AI agent security.
Test the boundaries around real actions.
An agent is more than a prompt. Its tools, permissions, memory, APIs, and approval steps determine the damage a bad instruction can cause. Start with the boundaries around real actions.
Security assessments for AI-agent builders
What a useful assessment looks like
- Map the authority
Identify what the agent can read, change, send, or execute.
- Test the boundary
Use a controlled environment and synthetic data to assess trust assumptions.
- Verify the control
Confirm the application enforces permissions even when the model makes a bad choice.
Assess the agent. Not just the prompt.
Define permitted actions and the controls that must stop them. Coverage is agreed for your application, model integrations and testing environment.
- Prepare the scope
- Identify tools, data stores, user roles, tenant boundaries and approval gates. Agree synthetic data, provider constraints, stopping conditions and excluded actions.
- Test the trust boundaries
- Review prompt injection paths alongside application risks: authentication, cross-account access, retrieval permissions, exposed credentials and tool-side authorization.
- Make the evidence useful
- Distinguish observed behaviour from model speculation. Record the request, identity, permitted action, observed result and a fix at the enforcing layer.
- Plan the next check
- Agree remediation validation and regression coverage. A bounded assessment is not exhaustive model testing or a promise that prompt injection has been eliminated.
OverWatch Labs is an ISO/IEC 27001:2022 certified company. Certification covers the company’s information security management system, not a guarantee that an assessed system has no vulnerabilities.
“What happens if untrusted text becomes an instruction?”
An illustrative support agent reads a customer message and can update a record. The meaningful question is not whether the model follows the message. It is whether the system lets it exceed the user’s authority.
Choose a stage to see the decision and what to prepare. This is an illustrative scenario, not a client case study.
A document is data, not permission.
- Untrusted input
- Tool permission
- Action result
- Example input
- A retrieved customer message
- Trust decision
- Content does not grant authority
Why this matters
Map external messages, retrieved documents, and tool responses. Identify where untrusted content could influence the agent’s next action.
Authorization belongs outside the model.
- Untrusted input
- Tool permission
- Action result
- Example action
- Update a customer record
- Required check
- Caller can change this record
Why this matters
Check the tool gateway and application APIs. Keep credentials narrowly scoped and require human approval for consequential actions.
Test the denied path too.
- Untrusted input
- Tool permission
- Action result
- Test request
- A different account’s record
- Expected result
- Denied and logged
Why this matters
Use synthetic cross-account requests and an explicit deny condition. Confirm the action is blocked, logged, and understandable to the operator.
Scope the work around your situation.
Abhimanyu has performed multiple AI-agent security audits. Agent-specific coverage is agreed per system; this is not a claim of exhaustive model testing or a guarantee against prompt injection.
- Web and API foundationsAuthentication, tenant isolation, exposed endpoints, and sensitive data paths around the agent.
- Agent-specific trust boundariesReview tool permissions, prompt/data separation, approval steps, and retrieval boundaries according to the agreed scope.
- Code and integration reviewInspect the code that grants authority, handles secrets, and decides which actions require a human.
Understand the risk before the call.
Why correct code can still create unsafe workflows.
Read the guide →Ready to share the context?
Discuss your agent’s security →