Securing AI Agents: Prompt Injection, Permissions and Guardrails

Topics covered

• •Explain why a language model cannot reliably tell trusted instructions apart from the data it reads, and why that matters once it has tools
• •Distinguish direct from indirect prompt injection and recognise goal hijacking in a real workflow
• •Trace the common exfiltration channels: tool calls, links, rendered images and other outbound paths

Topics covered

• •Recognise OWASP's three root causes of excessive agency: too much functionality, too many permissions, too much autonomy
• •Design narrow, single-purpose tools and keep reading separate from writing
• •Scope credentials to the task, the user and the environment

Topics covered

• •Explain why every MCP server is third-party code plus third-party text inside your agent
• •Recognise tool poisoning, rug pulls and cross-server shadowing
• •Vet, pin and allowlist MCP servers before connecting them to agents

Topics covered

• •Decide which actions need human approval and design approval requests that people can genuinely evaluate
• •Avoid approval fatigue so that gates stay meaningful
• •Contain code-executing agents with sandboxes and outbound network controls

Topics covered

• •Log what an agent read, decided and did, so any incident can be reconstructed
• •Define practical detection signals for injection and misuse
• •Prepare a kill switch and a credential-revocation plan before you need them

Topics covered

• •Set up a safe, authorised test environment with canary data and a controlled destination
• •Run a checklist of injection and misuse attacks against a sample agent
• •Record findings with evidence, severity and root cause