AI agents shouldn't be a security nightmare

SECTION 1

Why AI agent autonomy changes the security equation

AI agents no longer just generate text: they read databases, call APIs, execute code, send emails and chain dozens of actions without human validation at every step. This autonomy, which is where all their value lies, removes the traditional control point of information security: the human who approves each sensitive operation before it runs.

In 2026, the question is no longer theoretical. Agents are in production in customer support, IT operations, finance and software development, connected to internal systems through the Model Context Protocol (MCP) and orchestrated by frameworks that have reached maturity such as LangGraph 1.0 or Microsoft Agent Framework, the unified successor to AutoGen and Semantic Kernel. Thoughtworks even made it a theme of its April 2026 Technology Radar: securing "permission-hungry" agents.

At Adservio, we have developed a security framework for agentic AI built on proven principles, defense in depth, least privilege, fail secure, adapted to the specifics of LLMs. This article details the threats you need to know, the six defense layers to put in place and the governance that keeps them alive over time.

SECTION 2

The seven major threats, from prompt injection to rogue agents

Before securing anything, you need to understand what threatens it. The OWASP GenAI Security project published its 2026 Top 10 risks for agentic applications, confirming what field teams were already observing: prompt injection remains the most exploited vulnerability, involved in the majority of agentic incidents recorded in production.

### Prompt injection, the number one threat

An attacker injects malicious instructions into the agent's inputs, a user request, a processed document, a fetched web page, a Slack or Teams message, to divert its behavior. OWASP now speaks of agent goal hijack: the agent pursues a goal that is no longer its owner's, while keeping all of its legitimate permissions. That is what makes the attack so dangerous: it breaks nothing, it turns the tool against its own organization.

Next come the exfiltration of sensitive data (PII, secrets, intellectual property disclosed in responses or logs), privilege escalation (chaining individually authorized tools to reach a forbidden objective), denial of service and its financial variant, cost DoS, a manipulated agent can generate tens of thousands of euros in API calls within hours, and data or memory poisoning: corruption of the RAG, the embeddings or the agent's long-term memory, which silently erodes the reliability of its decisions.

### Supply chain and agents gone out of control

Two families complete the picture: unauthorized actions (data deletion, transactions, malicious commits, emails sent on behalf of executives) and supply chain attacks, agent libraries, third-party MCP servers, compromised pre-trained models. Recent incidents involving popular packages in the agentic ecosystem have shown that a single tainted dependency is enough to propagate a malicious payload across thousands of deployments. OWASP adds the rogue agent to the list: an agent that drifts from its expected behavior and becomes an authorized, trusted, but misaligned insider threat.

@cite:comment-le-prompt-fencing-peut-contrer-les-attaques-par

SECTION 3

A six-layer defense-in-depth framework

Against these threats, no isolated measure is ever enough. At Adservio we apply a six-layer framework in which each layer assumes the previous one can be bypassed, the very definition of defense in depth.

These layers are not reserved for large enterprises: they can be rolled out progressively, starting with IAM and output filtering, which offer the best protection-to-effort ratio. The classic mistake is betting everything on a single control, a supposedly smart anti-injection filter, while neglecting permissions: it is the combination of layers that makes an attack expensive for the adversary, not the perfection of any single one.

### Identity, access and least privilege

Each agent gets a dedicated service account, granular RBAC permissions defined at the action and resource level ("read:customers", never "admin"), automatically rotated credentials managed by a secrets manager and short-lived tokens. The rule is simple: an agent must never be able to do more than its mission requires, and its permissions must expire on their own when unused.

### Filtering inputs and outputs

On the input side: length and format validation, detection of known injection patterns and maliciousness scoring by a dedicated classification model, without ever considering this filtering watertight, because prompt injection is a structural flaw of LLMs: you contain it, you do not eliminate it. On the output side: automatic PII detection and masking with tools like Presidio, secret scanning and content filtering before anything is delivered to the user, so that a successful injection does not turn into a data leak.

### Sandboxing, monitoring and governance

Execution is isolated in containers or serverless functions with limited resources, a tool allowlist, validation of every call's parameters and per-tool quotas. Monitoring logs every action in structured format, inputs, outputs, tool calls, centralized in the SIEM, with anomaly detection against a behavioral baseline. The sixth layer, governance, orchestrates the whole: human validation, kill switches and audits, detailed below.

SECTION 4

Securing MCP and tool-calling: machine identity front and center

The Model Context Protocol has established itself as the standard for connecting agents to enterprise tools and data. The good news: its specification has matured considerably on the security front. A protected MCP server now acts as an OAuth 2.1 resource server, and clients must implement Resource Indicators (RFC 8707), which bind each token to its target and prevent it from being reused from one service to another.

Still, MCP authorization remains optional, and fine-grained scoping is left to the teams. Concretely: expose only the minimum set of tools needed, require distinct scopes for each sensitive tool, validate every received parameter server-side, and treat any content returned by a third-party MCP server as untrusted input, subject to the same anti-injection filters as user inputs.

Machine identity thus becomes a first-order topic: every agent must be individually identifiable, auditable and revocable, exactly like an employee. That is the precondition for applying least privilege to entire fleets of agents rather than a handful of isolated prototypes.

@cite:resoudre-les-defis-de-securite-mcp-avec-le-modele

SECTION 5

Human oversight, kill switches and continuous compliance

Governance turns the technical layers into a living system. Human-in-the-loop is driven by a criticality matrix rather than case by case: reading a customer record, low risk, requires no validation; sending an email, medium risk, requires manager approval; modifying billing data, high risk, requires joint approval from the manager and finance; deleting a database, critical, does not happen without the CTO. The agent also escalates automatically whenever its confidence score falls below a defined threshold.

### Kill switches and rollback

Any agent deployment must be stoppable within seconds: a circuit breaker accessible to business teams, automatic deactivation on detected abnormal behavior, configurations versioned with GitOps for immediate rollback. These mechanisms are tested regularly, like a fire drill, a kill switch that has never been triggered is a kill switch presumed broken.

Add to that periodic agent red teaming, a threat model update every time a new tool is connected, and regulatory compliance: the European AI Act, whose obligations are ramping up through 2026, mandates risk documentation, effective human oversight and traceability for high-risk systems, all requirements this framework covers natively rather than as an afterthought.

SECTION 6

Case study: a customer support agent secured in production

Let's illustrate the framework with a real case: a support agent that answers customers 24/7, accesses a database of several million records and can create or modify tickets, via Slack and web chat. The priority threats identified: customer data exfiltration through prompt injection, unauthorized ticket modification, denial of service through request flooding and PII disclosure in responses.

The measures deployed run through the six layers: a service account with read-only access to customers and create/update on tickets only, with no delete permission whatsoever; inputs limited to 2,000 characters with maliciousness scoring and rate limiting at 10 requests per minute per user; automatic PII masking and ownership verification before any response, so a customer never sees another customer's data; container execution with an allowlist of five constrained tools; a real-time dashboard with alerts on costs, latency and the rate of injection attempts; and finally, human validation in Slack for email sending and a kill switch in the hands of support managers.

After six months in production: zero major security incidents, fifteen prompt injection attempts blocked, a 70% reduction in tickets handled by humans, stable customer satisfaction and costs kept under budget. Security did not curb the agent's value: it made it sustainable.

@cite:l-ia-agentique-au-travail-comment-les-agents-autonomes

SECTION 7

Making AI agents a secured asset, not a nightmare

AI agents shouldn't be a security nightmare. Five principles sum up the approach: defense in depth, least privilege, fail secure, when in doubt or on error, block rather than allow, full observability of every action, and human control maintained over critical decisions.

It is a continuous process, not a one-off project: threats evolve as fast as model capabilities, and every newly connected tool widens the attack surface. At Adservio, we support our clients from the audit of their first agents through to the industrialization of secured fleets, with a methodology proven in production. Agentic AI is the future of work: let's build it on secure, resilient foundations.

Note: The statements and opinions expressed in this article are those of the author and do not necessarily reflect the positions of Adservio.

FAQ

Frequently asked questions