Agentic Security
Agent security does not fail in the model. It fails at the seams.
When a model can read untrusted content and call tools, security becomes a question of authority — what the system is allowed to do, regardless of what the model decides. The holes open where the agent touches the world. This is the map of where, and how.
// none of these are model bugs — they are architecture gaps
Where the holes open
The four seams
Almost every agent compromise enters through one of these. Each is a boundary where untrusted input meets real capability.
The instruction boundary
A language model has no built-in line between instructions and data. Any text it reads — a web page, a file, a tool result — can try to steer it.
Tools & MCP
The moment the model can call tools, a prompt-level trick becomes a real action. A poisoned tool or MCP server turns a description into an exploit.
Memory & retrieval
What the agent remembers or retrieves re-enters its context as if it were trusted. Poison the store once and it is believed on every later run.
Delegation & authority
When an agent acts for a principal, or hands work to another agent, authority leaks. A confused deputy acts on someone else’s behalf, with someone else’s rights.
Wire data, tools and reach together — the lethal trifecta — and a single crafted input becomes a real, unauthorized action.
The map of attacks
Named, grouped and documented
Each attack has a Knowledge Base entry with its mechanism, impact and honest support level. This is the defender's map — not a recipe.
The instruction boundary
Memory & retrieval
Where defense lives
Authority outside the model
None of the seams close by making the model smarter. They close with architecture: a deny-by-default gate the agent cannot bypass, least-privilege capabilities, information-flow control to bound exfiltration, and a finding that exists only when a verifier re-derives it from evidence.
The discipline
- ▸Untrusted input is data, never instructions.
- ▸Every tool call passes one deny-by-default gate.
- ▸Capabilities are least-privilege and attenuable.
- ▸Information flow is bounded — no silent exfiltration.
- ▸A finding needs a verifier; the rest is UNKNOWN.
A synthetic teaching example. The two lanes run the identical injected document; only the authorization point differs. When authority lives in the model, the action proceeds and the trifecta closes into exfiltration. When a deterministic deny-by-default gate sits outside the model, the same proposal is denied — persuading the model is no longer enough to cause harm.
Reading
Threat-model write-ups
Prompt injection: when data becomes instructions
A language model does not separate instructions from data. Any text that reaches the context window can steer behaviour — including text an attacker planted in a document retrieved later.
Read articleAgent authority and the lethal trifecta
When a model can plan and call tools, security becomes about authority: what the system is allowed to do, regardless of what the model decides. A family of invariants makes "allowed" precise.
Read article