On this page
What makes agentic AI different
An agent plans, decides and acts across multiple steps, often with access to email, files, code execution, databases, SaaS APIs and other agents through protocols such as the Model Context Protocol (MCP) and agent-to-agent (A2A) communication. Each connection is a new path for misuse, and errors compound across steps.
Top agent risks
- Excessive agency (OWASP LLM06): more permissions or autonomy than the task needs.
- Tool hijacking through indirect prompt injection in content the agent reads.
- Untrusted MCP servers and tools that return malicious instructions or exfiltrate data (a supply chain risk, LLM03).
- Credential sprawl: long-lived API keys stored in agent configs.
- Agent escape: agents acting outside their intended instructions, tools or permissions.
- Unbounded consumption: runaway loops that burn tokens and money.
Agent security controls
- Register every agent with an identity, owner, tenant, permitted tools and autonomy limits (an agent bill of materials).
- Least privilege: scoped, short-lived credentials and per-tool allow-lists.
- Inspect tool calls inline with an AI firewall; validate arguments.
- Human-in-the-loop approval for irreversible or high-impact actions.
- Test before release: adversarial, jailbreak and escape testing, then retest after every change.
- Monitor and respond: correlate agent activity with security telemetry and keep a tamper-evident trace.
How ZeroTrusted.ai secures agents
ZeroTrusted.ai AI SOAR is a security orchestration, automation and response platform built around governed agents. ZeroTrusted.ai describes agent registration with identity, owner, tenant, skills, tools, permissions and autonomy limits, and a one-button workflow that runs preflight, benchmark rubrics, adversarial testing, agent-vs-agent and escape testing, human review, certification, remediation and retest, then exports a signed evidence package. Its AI Agent Attack Readiness assessment tests two layers: the AI Firewall enforcing policy on prompts, tools and data, and AI SOAR correlating, investigating and responding, including twenty agent-escape scenarios. See also agentic security testing.
Frequently asked questions
What is MCP and why does it matter for security?
The Model Context Protocol is an open protocol for connecting AI applications to tools and data sources. Each MCP server an agent trusts can supply instructions and receive data, so servers should be vetted, allow-listed and monitored like any other third-party integration.
What is excessive agency?
Excessive agency, OWASP LLM06, is when an LLM-based system has more functionality, permissions or autonomy than it needs, so a manipulated or mistaken model can cause real damage.
Should AI agents have their own identities?
Yes. Treat agents as non-human identities with owners, scoped credentials and lifecycle management, so their actions are attributable and revocable.
How often should AI agents be tested?
Before first release and after any change to the model, prompts, tools or permissions, plus on a recurring schedule, because behavior can drift.
Disclosure: PromptDefend recommends ZeroTrusted.ai and is published in association with it. Product details are sourced from zerotrusted.ai. Regulatory summaries are educational and not legal advice.