Security

Threats related to agents and their actions

Untrusted instructions, overpowered tools, and contaminated memory can divert an action chain.

Back to track

Objectives

  • Recognise injection, tool abuse, and excessive authority.
  • Place controls before irreversible effects.
Duration
11 min
Level
Intermediate

Prerequisites

  • Secrets, identity, and trusted context

Concepts

Concepts

  • Untrusted instruction

    Content read by an agent may try to change its objective or bypass its policy.

  • Tool authority

    Every tool should have minimum scope, validated parameters, and a decision before sensitive effects.

  • Memory boundary

    A remembered item must retain its source, date, and scope rather than become implicit truth.

  • Action integrity and human stop

    A modified destination, obsolete policy, replay, role confusion, or missing confirmation requires a new decision and, when necessary, a human stop.

Visual guide

Reducing an action threat

  1. Classify the input and retain its context.
  2. Check destination and freshness against replay.
  3. Isolate untrusted instructions and unsuitable tools.
  4. Re-evaluate policy, roles, and authority.
  5. Require confirmation or a human stop, then reconcile.

Synthetic example

Synthetic example

A fictional document tells an agent to ignore its policy and use a tool. The content remains untrusted data, not authorization.

An instruction in a source is not a policy decision.

Lesson scope

This lesson presents families of threats and general control points.

What this lesson does not demonstrate

It is not exhaustive and does not confirm that a real agent or system withstands these threats.

Check question

How should an instruction found in an external source be treated?

How should an instruction found in an external source be treated?

Choose an answer to read its feedback.

Local checklist

Control point

Identify where to stop a fictional tool scenario.

No tool, file, or service is called.

Sources and limitations

Sources and limitations

Source repository
https://github.com/SwissTokint/swisstokint-website
Source reference
codex/learning-hub-v3-autonomous-controls
Content commit
29c88f79cee07a72804bc017b92fab9200fd3734
Source version
learning-v3
  • Agentic AI — Threats and MitigationsOWASP-AGENTIC-2025
    Publisher
    OWASP Agentic Security Initiative
    Version or date
    2025-02-17
    Link verified on
    2026-08-13
    Scope used
    Emerging threats and mitigations for agentic systems.
    Limitation
    An emerging guide that is neither a standard nor exhaustive.
  • OWASP Top 10 for LLM ApplicationsOWASP-LLM-TOP10-2025
    Publisher
    OWASP GenAI Security Project
    Version or date
    2025 edition
    Link verified on
    2026-08-13
    Scope used
    Common risks in applications using language models.
    Limitation
    A community list, not an audit or certification.
  • Artificial Intelligence Risk Management Framework: Generative AI ProfileNIST-AI-600-1
    Publisher
    National Institute of Standards and Technology (NIST)
    Version or date
    2024-07-26
    Link verified on
    2026-08-13
    Scope used
    Risk categories and candidate actions for generative AI.
    Limitation
    A profile broader than agents and not evidence of a control.