A chatbot that answers badly is an annoyance. An agent that can send email, issue refunds or change records and is manipulated into doing so is an incident. Security for agents is mostly about limiting what a manipulated model can do. OWASP publishes guidance for both LLM applications and agentic applications, and both are worth reading before launch. The points below reflect that guidance in practical terms; check OWASP's own pages for the current official text.
Prompt injection
Prompt injection is when text the model reads causes it to follow instructions you did not give it. It can be direct, typed by a user, or indirect, hidden in a web page, document, email or support ticket the agent retrieves. It has been the top-listed risk in OWASP's LLM guidance. There is currently no complete fix at the model level, so assume it will sometimes succeed and design so that success is harmless.
Excessive agency
Excessive agency means the agent has more tools, permissions or autonomy than its job needs. It rose in OWASP's 2026 LLM ranking as models gained tools. The fix is old-fashioned least privilege: if the agent only needs to read orders and draft a reply, it should not hold a token that can delete customers.
Controls that work
- Least-privilege tools. Narrow, task-shaped tools with scoped credentials, read-only by default.
- Human approval for high-impact actions. Refunds above a limit, external messages and data changes should wait for a person until evidence supports loosening.
- Separate trusted and untrusted content. Treat retrieved text and tool output as data, not instructions, and avoid giving an agent that reads untrusted content direct access to sensitive actions.
- Validate outputs. Check tool arguments against schemas and allow-lists before executing.
- Protect secrets and personal data. Keep keys out of prompts, minimise what the model sees and redact where you can.
- Log and monitor. Record every tool call and decision, alert on unusual patterns and review samples regularly.
- Vet third-party tools. Every connected tool or MCP server is part of your attack surface. See MCP for B2B SaaS.
Test it like an attacker
Add adversarial cases to your evaluation suite: documents containing hidden instructions, requests to reveal system prompts, attempts to exceed permissions and malformed tool arguments. Run them on every change, not once. Our process is described in how to evaluate an AI agent before production, and the production integration side in the Claude and OpenAI API production checklist.
Keep watching after launch
New attacks appear, models change and your agent gains tools over time. Ongoing monitoring and regression testing are what our AgentOps retainer provides, and security design is part of every AI agent build.
Frequently asked questions
What is prompt injection?
Prompt injection is when text an AI model reads, from a user or from retrieved content, causes it to follow instructions its operator did not intend.
Can prompt injection be fully prevented?
Not currently at the model level. The practical approach is layered: limit permissions, require approval for risky actions, validate outputs and monitor, so a successful injection has little impact.
What is excessive agency?
It is when an AI agent has more tools, permissions or autonomy than its task requires, so a mistake or manipulation can cause outsized harm.
Where can I find the OWASP guidance?
OWASP publishes a Top 10 for LLM Applications and a Top 10 for Agentic Applications at owasp.org. Review the current versions directly.
Related: AgentOps · AI agents explained
Want a straight answer for your project?
Book a 30-minute call. I will tell you what I would do, and a fixed price if it makes sense.