Securing AI Agents: Prompt Injection, Tool Abuse and Zero Trust

When a language model only generates text, a failure is usually a bad answer. When an agent can read emails, browse pages and call tools, a failure can be a data leak or an unauthorised transaction. Security has to be designed in from the first line.

The core problem: instructions and data share one channel

Prompt injection happens when untrusted content, such as a web page, a PDF or an email, contains text that the model treats as instructions. An attacker does not need to break into your system; they only need to get text in front of your agent. The OWASP Top 10 for LLM Applications lists prompt injection as a leading risk.

Threats worth modelling

• Indirect prompt injection: hidden instructions in retrieved or browsed content.
• Excessive agency: an agent with more permissions than its task needs.
• Data exfiltration: secrets leaking through tool calls, links or generated output.
• Insecure tool and plugin design: tools that trust model output without validation.
• Supply-chain risk: unverified models, datasets and dependencies.

Defence in depth

1. Least privilege: give each agent a scoped identity, short-lived credentials and only the tools it needs.
2. Separate trust levels: mark untrusted content clearly, and never let it authorise actions by itself.
3. Validate everything at the tool boundary: schemas, allow-lists, rate limits and output encoding, exactly as you would for any untrusted input.
4. Human approval for risky actions: payments, deletions, external messages and permission changes.
5. Isolate and sandbox: run code and browsing in restricted environments with controlled egress.
6. Monitor and red-team: log tool calls, alert on anomalies, and regularly test with adversarial prompts.

Local deployment helps, but is not a cure

Running models inside your own perimeter reduces data exposure and gives you control over logging and updates. You still need the controls above, because the attack arrives through the content, not the network.

AI for defence too

The same technology can speed up security work: triaging alerts, summarising incidents, spotting anomalies and drafting response playbooks, with analysts approving the final actions.