9.10 Agent security
You can name the ways an agent gets hijacked and block them.
Before:08. Large Language Models
Agent security starts from one assumption: everything the model reads — retrieved documents, tool results, web pages — is a potential instruction channel. Least privilege, scoped credentials, sandboxing and egress control limit what a hijacked agent can do. It sits beside evaluation at the module's serious end. The layering rule is the point: prompt-level defences are a speed bump, and the guarantees that hold under attack are the ones enforced outside the model.
Work through these
Prompt injection through retrieved and tool content
Instructions hidden in a retrieved document or a tool result can redirect an agent that treats them as guidance. This is the central security problem of the whole field.
Least privilege, scoped credentials, allowlists
Giving an agent narrow credentials, scoped to the task and expiring quickly, with an explicit list of what it may reach. This limits what a hijacked agent can do.
Sandboxed execution and network egress control
Running agent-generated code in isolation, and controlling what it can connect to. Outbound network control is what stops a compromise becoming a data loss.
Audit logs and irreversible-action gates
A durable record of what the agent did, and a gate requiring approval before anything irreversible. These two make an incident investigable and survivable.
Sign in to keep your progress.
Free resources
We haven't checked most of these for screen reader use yet.
Links last checked 29 Aug 2026.
Stuck here?
Ask a mentor. A real person answers, and they can see exactly which topic you're on. Usually within a couple of working days.
Checking your session…
Topics shown in module order.