Agentic AI security
securityAI agent security · agent security
Protecting goal-driven systems that act on their own: dynamic controls, continuous monitoring and adaptive access — because the attack surface is no longer the application, it's what the agent can do with its permissions.
With a classic application you know up front which calls it can make. With an agent you don't: it decides the plan at runtime, based on text that may have arrived from an email, a web page or a document someone else uploaded. That changes the security question. It stops being 'who can get in' and becomes 'what can this thing do, on whose credentials, with nobody approving it'. Hence the three pieces: a distinct identity per agent (not a borrowed human one), least and time-boxed privilege per action (not standing access to the whole system), and a full trace of every tool call so you can reconstruct what it did and why. On top of that sits the genuinely new problem: instruction injection through content the agent reads, which has no equivalent in traditional software.
How it differs from
- LLM security
- LLM security is about what the model says: toxicity, output leakage, prompt injection. Agentic security is about what the system does: which tool it calls, with which permissions, against which real system.
- AI governance
- Governance sets policy and accountability. Agentic security implements the technical controls that stop the wrong action. You can have an immaculate committee and an agent with admin access.
Examples
- Giving each agent its own identity and rotatable credentials instead of reusing an employee's service account.
- Isolating an agent's execution environment so it can't override its own constraints even if an injection compromises it.
FAQ
- What breaks first when it's missing?
- Permissions. The most common pattern is the agent inheriting the credentials of whoever launched it and ending up with more access than any human would have been approved for — without anyone explicitly deciding it.
- Is a standard pentest enough?
- It helps but doesn't cover it. The new surface is the content the agent reads: a document or a web page can carry instructions the agent executes. You have to test that with the agent running and its tools connected, not against an endpoint.