Agentic AI Security Guide: Threats & Controls

Agentic AI does not introduce one new risk. It connects familiar ones in a new way. An agent reads untrusted content, decides what to do, and acts with real credentials against real systems, often without a human reviewing each step. Prompt injection, over-privileged identities, insecure tools, poisoned memory and supply chain compromise already existed separately. In an agent they combine into a single path from a malicious sentence to a production change. This guide sets out a layered threat model for agentic AI, maps it to the OWASP Top 10 for Agentic Applications, and explains which controls matter at each layer, with identity as the control that limits the damage when everything else fails.

Key takeaways

Secure agentic AI across six layers: inputs and context, the model and its instructions, memory, tools and integrations, orchestration and inter-agent communication, and identity and credentials. Most serious incidents cross several layers.
Assume the model can be manipulated. No prompt, filter or guardrail reliably stops prompt injection today, so design so that a manipulated agent still cannot cause serious harm.
Identity and access are the blast-radius control. What an agent can do when it goes wrong is set by its credentials, not its instructions.
The OWASP Top 10 for Agentic Applications (2026) is the most useful shared vocabulary; map your controls to it.

Why agentic AI needs its own security approach

Traditional application security assumes code follows a fixed path. An agent's path is chosen at runtime by a model that interprets natural language, and it cannot reliably tell the difference between instructions from its operator and instructions hidden in the data it processes. Three properties follow:

The attack surface is the content. Anything the agent reads, including email, tickets, web pages, documents, tool descriptions and other agents' messages, can steer it.
Actions are real. Agents send messages, change records, run code and move money using legitimate credentials, so misuse often looks like normal activity.
Errors compound. A wrong decision early in a multi-step plan, or in one agent of many, propagates to later steps and other agents.

For how these properties grow as systems move from chatbots to multi-agent systems, see AI Agents vs Agentic AI.

A layered threat model

Layer 1: Inputs and context

Threats: direct prompt injection by users; indirect prompt injection through retrieved documents, web pages, email, calendar invites and tool output; data poisoning of retrieval-augmented generation (RAG) indexes.

Real-world pattern: the Gemini Google Calendar prompt injection showed calendar data leaking through instructions hidden in content the assistant processed.

Controls: treat all external content as untrusted data; separate and label trusted instructions from retrieved content; filter inputs for known injection patterns (useful but not sufficient); restrict which sources an agent may read; and keep retrieval permission-aware so an agent only retrieves what the requesting user may see. The contributed article How to Prevent Prompt Injection in AI Agents goes deeper.

OWASP mapping: ASI01 Agent Goal Hijack.

Layer 2: The model and its instructions

Threats: goal hijack, jailbreaks, system prompt disclosure, hallucinated actions, and behaviour drift after model updates.

Controls: never place secrets in system prompts; pin model versions and re-test before upgrading; define the agent's goals and prohibited actions in policy enforced outside the model; and require the agent to state its intended action in a structured form that a policy engine can check before execution.

OWASP mapping: ASI01 Agent Goal Hijack, ASI09 Human-Agent Trust Exploitation.

Layer 3: Memory

Threats: poisoned long-term memory that changes future behaviour; cross-user or cross-session leakage; sensitive data persisting longer than intended.

Controls: isolate memory per user, session and task; validate content before it is written to memory and store structured summaries rather than raw input; log memory changes; set retention limits; and periodically reset or re-baseline long-term memory.

OWASP mapping: ASI06 Memory and Context Poisoning.

Layer 4: Tools and integrations

Threats: tools with more permissions than needed; untrusted input passed straight to shells, databases or code interpreters; malicious or typosquatted tools and MCP servers; tool descriptions that carry hidden instructions ("tool poisoning"); runaway loops that exhaust budgets.

Real-world patterns: the Gemini CLI silent code execution flaw; the Amazon Q coding agent compromise, where data-wiping instructions were injected into the extension.

Controls: an allowlist of approved tools and MCP servers; least privilege per tool; sandboxed execution with no network, filesystem or root access unless required; validation of tool arguments; rate limits and spend budgets; and human approval for destructive operations. The MCP Security Guide covers MCP-specific controls.

OWASP mapping: ASI02 Tool Misuse and Exploitation, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution.

Layer 5: Orchestration and inter-agent communication

Threats: spoofed or rogue agents; tampered or replayed messages between agents; a planner agent passing its full privileges to worker agents; one agent's bad output cascading through others.

Controls: mutual authentication between agents; signed agent metadata (such as A2A Agent Cards); message integrity and anti-replay protection; separation of planning from execution with independent checks between them; circuit breakers that stop runaway workflows. See the Multi-Agent and A2A Security Guide.

OWASP mapping: ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI10 Rogue Agents.

Layer 6: Identity and credentials

Threats: agents using human credentials or shared secrets; long-lived, over-scoped tokens; credentials stored in agent configuration, prompts or memory; delegation chains that pass full privileges; permissions checked once at the start of a long workflow and never again.

Real-world pattern: in the PocketOS incident, a coding agent found an API token with unrestricted access and deleted a production volume and its backups. The model did not need to be attacked; the access was simply there.

Controls: a dedicated identity per agent; short-lived, audience-bound, task-scoped tokens; delegation that records both the user and the agent; authorisation per action; secrets kept out of the agent's context entirely. See the Agentic AI Identity Guide and AI Agent Authorisation Guide.

OWASP mapping: ASI03 Identity and Privilege Abuse, plus the OWASP NHI Top 10 risks for the underlying credentials.

How the layers combine in an attack

Most serious agent incidents follow the same chain:

An attacker places instructions in content the agent will read (Layer 1).
The model treats them as part of its task (Layer 2), sometimes saving them to memory for later (Layer 3).
The agent calls a tool to act on them (Layer 4), or instructs another agent to (Layer 5).
The action succeeds because the agent's credentials allow it (Layer 6).

Controls at Layers 1 and 2 reduce how often step 2 happens, but cannot guarantee it never does. Controls at Layers 4 and 6 decide how bad the outcome is when it does. That is why identity and tool permissions are where to invest first.

Mapping to the OWASP Top 10 for Agentic Applications

OWASP risk	Primary layer	Key identity and access controls
ASI01 Agent Goal Hijack	Inputs, model	Human approval for goal-changing and high-impact actions; limited access so a hijacked agent can do little
ASI02 Tool Misuse and Exploitation	Tools	Least privilege per tool; just-in-time, ephemeral credentials; argument validation
ASI03 Identity and Privilege Abuse	Identity	Per-agent identity; task-scoped, short-lived tokens; per-step authorisation
ASI04 Agentic Supply Chain Vulnerabilities	Tools, ecosystem	Allowlisted, signed components; vetted MCP servers; no credentials for unvetted tools
ASI05 Unexpected Code Execution	Tools	Sandboxes with no ambient credentials; egress control
ASI06 Memory and Context Poisoning	Memory	Per-user memory isolation; never store secrets in memory
ASI07 Insecure Inter-Agent Communication	Orchestration	Mutual authentication; signed agent metadata; message integrity
ASI08 Cascading Failures	Orchestration	Scoped delegation so workers never inherit full privileges; circuit breakers
ASI09 Human-Agent Trust Exploitation	Model, users	Clear separation of preview and execute; confirmation for sensitive actions
ASI10 Rogue Agents	All	Behavioural monitoring; kill switches; rapid credential revocation

Controls that span every layer

Inventory. You cannot secure agents you do not know about. See the Shadow AI and AI Agent Discovery Guide.
Threat modelling. Model each agent before deployment and whenever its tools or autonomy change. See the Threat Modelling AI Agents guide.
Human oversight in the right places. Require approval for irreversible, high-value or externally visible actions, enforced by the platform rather than the prompt. Approving every step creates fatigue and rubber-stamping.
Observability and response. Log every action with the agent identity, the delegating user and the tool, and be able to stop an agent and revoke its credentials in minutes. See the AI Agent Observability and Incident Response Guide.
Zero trust. Verify every request from every agent, as if it might be compromised. See Zero Trust for AI Agents.

A maturity path

Visibility: find every agent and AI integration, including those with OAuth access to corporate SaaS.
Containment: move agents onto their own identities with least privilege; remove shared and human credentials.
Guardrails outside the model: tool allowlists, sandboxes, policy checks and approval gates for high-impact actions.
Runtime assurance: per-action authorisation, behavioural baselines and alerting.
Resilience: tested kill switches and revocation, red teaming, and threat models kept current.

Practitioner checklist

Maintain an inventory of agents, their owners, tools, data sources and credentials.
Treat all content an agent reads, including tool descriptions and other agents' messages, as untrusted.
Keep secrets out of prompts, memory and agent configuration files.
Give each agent its own short-lived, least-privilege identity; authorise each action, not just the session.
Allowlist tools and MCP servers, sandbox code execution and restrict network egress.
Require enforced human approval for irreversible or high-value actions.
Authenticate and integrity-protect communication between agents.
Log agent, user, tool and outcome for every action; rehearse stopping an agent and revoking its access.
Threat model and red team agents before deployment and after significant changes.

Agentic AI Security Guide: Threats and Controls Across the Agent Stack