AI agents
How to secure AI agents, chatbots and the tools they use
An AI agent is software you've given a goal, some tools and permission to act: read the inbox, update the CRM, refund an order, change the code. That's what makes agents useful, and why their security looks different. An agent can be persuaded by the content it reads, and it can only do as much damage as the access you've given it.
Rather just ask someone? Talk to usIn short
AI agents fail differently from ordinary software: they can be manipulated by instructions hidden in emails, web pages or documents they read, a risk called prompt injection. Since it can't be fully prevented, the defence is limiting what an agent can reach and do, requiring a person's approval for anything that moves money or data, and logging every action.
General information, current as at November 2026, not legal advice. A review lowers risk; it can't guarantee a system won't be breached, and it isn't a certified penetration test or a compliance audit.
- What is prompt injection?
- An attack where instructions are hidden in content an AI system processes, such as an email, a web page, a support ticket or a file, so the model follows the attacker's instructions instead of yours. It's first on OWASP's Top 10 for LLM applications, and there is no complete technical fix, which is why limiting an agent's access matters so much.
What actually matters
Assume the agent can be talked into things
In 2025 researchers showed a malicious public GitHub issue could make a coding agent leak private repository data into a public pull request. The model did exactly what the injected text asked. Design as if any content the agent reads might contain instructions.
Give it the least access that works
OWASP calls this excessive agency. An agent that drafts replies doesn't need to send them; one that reads orders doesn't need to issue refunds. Separate read from write, scope each credential to one job, and use separate accounts so the agent's actions are clearly its own.
Put a person in front of money, data and anything irreversible
Payments, refunds, deletions, bulk exports, messages to customers and changes to permissions should wait for a human to approve them. It costs a click, and it turns a successful injection from a breach into a rejected suggestion.
Vet every MCP server and plugin like a new supplier
Agent tools are code with access to your systems. In September 2025 a fake 'postmark-mcp' package quietly copied every email it sent to an outside address, and in 2026 hundreds of malicious skills were found in an agent marketplace. Install tools from known publishers, pin versions and review what each one can reach.
Keep secrets out of prompts and configuration
GitGuardian found more than 24,000 secrets in MCP configuration files in public code in 2025. Store keys in a secrets manager, not in prompts, agent memory or config files that end up in a repository.
Log everything the agent does
Every tool call, with its inputs and results, should be recorded somewhere a person can review. When something goes wrong, the log is how you find out what happened, and it's often how you notice in the first place.
The risks that matter most for a business
Drawn from OWASP's Top 10 for LLM Applications (2025) and Top 10 for Agentic Applications (2026), in plain terms.
| Criteria | What it means | The control that helps |
|---|---|---|
| Prompt injection | Hidden instructions in content redirect the model | Limit access, require approval for actions, treat output as untrusted |
| Excessive agency | The agent can do more than its job needs | Scoped credentials, read/write separation, approval steps |
| Sensitive data disclosure | The model reveals data it can see to the wrong person | Only give it data the user is allowed to see |
| Tool and supply chain risk | A plugin, MCP server or model is malicious or flawed | Known publishers, pinned versions, reviewed permissions |
| Improper output handling | Model output is run or displayed without checks | Validate and escape output like any user input |
| Unbounded consumption | Runaway loops or abuse run up costs | Rate limits, spending caps and alerts |
Where we'd point you elsewhere
If an AI feature only drafts text for a person to read and send, the risk is modest and a full review is probably overkill; check what data it can see and move on. The review earns its cost when an agent can act on its own: sending messages, changing records, moving money or touching code.
Tell us what you'd like checked
Describe what you run and what's worrying you. We'll suggest a sensible scope and a fixed price, or tell you plainly if a different kind of specialist would serve you better.
Common questions
Not completely, with today's models. Filters and careful prompts reduce it, but determined attackers get around them. That's why the dependable controls are about limiting impact: narrow access, human approval for consequential actions, and logging, so a successful injection can't do much harm.
It can be, with limits. Give the agent its own account with only the permissions its task needs, keep read and write separate where you can, and require approval before it sends, pays, deletes or exports anything. Start read-only and widen access once you trust the behaviour.
The Model Context Protocol (MCP) is a standard way to give AI tools access to other systems, and an MCP server is the connector. Each one is code that holds some of your access, so treat it like any third-party integration: known publisher, pinned version, minimum permissions.
From 10 December 2026, businesses covered by the Privacy Act must say in their privacy policy when computer programs use personal information to make, or substantially help make, decisions that could significantly affect people. If an agent does that, it needs disclosing. Get advice on how it applies to you.
See it working
Software we'd build, running with a fictional business and sample data. Use it, then decide.
Also worth a look
- Securing Integrations and Connected Apps
- Leaked API Keys: How to Check and What to Do
- How AI Is Changing Cyber Attacks on Business
- Already broken or stuck? Fix & rescue
Last reviewed . General information, not legal advice. Figures cited are from the sources named on each page.