Category
Threats, controls and review methods for systems that read untrusted content and act through tools.
An agent that reads untrusted content, holds credentials and can take actions combines three properties that traditional application security kept separate. This category covers threat modelling for agentic systems, prompt and tool-description injection, privilege escalation through tools, memory and retrieval poisoning, agent identity and delegation, sandbox and isolation boundaries, containment design and security release assurance. The recurring theme is that the model’s judgement is not a security boundary; the surrounding system has to be.
Turn agent permissions into an enforceable action contract. Separate a model's suggestion from a resource owner's authorisation, test the boundary, and make delegation and revocation reviewable.
An agent can only be evaluated in the context of what its tools allow. Examine identity, delegated authority and action boundaries before you put a workflow in motion.
A working paper for the moment an AI system moves from advice to action. Map identity, permissions, approvals and recovery into an authority model your team can review and test.
A computer-use agent treats pixels, accessibility data and interface state as both evidence and an action surface. Security must bind intent to effects beyond the screen.
Legal agents can organize evidence and prepare work, but professional judgement, client authority and verified legal positions cannot be delegated by interface.
Agent credentials should be shorter-lived than the assumptions that justify them. Bind them to a workload, audience, task and action, then prove renewal and revocation work.
Investigators need more than chat transcripts. Preserve identity, instructions, retrieved context, model and tool versions, policy decisions, credentials, network events and actual state changes.
A useful tabletop follows one plausible agent failure through detection, containment, evidence, business recovery and accountable return to service.
“Internet access” is too broad a permission for an agent. Define destinations, protocols, data-release rules and failure behaviour, then test bypasses against the deployed network path.
Maintenance agents can turn condition signals into coordinated work, but plant safety and control demand bounded action and field verification.
Least privilege for agents is not a smaller role assigned once. It is authority narrowed by identity, task, resource, action, time and consequence at every tool call.
A passing patch is only the start. Repository evaluation should test understanding, change quality, security, reviewability and recovery.
Protocols make tools and agents interoperable, but they also standardise discovery, delegation and context exchange. Those interfaces need explicit trust and policy controls.
Review an MCP server as a privileged protocol adapter: verify tool semantics, OAuth boundaries, token audience, downstream delegation, input handling, isolation, logging and consent.
A useful agent threat model follows data, instructions, identity, tools and state across trust boundaries. This method turns the map into test cases and control decisions.
An agent becomes especially risky when it can read secrets, ingest attacker-controlled material and communicate or act outside the boundary. Design the workflow to break that combination.
A dramatic exploit is a discovery, not a decision rule. Translate it into a threat condition, required control, repeatable regression and release consequence.
Tool-using agents join untrusted input, probabilistic decisions and privileged action. CISOs should govern that path as a security system, not a chatbot feature.
A procurement agent may discover, compare and prepare, but supplier commitments require explicit mandates, separation and evidence.
A sandbox limits what compromised execution can reach. Authorisation decides what an authenticated actor may do. Secure agents need both, tested independently and together.
Stopping one process may leave tools, queued actions, delegated agents and credentials active. Define the safe state, control every action path and rehearse the stop under load.
Prompt injection becomes consequential when untrusted content can steer a model towards privileged tools. Reduce the blast radius by redesigning the workflow around trust and authority.
Financial agents combine models, data, tools, people and third parties, so assurance has to follow the complete regulated workflow.
Bring one agent workflow and the decision in front of you. Gaurav Tiwari replies personally within 1 working day.