A standard Large Language Model (LLM) is like a very knowledgeable librarian. You can ask it anything, and it will give you a well-written answer based on the books it has read. But it can't leave the library. An AI agent, on the other hand, is like a personal assistant who has read all the books and also has a phone, a credit card, and a key to your office. It doesn't just give you information; it can book flights, send emails, and manage your files.

This ability to take action is what makes agents so powerful. It also introduces a new world of security risks. Because these risks are so unique, a dedicated group of security experts has created a guide to navigate them. It's called the OWASP Top 10 for LLM Applications, a list of the most critical security vulnerabilities for AI systems.

The most common attack is called Prompt Injection. It's a way of tricking the AI into doing something it shouldn't. There are two main flavours.

Indirect Prompt Injection is much sneakier. This happens when the agent processes information from an external source, like a website or an email, that contains a hidden, malicious instruction. The AI reads the hidden prompt and follows the attacker's orders without the user even knowing.

When an AI agent is successfully tricked by prompt injection, it becomes a classic security problem known as the Confused Deputy problem. The agent has legitimate permissions to perform actions (like sending emails or reading files), but an attacker tricks it into misusing those permissions for a harmful purpose. The agent isn't malicious, just confused about who it's supposed to be working for.

The danger isn't just about what goes into the AI, but also what comes out. Insecure Output Handling occurs when the output from an LLM isn't properly checked before being used by other systems. For example, an agent could be tricked into generating malicious JavaScript code. If that code is then automatically embedded into a website without review, it could steal user data.

This risk is magnified when agents can perform autonomous tool execution. Giving an agent access to your file system, email client, or a web browser is powerful, but it also creates a direct path for an attacker to do real damage. A tricked agent could delete files, send spam, or purchase items online.

Finally, securing AI agents is especially hard because they are non-deterministic. Unlike traditional software that behaves identically every time, an LLM might respond slightly differently to the same prompt. This unpredictability makes it difficult to create simple, foolproof rules to prevent bad behaviour.

Time to check what you've learned.

Understanding these risks is the first step in building and using AI agents safely. By being aware of how they can be manipulated, we can create better safeguards.