Recommended Free Tools
Adding security tools is not enough to secure an AI agent. The effective approach is to limit what the agent can access, enforce authorization outside the model, contain what it can execute, and require independent approval for consequential actions. A model can be manipulated by instructions hidden in content it reads; access controls must still hold when that happens.
Why can a tool-using agent be hijacked?
An agent’s tools turn its decisions into actions: reading files, querying databases, running code, or sending messages. That creates an action surface. An attacker may not need to talk to the model directly; malicious instructions embedded in an email, file, or web page the agent reads can influence what it does next.
As an Amazon Associate I earn from qualifying purchases.
NIST’s Center for AI Standards and Innovation described this risk as “agent hijacking,” a form of indirect prompt injection that can cause an agent to take unintended, harmful actions. In a January 17, 2025, technical blog post, NIST reported experiments involving code execution, database exfiltration, and automated phishing scenarios. Those experiments used agents powered by an upgraded Claude 3.5 Sonnet released in October 2024. They illustrate risks under the tested conditions, not a prevalence rate for all agents or a guarantee about how a current system will behave.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe security implication is straightforward: instructions in a prompt are not an authorization boundary. The agent may misunderstand policy, or hostile content may steer it toward an action. Systems that perform the action must independently decide whether it is permitted.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How should you limit what an agent can do?
Start with the smallest useful toolset
Give an agent only the tools needed for its assigned task. Narrow each tool to specific operations rather than exposing a general-purpose shell, broad URL fetcher, or unrestricted connector where a focused operation will suffice. A mail summarizer, for example, usually needs to read messages, not send or delete them.
Apply least privilege to the entire path from agent to service. Scope the downstream API or database identity to the required data and operations; keep read-only and write-capable identities separate. Where appropriate, use the user’s own authorization context. OWASP’s guidance on excessive agency recommends minimizing extensions, their functionality, and their permissions, with authorization enforced in downstream systems.
Check every proposed action outside the model
Put a policy enforcement point between a proposed tool call and the system that executes it. At execution time, validate the initiating identity, tool, target, arguments, permitted scope, rate, and any required approval. The model may propose an action, but it should not be the component that grants itself permission to take it.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
OWASP’s 2026 Top 10 for Agentic Applications guidance describes per-tool profiles, action-level authentication, pre-execution policy checks, and usage ceilings as controls. A useful implementation question is whether each check happens in a component that the agent cannot bypass or rewrite.
How can you contain an agent if a control fails?
Isolate execution and restrict network access
Run code and tools in isolated environments with restricted filesystem access. Limit outbound connections to destinations the task requires, ideally through an allowlist. Avoid placing production credentials in the agent’s environment; use dedicated identities and scoped, short-lived credentials instead.
Do not assume that one sandbox covers every integration. Verify which execution paths it contains, including file tools and MCP servers. OWASP’s AI Agent and MCP Security guidance notes that coverage can vary across components, so map the actual path from model call to external action.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Treat content, tool definitions, and dependencies as untrusted
Content an agent reads can carry prompt injection, and tool integrations introduce their own risks. OWASP’s MCP Top 10 discusses threats such as poisoned tool metadata, scope creep, exposed tokens, vulnerable dependencies, command execution, and contextual payloads.
- Vet MCP servers and pin versions or dependencies where possible.
- Review changes to tool definitions and permissions before deployment.
- Keep long-lived secrets out of prompts and environment files.
- Do not rely on the model to consistently recognize malicious instructions or unsafe metadata.
Which actions need a human gate?
Keep a separate human decision for actions that are difficult to reverse or have significant external impact: deleting data, sending messages, spending money, changing permissions, or deploying software. The approval interface should show the exact action, target, and tool arguments, not a vague summary of what the agent intends to do.
Approval is not a substitute for authorization. Validate the human’s approval and the action’s permission independently before execution. For especially sensitive operations, the OWASP AI Agent Security Cheat Sheet recommends controls beyond a simple approval prompt, including binding approval to the specific action and using short-lived authorization artifacts with replay protection.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should you log and test?
Keep an audit trail outside the agent’s control
Record tool calls, commands, file writes, network requests, the initiating identity, and execution results in a system the agent cannot alter. Alert on behavior that does not fit the task, such as unexpected destinations, credential access, bulk data reads, or the appearance of a new MCP server. Logs should let an investigator connect a proposed action to its authorization decision and outcome.
Test the tasks and risks you actually deploy
Test with scenarios tailored to the agent’s task and access, including malicious instructions in content it may read. Include attempts to trigger data exfiltration, code execution, and phishing where those risks are relevant. Retest after changes to models, tools, permissions, or workflows, and use repeated or adaptive attack scenarios rather than treating one successful test as proof of safety.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11NIST’s January 2025 article argues that evaluations should adapt as systems change and examine task-specific risk. Its reported results should be read in the context of the systems and conditions it tested, not treated as a universal score for agent security.
How should an organization choose its control approach?
Controls can be built into an application, assembled from open-source policy and sandbox components, or provided through a platform. The right choice depends less on the number of security products than on whether the controls cover the full path from model request to downstream action.
- Enforcement location: Identify whether policy is enforced in the application, a gateway, an identity provider, or the execution environment—and whether the agent can bypass it.
- Permission detail: Check whether policy can constrain individual tools, operations, targets, and arguments.
- Identity and credentials: Assess support for isolated identities, scoped permissions, and short-lived credentials.
- Containment coverage: Confirm which code, file, network, and MCP execution paths are sandboxed and how egress is restricted.
- Audit and integration: Determine whether logs capture identities, requests, decisions, and outcomes in a system outside the agent’s control.
- Testing and upkeep: Check how easily controls can be tested again when models, tools, or workflows change, and account for the operational work required.
OWASP’s DevSecOps guidance names examples of policy, gateway, testing, and sandboxing projects, but naming a project is not an endorsement or evidence that it will fit a particular deployment. Evaluate coverage and enforcement behavior against the agent’s actual permissions and failure modes.
Quick Recap
What is the practical security baseline?
- Define the agent’s task and remove tools and permissions it does not need.
- Scope downstream identities and enforce authorization in the systems that carry out actions.
- Place a policy check before execution, validating the identity, target, arguments, scope, rate, and approval state.
- Isolate execution, restrict filesystem and network access, and use scoped, short-lived credentials.
- Require action-specific human approval for consequential operations.
- Log activity outside the agent’s control and retest task-specific attacks as the system changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →
