AI agents: what security teams miss beyond prompt filtering

TL;DR: AI agent security cannot be reduced to prompt filtering because agents act through five attack boundaries: goals, tools, memory, identity and inter-agent communication, according to Mindgard. The article ties that exposure to real attack patterns, including indirect prompt injection, tool poisoning, persistent trust abuse and privilege misuse, and says continuous red teaming and least-privilege runtime controls are now mandatory.

Editorial analysis by NHI Mgmt Group, based on content published by Mindgard: “AI Agent Security: Risks, Attacks and How to Secure Agents”.

By the numbers:

• By the end of 2026, Gartner predicts 40% of all enterprise applications shipped will have task-specific agents baked in, compared to less than 5% in 2025.
• Unit 42 observed 22 unique payload variations in indirect prompt injection attacks hidden on live websites.
• Mindgard says a single payload accounted for 75.8% of injected pages analysed in one telemetry set.

Key questions

Q: What breaks when organisations rely only on prompt filtering to secure AI agents?

A: Prompt filtering can reduce obvious abuse, but it does not stop a compromised agent that has already accepted malicious instructions or been manipulated through its environment.

Q: Why do over-privileged AI agents create higher business risk than ordinary users?

A: Over-privileged agents can execute many more actions than the task actually requires, so one bad decision can cascade into wrong approvals, refunds, data movement, or API calls.

Q: What are the signs that AI agent security controls are too weak?

A: Common warning signs include agents accessing systems or data outside their intended scope, sharing sensitive information inappropriately, and using credentials or tools without clear justification.

Practitioner guidance

• Implement boundary-specific red teaming Test goals, tools, memory, credentials and inter-agent messages separately so you can see which boundary fails first and which one cascades into real action.
• Scope every agent to task-level authority Replace broad shared credentials with task-scoped permissions, and verify that the agent cannot reach tools or data outside the specific work item.
• Validate tool metadata before approval Review tool descriptions, registration records and mutation paths as governed inputs, because poisoned metadata can drive agent behaviour without changing the endpoint itself.

Bottom line: AI agents expand the attack surface beyond prompts into goals, tools, memory, identity and message flows, so security has to move to runtime control.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →