read-only” means harmless: reading a webpage, email, or file can expose the agent to instructions designed to influence its later actions. Risk depends on the combination of permissions, environment, data, and what the agent can do after reading it.
Test whether untrusted content can redirect the agent
Include realistic tasks where the agent must process untrusted material that contains instructions conflicting with the user’s request. For example, evaluate a task involving a webpage, email, or file that asks the agent to disclose data or take an unrelated action. The test is whether the content changes what the agent does—not whether it can explain that the content looks suspicious afterward.
- Set a legitimate task. Give the agent a normal, bounded objective and only the tools it would have in the intended deployment.
- Include conflicting instructions in the content. Use representative material from the sources the agent will actually encounter; do not rely on a single artificial phrase.
- Observe the full tool trace. Record tool calls, arguments, outputs, and resulting state, not just the agent’s final response.
- Check for unauthorized effects. Determine whether it followed the injected instruction, disclosed information, or attempted an out-of-scope action.
NIST CAISI’s January 17, 2025 technical blog describes agent hijacking as indirect prompt injection: malicious instructions are inserted into data an agent may ingest and can cause unintended, harmful actions. Its evaluation discussion uses scenarios, including work with AgentDojo. A test result applies to the tested setup and scenarios; the blog’s discussion of a particular model version is not a current model ranking.
Test ordinary errors as well as attacks
An attacker is not required for an agent to cause harm. Evaluate failures that can arise from ambiguity, mistakes, or behavior that does not match the task’s intent. NIST’s January 12, 2026 security RFI identifies risks from adversarial data as well as harmful actions without adversarial input.
- Ambiguous requests: Does the agent ask for clarification rather than guessing when the choice could have consequences?
- Scope boundaries: Does it avoid taking actions that were not requested, even if those actions appear to make the task easier?
- Unsafe tool use: Does it use only the tools and operations needed for the task?
- Data handling: Does it avoid disclosing information to an unintended recipient or system?
- Specification gaming or misaligned behavior: Does it pursue an apparent objective in a way that violates the intended limits?
For each scenario, record what should happen, what actually happened, whether any tool call or state change occurred, and what control would prevent or limit the harm. A reassuring final answer does not erase an unsafe attempted action.
Check who grants authority and how actions are accountable
Establish how the agent is identified, authenticated, and authorized; whose authority it acts under; and how any delegated access is bounded to the user and task. Decide which actions require human approval and whether tool calls and outcomes can be attributed to the agent and investigated later.
NIST NCCoE’s February 5, 2026 concept paper on identity and authority of software agents raises identity, authentication, authorization, least privilege, delegation, human approval, auditing, and non-repudiation as design questions. It is a concept paper, not a final implementation standard. NIST’s agent identity and authorization project resource hub provides the project context; its content and status may change. These materials support treating authority and accountability as explicit design questions, not claiming there is one settled implementation that guarantees safety.
Recommended Free Tools
Constrain access and monitor the deployed configuration
Give the agent only the narrowest useful permissions for the task. Constrain high-impact writes and decide in advance which actions should stop for human approval. Monitor tool use and retain enough information to investigate unexpected behavior. NIST’s January 2026 RFI asks about ways to constrain and monitor agent access; that supports these as evaluation and deployment considerations, not as proof that any particular control eliminates risk.
When comparing two setups, assess them across the same dimensions:
- Permission breadth: read-only, constrained-write, or write.
- Environment trust: whether it works only with trusted resources or also processes untrusted content or systems.
- Action impact: whether it can send, delete, publish, spend, execute code, or change persistent state.
- Injection exposure: what untrusted content it ingests and whether it can act after ingesting it.
- Authority: identity, task scope, delegated permissions, credential handling, and human approval.
- Observability: whether tool calls and outcomes can be inspected and attributed.
A setup with narrower permissions may limit the harm of a failure, but it still needs testing: read access can expose sensitive data, and content can influence subsequent actions. Consider the capabilities together rather than treating one label as a safety verdict.
Make a scoped decision and revisit it after changes
Document the agent version, tools, permissions, credentials, connected data, environment, scenarios tested, failures found, and mitigations applied. A passing result supports a decision about that configuration under those tested conditions; it does not establish that other configurations or future behavior are safe.
Reevaluate after a material change to the model, prompts, tools, credentials, connected systems, data sources, or level of autonomy. NIST’s 2025 tool taxonomy makes access patterns configuration-sensitive, while its 2026 agent security work addresses risks and deployment controls. NIST’s May 18, 2026 summary analysis of RFI responses reports stakeholder input; it is not a binding standard. Across these materials, there is no universal pass/fail threshold for every agent deployment, so state what was tested and what remains outside the evaluation.
Sources and scope
- NIST NCCoE, “New Concept Paper on Identity and Authority of Software Agents,” February 5, 2026.
- NIST CAISI, “Technical Blog: Strengthening AI Agent Hijacking Evaluations,” January 17, 2025.
- NIST, “Lessons Learned from the Consortium: Tool Use in Agent Systems,” August 5, 2025.
- NIST CAISI, “CAISI Issues Request for Information About Securing AI Agent Systems,” January 12, 2026.
- NIST, “Summary Analysis of Responses to the Request for Information Regarding Security Considerations for AI Agents,” May 18, 2026.
- NIST NCCoE, “Introduction — NCCoE Agentic AI Identity and Authorization Project Resource Hub.”
These sources provide risk and evaluation guidance, not certification criteria or a promise that an agent is safe in every setting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
