Prompt injection and agent security
Systems using models and agents introduce new risk surfaces without making classical security principles obsolete. Prompt injection, excessive tool access and misplaced trust in generated output require targeted controls.
Trust boundaries
Application instructions, user decisions and external documents carry different authority. A page visited by an agent must not be able to change permissions or authorize a transaction.
Least privilege and separation
Each tool should expose only necessary operations. Secrets, tokens and personal information should not be available to untrusted resources. Sensitive operations require confirmation.
Test beyond happy paths
Agent tests should include hostile documents, conflicting evidence, network failures and partial states. Logs should make actions auditable while minimizing unnecessary personal data.
Keep controls current
Risk guidance, including OWASP materials, evolves. A risk ranking does not guarantee comprehensive coverage; assessments need to match the application and its operating context.
Trust boundaries and permissions
In a WebAI application, retrieved pages, files and tool results are potentially hostile external data. Instructions found in a document must not gain more authority than their author has. Sensitive operations need deterministic controls, least-privilege authorization and, where appropriate, specific user confirmation.
Exercise: summarize without following a page
In an isolated environment, add a harmless instruction to a fictional document requesting an unauthorized file edit. The system should summarize the document while treating that instruction as untrusted data. Check tool logs, refusal of the action and fulfillment of the legitimate request. Keyword filters cannot replace structural trust separation.
Core steps
- 01Map access
- 02Separate sources
- 03Restrict permissions
- 04Test attacks
Three questions to ask
Can it distinguish an authorized command from an instruction embedded in a page?
Do sensitive tools require explicit approval?
Are failures and refusals observable?
Read the source documents
Versions, reuse terms and document status can change. Check them on the original sites.