What Is agentic AI security?

Definition#

Agentic AI security is the practice of securing AI agents that can interpret goals, plan work, access tools or data, and take actions with limited human intervention. It extends traditional application security with controls for non-deterministic behavior, untrusted instructions, model-driven decisions, agent memory, and delegated authority.

A conventional application generally follows code-defined paths. An agent can select its next step at runtime, sometimes calling APIs, modifying records, sending messages, or initiating workflows based on model output.

Analyst’s Take: The defining security problem is not that an agent uses a model; it is that the model can influence actions across tools, data, and external systems. Start with the agent’s authority and execution path, then apply controls where it receives instructions, selects tools, and persists state.

Agentic AI security overlaps with broader AI application security and identity governance, but it focuses especially on systems that can reason through tasks and act on their own.

How Agentic AI Security Works#

Agentic AI security applies defense in depth across the agent’s complete operating loop:

1. Receive instructions. The agent may process a user prompt, an API request, retrieved documents, email, web content, or messages from another agent. Security controls must distinguish trusted instructions from untrusted content.
2. Interpret and plan. The model converts a goal into one or more proposed actions. Because the output is probabilistic, validation cannot rely only on a fixed list of expected responses.
3. Select tools. The agent chooses functions such as search, database access, code execution, ticket creation, payment processing, or email delivery. Each tool needs an explicit schema, authorization check, and safe failure behavior.
4. Execute actions. A policy layer should evaluate the requested action, target, data, and user context before execution. High-impact operations may require approval or additional verification.
5. Observe and continue. The agent receives tool results and may revise its plan. Logs need to capture the sequence of prompts, decisions, tool calls, responses, and policy outcomes.
6. Persist state. Conversation history, long-term memory, vector stores, and intermediate artifacts can influence future behavior. These stores require access controls, retention rules, integrity protections, and tenant isolation.

The central difference is that the security boundary is no longer just the application endpoint. It includes the model, orchestration framework, system prompts, tools, retrieved context, memory, user identity, service identity, and external systems.

Technical Notes

A practical policy should evaluate actions before a tool runs. For example:

allow:
  - tool: ticket.read
    conditions:
      - requester_can_access_ticket
  - tool: calendar.create_draft
    conditions:
      - user_owns_calendar

require_approval:
  - tool: email.send
  - tool: payment.submit
  - tool: production.deploy

deny:
  - tool: shell.exec
  - conditions:
      - destination_not_allowlisted

The exact policy language will vary, but the security properties are consistent:

• Least privilege: Give the agent only the tools and data required for its task.
• User-bound authorization: Do not let an agent use its broad service account to bypass the user’s permissions.
• Input and output validation: Treat model output as untrusted data until it passes schema, policy, and business-rule checks.
• Tool isolation: Separate read operations from write operations and restrict network, filesystem, and code-execution access.
• Approval controls: Require explicit confirmation for irreversible, external, financial, or privileged actions.
• Traceability: Record who initiated the task, what the model proposed, which tools ran, what data was returned, and why the action was allowed.
• Rate and budget limits: Bound API calls, tokens, runtime, financial value, and the number of delegated steps.

Agent credentials and integration secrets should be stored in an approved secrets-management system rather than prompts, source code, or memory stores. Teams evaluating password and secret-management workflows can consider tools such as 1Password, subject to their organization’s security and compliance requirements.

Useful telemetry may include events such as:

agent_id=research-assistant
user_id=u-1842
event=tool_call
tool=crm.export
decision=deny
reason=scope_exceeds_user_permission
trace_id=7f31...

Security teams should alert on repeated denied tool calls, unexpected access to sensitive data, prompt injection indicators in retrieved content, unusual outbound destinations, rapid action loops, and attempts to disable safeguards. These signals should feed the organization’s broader risk management process.

When You’ll Encounter Agentic AI Security#

You will encounter agentic AI security when an AI feature can do more than generate a response. Common examples include:

• IT and security operations: Agents investigate alerts, query logs, open tickets, or propose containment actions.
• Software development: Coding agents read repositories, modify files, run tests, and create pull requests.
• Customer support: Agents retrieve account information, update records, issue refunds, or send customer communications.
• Enterprise search and knowledge systems: Agents retrieve documents and combine information across internal sources.
• Business automation: Agents schedule meetings, update enterprise resource planning systems, process invoices, or manage workflows.
• Browser and computer-use agents: Agents navigate websites, enter data, and interact with desktop applications.
• Multi-agent systems: One agent delegates work to other agents, creating additional identity, trust, and authorization relationships.

Traditional application security remains necessary in all these cases. Secure coding, dependency management, vulnerability testing, secrets protection, identity controls, and network segmentation still apply. Agentic security adds controls around how the AI decides to use those capabilities.

For an initial assessment, inventory every agent, its owner, model provider, tools, data sources, memory stores, service accounts, and external destinations. Then classify actions by impact. Reading a public document is not equivalent to deleting a customer record or deploying code to production.

Agent Security Risks#

The most important agent security risks arise from the interaction between model behavior, data, tools, and authority:

• Prompt injection: Untrusted content can attempt to override the agent’s instructions or influence its plan.
• Excessive permissions: A compromised or misdirected agent may perform actions beyond the user’s intended authority.
• Sensitive-data exposure: Retrieval, memory, logs, or tool responses may reveal information to an unauthorized user or system.
• Unsafe tool use: Poorly constrained functions can enable unauthorized transactions, code execution, data changes, or external communication.
• Memory poisoning: Malicious or inaccurate information stored for future use can influence later tasks.
• Over-reliance on model output: A plausible response is not proof that an action is correct, safe, or authorized.
• Unbounded autonomy: Long action chains can increase cost, expand the attack surface, and make failures harder to detect.
• Weak delegation controls: In multi-agent systems, one agent may pass authority or sensitive data to another without adequate verification.

Controls should be proportionate to impact. A read-only research assistant may need strong data-access and prompt-injection defenses, while an agent that can approve payments or deploy code also needs transaction limits, separation of duties, and mandatory human approval.

Related Terms

• AI application security: The broader discipline of securing applications that use machine learning or generative AI, including models, data, prompts, integrations, and infrastructure.
• LLM security: Security controls for large language models and systems built around them, including prompt injection, data leakage, model abuse, and supply-chain concerns.
• Prompt injection: An attempt to influence an AI system by placing instructions in a prompt, document, webpage, message, or other input. It is especially important for agents because successful manipulation may trigger tool use.
• Tool or function-calling security: The practice of restricting, validating, and monitoring the functions an AI system can invoke.
• AI red teaming: Adversarial testing of model behavior, agent workflows, tools, data access, and policy enforcement.
• Model context protocol security: Security considerations for protocols that connect models or agents to tools and data sources, including server trust, authorization, and input handling.
• Human-in-the-loop security: Requiring a person to review or approve selected decisions or actions before execution.
• Identity-aware agent security: Binding agent actions to a known user, workload, or delegated service identity instead of relying on an unrestricted shared credential.

How to Implement Agentic AI Security#

Start by inventorying each agent’s tools, data sources, identities, memory stores, and external destinations. Classify the actions it can take, then enforce:

1. Least privilege for tools, data, and service identities.
2. User-bound authorization so agents cannot bypass the initiating user’s permissions.
3. Input and output validation for prompts, retrieved content, tool arguments, and results.
4. Approval gates for irreversible, financial, external, or privileged actions.
5. Isolation for code execution, network access, memory, and tenant data.
6. Detailed logging of prompts, plans, tool calls, policy decisions, and outcomes.
7. Monitoring and response procedures for anomalous behavior and repeated policy violations.
8. Revocation mechanisms that can disable tools, credentials, memory, or the entire agent quickly.

This approach preserves useful automation while keeping the agent’s authority explicit, bounded, observable, and revocable.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.