Why agents increase the attack surface
A classic chatbot receives a message and generates a response. An AI agent may also call APIs, read files, query databases, send email or trigger actions.
This turns a prompt mistake into a real operational risk. The problem is no longer only a wrong answer, but unauthorized data access or transmission.
Security must therefore be designed at the tool, permission and data layers, not only in the system prompt.
Prompt injection can cause data leakage
External content can contain instructions designed to manipulate the agent: a document, email, web page, support ticket or RAG result.
If the agent treats these instructions as trusted, it may reveal information, use an unintended tool or deviate from the requested task.
All retrieved content should be considered untrusted, system instructions must remain separate from data, and available tools should be strictly limited.
Apply least privilege to agent tools
An agent that only needs to read order status does not need generic write access to the entire database.
Each tool should expose one precise business operation with limited parameters, server-side authorization checks and validation.
Credentials used by the agent should have fewer privileges than a human administrator, never more.
Prevent cross-tenant leakage in RAG
In a multi-tenant SaaS, organization filtering must be applied before vector retrieval, not after documents have already been fetched.
Semantic similarity must never be enough to make a document accessible. Business authorization always takes precedence over similarity.
Tests should include cross-tenant leakage scenarios because a filtering bug can expose data without producing any technical exception.
Do not send secrets to the model
OAuth tokens, API keys, passwords, connection strings and technical secrets should never be placed in model context.
Tools should use their own server-side credentials and return only the business result needed.
When an agent acts on behalf of a user, delegated and time-limited authorization is preferable to directly exposing a secret.
Log without recreating the leak in logs
Logs are essential for understanding agent behavior, but they can become a leakage source if every prompt and response is stored in clear text.
Prefer correlation IDs, metadata, decisions, tool names and statuses, with masking of personal or sensitive information.
Logs that genuinely need content should use short retention periods and stronger access controls.
Put a human in the loop for sensitive actions
Data deletion, financial transfer, permission changes, bulk sending or disclosure of sensitive documents should not be executed automatically based solely on model output.
The agent can prepare the action, explain what it will do and request explicit confirmation before execution.
This validation significantly reduces the impact of hallucinations, prompt injection or bad context.
