Agent security
How AI agents get attacked, and the controls that hold. Prompt injection, tool poisoning and rug pulls on one side; least privilege, agent identity, egress limits and audit logs on the other. The standards pages put the same ground in OWASP, MITRE ATLAS and SOC 2 language, for when a reviewer asks.
Know the attacks
- What is prompt injection?Prompt injection is text that makes an AI model follow an attacker's instructions instead of its owner's. What direct and indirect injection are, why models can't tell data from instructions, and why nobody has solved it.
- What is MCP tool poisoning?MCP tool poisoning hides malicious instructions inside a tool's name, description or schema, where the model reads them but the user never sees them.
- The lethal trifecta: how AI agents leak dataPrivate data, untrusted content and the ability to send data out: when an AI agent has all three, an attacker can trick it into stealing from you. What the trifecta is and how to break it.
- What is an MCP rug pull?An MCP rug pull is when a server changes a tool's description or behavior after a user already approved it, so the approval no longer means what it meant at the time.
- What is excessive agency in AI agents?Excessive agency is when an AI agent has more functionality, permissions or autonomy than its task needs. OWASP's LLM06, with a worked example using a full GitHub token.
- The confused deputy problem in AI agentsThe confused deputy problem is when an agent uses its own broad credentials on behalf of a less-privileged requester or an injected instruction. Where it comes from and how to scope it out.
- Malicious MCP servers: how to vet one before you install itAn MCP server is code you run with your credentials. How malicious and impersonating servers get installed, the postmark-mcp case, and a checklist for vetting one.
- Prompt injection vs jailbreaking: what is the difference?Jailbreaking targets a model's safety training and the user is the attacker. Prompt injection targets the application built on the model, and the attacker is a third party.
Control agent access
- How to give an AI agent read-only GitHub accessLet an agent read issues and pull requests through GitHub's MCP server without being able to merge, push or close anything. Three layers: a read-only token, the server's read-only mode, and per-tool grants.
- Least privilege for AI agentsLeast privilege for AI agents means narrowing five things: the tools an agent can call, the credential behind them, the data it sees, where it can connect, and how long access lasts. How to do each, and in what order.
- Why your system prompt is not a security boundaryA system prompt tells a model what to do. It can't enforce anything: a user or a poisoned tool result can talk the model out of it, and the prompt itself can leak.
- Human in the loop for AI agents: when to require approvalWhich AI agent tool calls deserve a human approval prompt, why rubber-stamping defeats the control, and how MCP and Claude Code handle consent today.
- Why every AI agent needs its own identityAn agent running on a person's API key hides behind that person in every log and can only be stopped by locking the person out too. Give it its own identity instead.
- How to keep API keys out of your AI agent's reachPlaintext keys in mcp.json and .env files sit in an agent's reach and its context. Four patterns that keep them out: injection at call time, a secret manager, short-lived scoped tokens, and masking in output.
- How MCP authorization works (OAuth 2.1)MCP's authorization spec runs OAuth 2.1 over HTTP, with protected resource metadata, PKCE, resource-bound tokens and a ban on token passthrough. Here is the flow.
- How to sandbox an AI agent and control its network egressRun local MCP servers and agent code in a container with no ambient credentials and a short list of reachable addresses, so a manipulated agent has nowhere to send data.
- What to log when AI agents call toolsWhat an audit log needs for an AI agent calling MCP tools: caller identity, tool, server, arguments with redaction, result, allowed or refused, and latency.
- How to pin MCP server versionsLock an npx, uvx or Docker MCP server to one exact version or digest, so an update after you approved it can't change what runs.
Frameworks and standards
- OWASP Top 10 for LLM Applications (2025) mapped to MCPOWASP's ten LLM risks, LLM01 through LLM10, mapped to an agent calling MCP tools: what each one means for a tool call, an example, and the control that addresses it.
- OWASP agentic AI threats and mitigations explainedOWASP's Agentic Security Initiative names 15 agent threats (T1 to T15) and, as of December 2025, a separate Top 10 for Agentic Applications (ASI01 to ASI10). What each covers and how it maps to MCP.
- MITRE ATLAS for AI agents: a defender's guideMITRE ATLAS is a public knowledge base of adversary techniques against AI systems, including tool-using agents. How to read it and map it to defenses.
- How to get AI agents through a security review (and SOC 2)What a security review asks about an AI agent, mapped to SOC 2's CC6, CC7, CC8 and CC9, plus a checklist of evidence to collect before the call.