LEARN / PILLAR RESOURCE
AI Agent Security: Risks, Architecture and Runtime Controls
A system-level view of the attack surface created when AI moves from generating content to planning and acting across tools and environments.
The agentic attack surface
AI agent security covers the model and every component that turns its output into an outcome: prompts, retrieved context, memory, orchestration, tools, MCP connections, credentials, commands and execution environments.
Prompts, external context and models
Instructions may come from users, documents, websites, repositories and tool output. Untrusted content can influence planning or tool selection. Model controls, content boundaries and careful context handling reduce risk, but no single input control can prove the safety of every later action.
Planning and multi-step behavior
Agent behavior unfolds over a sequence. Each intermediate observation can change the next decision, and individually reasonable steps can combine into an unsafe outcome. Traceability should preserve the relationship among plan, selected capability, proposed action and result.
Tools, MCP and external services
Tools convert generated intent into operations against local or remote systems. Strong authentication, least privilege, allowlisted capabilities, parameter validation and server trust remain foundational. Review MCP security for the connection and tool boundary.
Commands, packages and local execution
Coding agents and local assistants may create shell commands, modify files, install packages or start processes. These actions can be evaluated as structured security objects, including action type, target, applicable policy and decision before execution where enforcement is supported.
Secrets and sensitive resources
Agents often operate near credentials, proprietary code and customer data. Security architecture should minimize available secrets, separate duties, constrain destinations and avoid including unnecessary sensitive values in prompts or telemetry.
Runtime controls and layered security
Identity answers who the agent is. Authorization constrains accessible capabilities. Model and prompt defenses reduce unsafe generation. Runtime controls address the concrete action approaching execution. Together, these controls provide stronger coverage than treating the model as the only boundary.
Explore runtime security foundations and the dedicated guide to AI agent runtime security.