Cybersecurity Recommendations for Securing AI Agents

Abstract: AI agents introduce a distinct risk profile because they can ingest untrusted content, reason over enterprise data, and take actions through tools, APIs, and automated workflows. Securing them requires combining traditional cybersecurity controls with AI-specific protections against prompt injection, tool misuse, excessive agency, memory leakage, and model or supply chain compromise. This white paper provides practitioners with a set of controls—along with a secure by default checklist—that can help them secure AI agents in their enterprises.

Introduction

Following the mass adoption of generative artificial intelligence (AI), AI agents have become the center of attention in the quickly evolving AI landscape. Within the next two years, agentic AI is expected to become nearly ubiquitous, with three in four companies using it at least moderately.¹

With great opportunity, however, comes great risk. Since AI agents can perceive, reason, and act on their own, how are they secured? Do they know to secure themselves? Indeed, practitioners have reason to be concerned. In July 2026, an agentic AI infiltrated Hugging Face production infrastructure before another AI system was able to detect and flag the intrusion.² Enterprises are now in the age of AI battling AI. Securing AI agents is crucial to protecting autonomous software from being manipulated to perform unauthorized actions or steal enterprise data, which can lead to financial loss, brand damage, and compliance issues.

This white paper provides a solid foundation of controls, explains their importance in securing AI agents, and includes a checklist for quickly assessing what areas are missing in an existing program. Figure 1 shows a high-level overview of the topics addressed by the controls. Note that these recommended controls are intended for securing AI agents, not agentic AI specifically.

Figure 1: Overview of Topics

Securing AI Agents

Practice Categories and Controls

The controls for securing AI agents are classified into 11 practice categories. Figure 2 describes each category and its rationale for inclusion.

Figure 2: Practice Categories

Practice Category	Rationale
Governance, Asset Inventory, and Risk Ownership	Without asset visibility and ownership, organizations cannot consistently manage agent risk, monitor changes, or respond to incidents.
Secure AI Development, Change Management, and Continuous Assurance	AI security risk changes continuously across the system life cycle. Many failures are introduced not by the model itself, but by how the AI system is built, deployed, updated, connected to tools, and maintained.
Strong Identity, Authentication, and Authorization	Compromise of an overprivileged agent identity can enable rapid unauthorized actions across connected systems.
Network Segmentation, Isolation, and Sandbox Execution	Most severe agent incidents occur when untrusted model outputs can directly reach powerful execution environments or internal networks.
Defense Against Prompt Injection and Untrusted Content	Prompt injections are a primary AI agent threat because attackers can weaponize content in addition to software flaws.
Data Protection, Secrets Management, and Memory Security	AI agents often combine sensitive information from multiple systems. Poor memory and data handling can create privacy, confidentiality, and compliance failures. Appendix A: Data Classification and Handling Guide includes detailed guidance on data classification and handling.
Secure Tool and API Integrations	Tool integrations are the “actuator surface” of the agent. This is where model mistakes can become operational incidents.
Policy Enforcement, Output Control, and Human Oversight	Critical decisions must be enforced through deterministic controls.
Logging, Monitoring, Detection, and Incident Response	Agent failures can be difficult to interpret without detailed telemetry and preplanned response workflows.
Model, Provider, and Software Supply Chain Security	A trusted agent can be undermined by compromised dependencies, malicious plugins, or unmanaged provider behavior.
Reliability, Resilience, Kill Switches, and Safe Degradation	Operational resilience is a core part of AI security. Fast containment and graceful degradation reduce the blast radius of failures or attacks.

Each practice category includes a set of related controls (detailed in figure 3).

Figure 3: Controls for Each Practice Category

Practice Category	Related Controls
Governance, Asset Inventory, and Risk Ownership	Maintain a current inventory of AI agents, models, tools, plugins, vector stores, memory stores, data sources, data lineage documents, and external providers. Define trust boundaries across users, the agent runtime, the model provider, the orchestration layer, the tool execution layer, enterprise systems, and human approval interfaces. Assign clear control ownership for deployment approval, tool access scope, monitoring, incident response, and risk acceptance. Establish agent identities, acceptable use policies, and prohibited actions for agents with clear agent goals. Require periodic security and risk reviews before expanding agent capabilities. Align governance to enterprise security, privacy, legal, and third-party risk programs.
Secure AI Development, Change Management, and Continuous Assurance	Integrate AI agents into the secure system development life cycle (SDLC), applying secure by design and privacy by design principles with controlled development, testing, and production release processes. Threat model each agent workflow, including user input, retrieval, memory, inference, tool calls, application programming interfaces (APIs), human approvals, output delivery, tenant boundaries, and privileged actions. Address AI-specific threats such as prompt injection, indirect prompt injection, data exfiltration, server-side request forgery (SSRF), memory poisoning, cross-user or cross-tenant leakage, excessive permissions, malicious tool output, model inversion, unsafe file ingestion, and compromised third parties. Separate reasoning, retrieval, and action execution into controlled stages, with least-privilege tool access, external policy enforcement, and explicit authorization for high-impact actions. Apply formal change management for prompts, models, policy logic, tool permissions, memory configuration, retrieval pipelines, orchestration logic, external providers, and action scope. Maintain version control, approval history, auditability, and rollback capability for prompts, policies, model versions, orchestration logic, evaluation datasets, configurations, and infrastructure as code (IaC). Perform conventional security testing, including code review, static application security testing (SAST), dynamic application security testing (DAST), software component analysis (SCA), API testing, secrets scanning, dependency scanning, IaC scanning, container scanning, and cloud configuration review. Conduct AI-specific adversarial testing for jailbreaks, prompt injection, data exfiltration, unsafe tool use, memory poisoning, cross-user leakage, SSRF, malicious document ingestion, guardrail bypass, and unauthorized actions. Maintain large language model (LLM)-specific regression tests for known attack patterns, policy bypasses, guardrail failures, sensitive data exposure, tool misuse, retrieval manipulation, and memory misuse. Validate privacy and confidentiality controls, including data minimization, sensitive data filtering, output limits, differential privacy or privacy-preserving techniques (where applicable), and prevention of unauthorized disclosure. Reassess risk and retest controls when models, prompts, tools, permissions, memory behavior, retrieval sources, providers, deployment environments, or the action scope change. Continuously monitor deployed agents for anomalous behavior, tool usage, policy violations, retrieval activity, memory access, guardrail failures, unsafe outputs, and emerging attack patterns. Conduct behavioral, performance, and governance drift detection to identify degradation in quality, bias, policy adherence, refusal behavior, tool-use behavior, and safety controls. Manage AI supply chain risk across models, datasets, plugins, APIs, libraries, containers, external providers, and infrastructure dependencies. Establish security release gates, rollback procedures, and incident response integration for AI-specific failures such as data leakage, prompt injection compromise, unsafe tool execution, or provider compromise.
Strong Identity, Authentication, and Authorization	Use per-agent and per-workload identity; do not share accounts or long-lived tokens. Prefer workload identity and federated access over static credentials. Issue short-lived credentials with automatic rotation. Apply least-privilege controls to every tool, API, knowledge source, and data store the agent can access. Use role-based access control (RBAC)/attribute-based access control (ABAC) and “just-in-time” elevation for sensitive functions. Require multifactor authentication (MFA) for operators and administrators. Separate identities for human users and functions and the agent runtime, tool runner, and admin/operator. Enforce authorization checks not only for tools, but also for memory retrieval and context access.
Network Segmentation, Isolation, and Sandbox Execution	Run tool execution, code interpretation, browser automation, and file parsing in sandboxed environments such as containers, virtual machines (VMs), or microVMs. Restrict sandboxes with read-only file systems (where feasible), prohibit privileged containers, and limit system calls (syscalls), ephemeral execution, and no default egress. Place agent infrastructure in segmented networks. Restrict outbound traffic to approved domains, APIs, and destinations. Route outbound requests through inspection or proxy layers when practical. Block access to internal admin interfaces, metadata services, and nonapproved internal network resources. Separate reasoning from execution so the model cannot directly invoke unrestricted actions.
Defense Against Prompt Injection and Untrusted Content	Treat all external content as untrusted input, including webpages, emails, PDFs, retrieved documents, user attachments, and tool outputs. Prevent external content from overriding system or developer instructions. Use content boundaries, contextual labeling, and instruction hierarchy enforcement. Limit agent behavior with allowlisted tools and explicit action constraints. Filter inputs and outputs for exfiltration attempts, credential requests, policy bypass language, and hidden or obfuscated instructions. Do not let retrieved content directly trigger actions without a separate policy decision. Track data provenance and source trust levels so that low-trust content does not receive high action authority.
Data Protection, Secrets Management, and Memory Security	Never place secrets in prompts. Use a secrets manager and scoped tokens for all credentials. Apply data classification, minimization, retention limits, and encryption for prompts, logs, traces, memory, and outputs. Redact or tokenize sensitive data in logs and observability platforms. Isolate memory and context by tenant, user, and use case. Apply retention limits and time to live (TTL) values to persistent memory. Require authorization checks before an agent can retrieve stored memory or prior interactions. Prevent cross-session and cross-tenant leakage. Validate the provenance and integrity of stored memory and retrieved context to reduce poisoning risk.
Secure Tool and API Integrations	Put agent-accessible tools behind an API gateway, action broker, or policy enforcement layer. Validate requests with authentication, authorization, schema enforcement, parameter constraints, quotas, and rate limits. Use explicit allowlists for domains, endpoints, commands, repositories, and file paths. Block dangerous primitives such as arbitrary shell access, unrestricted file reads, and unrestricted URL fetches. Protect against SSRF, internal reconnaissance, and unintended access to cloud metadata services. Validate outputs from tools before using them as context for later decisions.
Policy Enforcement, Output Control, and Human Oversight	Implement a deterministic policy enforcement point (PEP) between agent outputs and action-capable systems. Ensure the PEP validates the action type, target system, actor identity, authorization, business rules, risk thresholds, and required approvals. Require human in the loop (HITL) approval for destructive, financial, legal, regulated, or irreversible actions. Use step-up authentication, dual control, or transaction confirmation for sensitive workflows. Present clear execution summaries so humans can verify exactly what will happen. Support read-only mode or recommendation-only mode for higher-risk agent use cases.
Logging, Monitoring, Detection, and Incident Response	Log, with redaction where needed, prompts, responses, retrieved sources, content hashes, tool invocations, action decisions, approvals, the identity context, and policy violations. Use centralized, tamper-resistant logging. Monitor for unusual tool use, excessive data retrieval, repeated bypass attempts, anomalous outbound traffic, sudden changes in model behavior, and abuse patterns. Create agent-specific incident response playbooks such as playbooks for prompt injection, tool compromise, model/provider compromise, data leakage, cross-tenant exposure, and memory poisoning. Define escalation paths and containment procedures, including disabling tools or shifting the agent to read-only mode.
Model, Provider, and Software Supply Chain Security	Pin and verify versions of models, model endpoints, embeddings, frameworks, plugins, and dependencies. Use software bill of materials (SBOM), AI bill of materials (AI-BOM), dependency scanning, artifact signing, and provenance validation. Restrict who can publish or update tools, prompts, agent policies, and integrations. Vet third-party model and tool providers through supplier risk assessment. Contractually define security-related obligations such as data handling, retention, model training use, security controls, residency, and breach notification. Monitor for provider-side changes, behavior drift, or endpoint spoofing. Maintain rollback capability for model or tool changes.
Reliability, Resilience, Kill Switches, and Safe Degradation	Implement rate limits, quotas, token budgets, conversation limits, timeouts, retries with caps, and circuit breakers. Add global and per-capability kill switches to disable unsafe agent behavior quickly. Support rollback of model versions, prompts, policies, tool permissions, and dependencies. Design safe fallback modes such as read-only mode, recommendation-only mode, and manual approval mode; ensure critical workflows can revert to manual operation if the agent is disabled.

Secure by Default Checklist

The checklist in figure 4 is designed to help practitioners ensure that security measures are fundamentally integrated into AI agents, thereby minimizing vulnerabilities from the outset.

Figure 4: Secure by Default Checklist

✅	Inventory all agents, tools, models, memory stores, and providers.
✅	Define trust boundaries and owners.
✅	Use per-agent identity and least privilege.
✅	Prefer short-lived credentials and federated identity.
✅	Employ sandbox execution and segment networks.
✅	Deny outbound access by default.
✅	Treat all retrieved content and tool output as untrusted.
✅	Protect memory with tenant/session isolation and retention controls.
✅	Put all tool actions behind a policy enforcement point.
✅	Require human approval for high-risk actions.
✅	Log prompts, tool calls, decisions, and approvals with redaction.
✅	Pin models and dependencies; use SBOMs and signing.
✅	Integrate secure SDLC and change control.
✅	Conduct red team exercises continuously for prompt injection and tool misuse.
✅	Add kill switches, rollback capability, and safe-mode operations.

Conclusion

AI agents can create significant business value, but their ability to reason, retrieve information, and take action also expands the enterprise attack surface. Traditional cybersecurity practices remain essential, but they must be adapted for agent-specific risk, such as prompt injection, excessive permissions, unsafe tool execution, memory leakage, model drift, and supply chain compromise.

Securing AI agents therefore requires a layered, secure by default approach. Organizations should establish clear governance and ownership, apply strong identity and least-privilege controls, isolate execution environments, protect sensitive data and memory, enforce policies before actions occur, monitor agent behavior continuously, and maintain resilience mechanisms.

Ultimately, AI agent security is not a one-time implementation effort. As models, tools, data sources, and workflows evolve, controls must be reviewed, tested, and improved continuously. By embedding these practices into enterprise security, privacy, development, and risk management programs, organizations can enable AI agents responsibly while reducing the likelihood and impact of misuse, compromise, or unintended behavior.

Appendix A: Data Classification and Handling Guide

Mature data practices are crucial to achieve strong AI governance. A data classification scheme and recommendations for the proper storage and handling of data throughout its life cycle is shown in figure 5.

Figure 5: Data Classification and Handling Guide

Data Class	Examples	Store	Send	Access	Keep	Dispose
PUBLIC	Public website content Press releases Published brochures Approved job postings	Store data in approved business systems. Protect from unauthorized changes.	Data can be sent through normal business and public channels.	Data is public as approved. Edit access should be limited.	As useful for business, archival, or legal needs	Follow normal disposal methods for data that is no longer needed.
INTERNAL	Internal procedures Org charts Team documents Routine internal email Meeting notes	Store data in approved company systems only. Avoid personal or unapproved cloud storage.	Data can be sent through approved company email, chat, and collaboration tools.	Employees and approved third parties with business need can access data.	Per business retention schedule	Follow standard deletion methods. Shred paper if needed.
CONFIDENTIAL	Customer records Employee records Contracts Financial reports Nonpublic strategy documents Most personal data	Store data in approved managed systems only. Encryption at rest is required.	Data can be sent through approved secure methods only. It must be encrypted in transit, and recipients must be verified.	Access is for authorized users only and based on role. It should be logged and reviewed.	Per documented retention schedule only	Follow secure deletion methods. Approved shredding and secure wipe should be used where needed.
RESTRICTED/HIGHLY SENSITIVE	Health data Special category personal data Government ID numbers Payment data Passwords Cryptographic keys M&A data Security investigation files	Store data in explicitly approved and tightly controlled systems only. Strong encryption is required.	Data can be sent through approved secure transfer methods only. Recipient identity and authorization must be confirmed.	Strict need-to-know, formal approval, MFA, and tightly controlled privileged access are required.	Shortest justified retention period	Follow verified secure destruction methods. Sanitize or destroy media as required.

Endnotes

¹ Deloitte, “The State of AI in the Enterprise,” January 2026
² Osborne, C.; “An AI agent breached Hugging Face before an AI defender caught it: What users should do next,” ZDNet, 23 July 2026