AI and agent security
An agent with credentials is an execution path.
AI systems read untrusted content, decide what to do with it and then act through tools that reach real infrastructure. That is not a content problem. It is an authorization problem with a language model in the middle.
Where it breaks
The boundaries that matter.
Each hop between these layers is a place where instructions, data and authority get confused with one another.
User
01Trusted and untrusted input arrive on the same channel.
Application
02Session, tenancy and rate limits still apply here.
LLM
03Instructions and data are not separated by the model.
Tools
04Where a text output turns into an action.
Internal systems
05The agent inherits whatever permission it was given.
Data
06Retrieval sources are an input path, not a passive store.
Attack paths across boundaries
User to LLM
Direct prompt injection
Data to LLM
Indirect injection through retrieved content
LLM to Tools
Tool misuse and excessive agency
Tools to Internal systems
Authorization boundary failure
Internal systems to Data
Sensitive information disclosure
None of these has a single control that removes it. Defence is layered: constrain what a model can reach, authorize every tool call as the requesting user, treat retrieved content as untrusted, and test the whole path rather than the prompt alone.
What we test
Twelve areas, tested against your system rather than a checklist.
Direct prompt injection
Instructions in user input that change how the system behaves.
Indirect prompt injection
Instructions hidden in documents, pages, tickets or emails the model reads.
Agent tool misuse
Getting the agent to call a tool with arguments it should refuse.
Sensitive information disclosure
System prompts, keys, internal records and other users' context.
RAG poisoning
Content placed into a retrieval source to influence later answers.
Authorization boundary failures
The agent acting with more authority than the requesting user.
Untrusted content execution
Model output treated as code, SQL, shell or markup downstream.
Excessive permissions
Tokens and roles handed to an agent that only needs a fraction of them.
Browser agent attacks
Pages that manipulate an agent driving a real browser session.
MCP integration security
Server trust, tool descriptions, scopes and transport handling.
Model connected application security
Everything around the model: queues, caches, webhooks, storage.
Cross user context leakage
Shared memory, caches or embeddings crossing tenant lines.
Method
Testing the system, not the prompt.
Prompt level defences are worth having and are not a security boundary. We test what the model can reach when a defence fails.
- 01
Map authority
Every tool, credential, scope and downstream system the model can touch.
- 02
Introduce untrusted content
Through the channels the system actually reads: documents, pages, tickets, records.
- 03
Chain the path
From injected instruction to tool call to data access, as one attack rather than three findings.
- 04
Report with evidence
Reproduction, the data reached and the control that would have stopped it.
Find it before someone else does.
Tell us what you need protected. We will help define the right testing scope, in writing, before anything is touched.