Secure an AI agent by treating everything it reads as untrusted, granting it only task-specific permissions, and enforcing authorization outside the model before it can act. Add independent approval for consequential actions, isolate and limit memory, cap execution, and test the complete system against attacks—not just the model’s answers.
Why does an agent need different security controls?
A conventional language-model application generates text for a person to review and act on. An agent can call tools, retain state, and perform actions itself. That creates a path from untrusted content to an external side effect: a retrieved document or tool result can contain malicious instructions, and the agent may act on them if the application does not enforce boundaries.
As an Amazon Associate I earn from qualifying purchases.
NIST CAISI describes this pattern as agent hijacking through indirect prompt injection: an attacker places instructions in data the agent later ingests, potentially redirecting it into unintended actions. The central security problem is not simply that a model might produce a bad answer; it is that the system may let that answer trigger an operation.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Design around the agent’s full action path: what it can read, which identity it uses, which tools it can call, what those tools can change, and which checks run before an operation takes effect.
#1 Best Overall
How should you handle prompt injection?
Treat all content entering the agent’s working context as untrusted, regardless of where it came from. That includes user prompts, retrieved documents, API responses, tool results, conversation history, and messages from other agents. A source that is trusted to provide facts is not automatically trusted to issue instructions.
- Keep instructions distinct from data. Make the application’s trusted instructions and the content being processed distinguishable in the agent’s context and orchestration.
- Validate at boundaries. Check retrieved material and tool outputs before they are used, and validate proposed tool names and arguments before execution.
- Limit the consequences of a successful injection. Restrict tools, data scope, and actions so that malicious content cannot grant the agent new authority.
- Test with adversarial content. Include malicious instructions in documents, responses, and other content the agent is expected to process.
Content filtering can be one layer, but OWASP and Microsoft guidance do not establish any single filter as a way to eliminate prompt injection. Do not make a filter the only barrier between hostile content and an action.
What permissions should an agent have?
Give the agent only the tools and authority required for its defined task. “Just in case” tools expand the impact of a compromised or misdirected run. Separate read access from write access, scope resources narrowly, and enforce authorization in the component that executes the operation—not in the model’s reasoning.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSeparate the agent’s identity from the user’s authority
For every downstream operation, establish whose identity or delegated credentials are being used and whether that authority is narrower than the user’s. Avoid standing, broad credentials where possible. Check the specific action against the relevant identity and resource permissions each time it is requested.
NIST NCCoE’s 2026-02-05 announcement described a concept paper and proposed project on software-agent identity and authorization. It signals ongoing standards and implementation work; it is not a completed agent-identity standard.
Authorize the exact operation
The execution layer should independently check the actor, operation, target, and parameters against policy. Validate arguments against allowed values and ranges, and reject unexpected tools or targets. A model’s confidence, stated intent, or interpretation of a user request is not an authorization decision.
Rank #3
When should an action require human approval?
Put an independent approval gate in front of high-impact operations, particularly actions that are irreversible, externally visible, or affect other people or systems. Examples include sending messages, deleting data, making purchases, changing permissions, and deploying changes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Approval must apply to the specific action that will be executed. Bind it to the actor, tool call, target, and parameters; then validate and consume it atomically when the operation runs. OWASP warns that a bare user_confirmed flag is not sufficient: it can fail to prove that the current actor approved the current call. If approval validation fails, do not execute the action.
How do you protect agent memory and logs?
Persistent memory can carry malicious instructions or sensitive information from one interaction into another. Treat saving information as a security boundary, not as a harmless extension of the conversation.
- Validate and sanitize entries before saving, and record where stored information came from.
- Isolate memory by user and session so one person’s data or instructions do not leak into another’s context.
- Apply retention and size limits, and audit stored content for sensitive data.
- Minimize sensitive information in conversation traces and tool-call records; protect any logs that must retain it.
How can you contain runaway or misused agents?
Bound the resources and operations available to each run. Set ceilings for steps, iterations, retries, tokens, and cost; detect loops; and restrict which tools can be chained. These controls limit both accidental runaway behavior and the impact of an abusive or hijacked task.
Keep structured audit information for consequential operations so teams can determine which identity, tool, target, and parameters were involved. Monitoring should support investigation and detection without collecting more sensitive conversation content than necessary.
Recommended Free Tools
How should you test an agent before and after release?
Test the complete application—including the model, prompts, retrieval, memory, tools, authorization, and approval path—because vulnerabilities can arise at their boundaries. OWASP recommends repeatable abuse-case testing and release gates for changes to these components.
Best Value
- Attempt direct and indirect prompt injection, including instructions embedded in retrieved or tool-provided content.
- Try unauthorized tool use, privilege escalation, and access to data outside the task’s scope.
- Test memory poisoning, cross-user leakage, and sensitive-data exfiltration.
- Attempt to bypass approval, alter an approved call’s parameters, or reuse an approval.
- Exercise recursive tool use, loops, and multi-agent handoffs to find unbounded behavior or broken trust boundaries.
Repeat the relevant tests when prompts, tools, retrieval, memory, policies, or model providers change. In its 2025-01-17 discussion of agent-hijacking evaluations, NIST CAISI highlighted adaptive testing, task-specific attack performance, and testing across multiple attempts. A single successful or unsuccessful run is not enough to characterize behavior that can vary across attempts.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How does deployment change your responsibilities?
Microsoft Learn’s shared-responsibility model, last updated 2026-08-26, describes an illustrative progression: customers generally take on more responsibility as they move from a managed SaaS agent to a platform-based PaaS agent and then to a self-hosted IaaS agent. It is not a universal contract or legal rule.
| Deployment | Control and customization | Operational burden | Customer responsibility |
|---|---|---|---|
| SaaS agent | The vendor operates most of the platform; the customer configures data access and identity. | Lower platform-operation responsibility than in the other models described. | Configure data access and identity, and retain responsibility for authorization, oversight, and acceptable use. |
| PaaS agent | The customer has more control over instructions, tools, permissions, orchestration, memory, and identity. | Greater responsibility for configuring and securing the agent’s components than in the SaaS model. | Secure the additional components and define who owns data, identity, authorization, and oversight. |
| IaaS agent | The customer controls nearly the whole stack. | Highest customer responsibility of the three models described. | Own and secure nearly the entire stack, including the agent’s infrastructure and application controls. |
Whatever the deployment, name an owner for data scope, identity, action authorization, human oversight, and governance. Microsoft Learn’s Agent Safety guidance, last updated 2026-08-25, puts the principle plainly: “Building secure AI agents is a shared responsibility between Agent Framework and application developers.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
