AI agents are moving from answering questions to taking actions: reading inboxes, querying databases, updating tickets, sending messages, and calling APIs. That shift changes the security picture. A model that only produces text can mislead; an agent with tools can act on that text. Prompt injection, where instructions hidden in content steer the model, is the most widely discussed risk, but it is one of several. This guide explains the main risks in plain terms and the controls that reduce them.
What It Is
Large language models do not reliably distinguish between instructions from their operator and instructions embedded in the data they process. Direct prompt injection happens when a user types instructions designed to override the system's rules. Indirect prompt injection happens when the model reads external content, such as a web page, email, document, or support ticket, that contains hidden instructions, for example to reveal data or call a tool. Other risks compound this. Sensitive information can leak when the model has access to data the user should not see. Excessive agency arises when an agent holds broad tool permissions, such as the ability to send email or delete records, without confirmation. Improper output handling occurs when model output is passed directly into code, queries, or web pages without validation. Supply-chain risks come from third-party models, plugins, and connectors. The OWASP Top 10 for LLM Applications (2025 edition) catalogues these and related categories, such as system prompt leakage and unbounded consumption, and the OWASP GenAI Security Project also publishes guidance specific to agentic applications. Because no current technique fully prevents prompt injection, design should assume that some injected instructions will succeed and limit what they can do.
Who It Is For
This guide is relevant for:
- Teams building agents that use tools, APIs, or company data
- Businesses deploying AI assistants to customers or staff
- Security and risk leads asked to approve an AI feature
- Product owners integrating third-party AI platforms or connectors
What It Helps Clarify
Reviewing these risks helps clarify:
- Which data the agent can read and whether every user is entitled to it
- Which actions the agent can take and which require human confirmation
- How untrusted content reaches the model and what it could influence
- Where model output flows next and whether it is validated
What's Included
- Inventory every tool, connector, and data source the agent can access
- Apply least privilege: give each tool the narrowest permission and scope it to the current user
- Require human confirmation for actions that send, delete, pay, publish, or change permissions
- Treat retrieved content, emails, files, and web pages as untrusted input
- Separate system instructions from user and retrieved content as clearly as the platform allows
- Validate and encode model output before it reaches code, queries, or web pages
- Enforce access control in the data layer, not in the prompt
- Set limits on rate, cost, and the number of actions per session
- Log prompts, tool calls, and outcomes with appropriate privacy safeguards, and review them
- Test with adversarial inputs, including indirect injection through documents and links
- Define a way to disable a tool or the agent quickly if misuse is detected
What's Not Included
- A claim that prompt injection can be fully prevented
- Certification or regulatory approval of an AI system
- Legal advice on AI regulation
- Continuous monitoring of production agents unless separately agreed
When to Choose It
Address these risks before an agent is connected to real tools or data, and again whenever new tools, data sources, or user groups are added. An agent that was safe as a read-only internal prototype may not be safe once it can send email to customers. If a vendor provides the agent platform, ask how it handles tool permissions, confirmation steps, logging, and data isolation.
Our Approach
Design for containment rather than perfect prevention. Ask what the worst realistic outcome would be if an injected instruction succeeded, then reduce permissions and add confirmation steps until that outcome is acceptable. Keep authorisation decisions in deterministic code outside the model. Our LLM & AI Agent Security Review examines agreed AI systems for prompt injection, data exposure, unsafe output, retrieval risks, tool permissions, and human handoff boundaries, and delivers written findings with prioritised recommendations. Where you are still designing the agent, Secure AI Agent Integration can build it with approved data, scoped tools, and review points from the start, and AI Governance, Policy & Data Safety can define the usage rules around it. Revisit the review when models, tools, or data sources change, because behaviour can shift with each.
Frequently Asked Questions
Related Articles
Get Started
Connecting an AI agent to real tools or data?
Describe the agent, its tools, its data sources, and its users. We will propose a scoped security review.
Request a written scope