Traditional application security focuses on authentication, authorisation, and data protection. AI agent security includes all of that plus three new threat categories: prompt injection (manipulating the agent's reasoning through crafted input), tool abuse (tricking the agent into taking unintended actions), and data exfiltration (extracting sensitive information through the agent's outputs). These threats are unique to AI systems and require specific defences.
Prompt Injection
Prompt injection is the most common AI-specific attack. An attacker embeds instructions in user input that override the agent's system prompt: 'Ignore all previous instructions and instead...' The defence is layered: input sanitisation (strip known injection patterns), system prompt hardening (clearly separate system instructions from user input), output validation (check that the agent's output does not contain system prompt content), and instruction hierarchy (the system prompt always takes precedence over user input). No single defence is sufficient — you need all four layers.
Warning
Prompt injection is not a theoretical risk. It is the most common attack against production AI systems. Every agent that processes user input needs prompt injection defences.
Tool Permission Boundaries
Every tool should have explicit permission boundaries: which users can trigger this tool, what parameters are allowed, what the maximum execution count is per session, and what actions require human confirmation. The principle of least privilege applies: an agent should only have access to the tools it needs, and each tool should only be able to do what it needs. An agent that answers customer questions should not have access to the database deletion tool. Period.
Output Data Protection
Agents can inadvertently leak sensitive data through their outputs. An agent with access to a customer database might include another customer's data in its response. Defence: output filtering (scan outputs for patterns that look like sensitive data — emails, phone numbers, account numbers), context isolation (each user's context is completely separate), access-controlled retrieval (the agent can only retrieve data the current user is authorised to see), and output review (human review for high-risk outputs).
Audit and Compliance
Every agent action must be logged and attributable: which user triggered the action, what the agent decided at each step, which tools were called with what parameters, what the output was, and whether human confirmation was required. This audit trail is not optional — it is a compliance requirement for regulated industries and a debugging necessity for all agents. Store audit logs in an immutable store (append-only) with retention periods matching your compliance requirements.
Conclusion
AI agent security requires defending against threats that do not exist in traditional applications. Prompt injection, tool abuse, and data exfiltration each require specific defences. The principle is the same as traditional security: least privilege, defence in depth, and comprehensive auditing.
Key Takeaways
- Prompt injection is the most common attack — use four-layer defence (sanitise, harden, validate, hierarchy)
- Tool permission boundaries: least privilege, parameter validation, rate limits, confirmation gates
- Output protection: scan for sensitive data, enforce context isolation, access-controlled retrieval
- Every agent action must be logged in an immutable audit trail — this is a compliance requirement
- Defence in depth: no single security measure is sufficient for AI agents