Securing AI Agents

Orient with a complete attack surface map before diving into individual threat categories — understand what you're defending.

In one week, three independent research groups dissected the conversation, tool-use, and capability layers of AI agent systems. Here's what practitioners need to know.

Agents need credentials to act. NHI (non-human identity) mismanagement is how agents get their keys stolen — start here before trust delegation.

AI agents are becoming major credential holders and API consumers. Non-human identity (NHI) security treats agent tokens with the same rigor as human credentials — and getting this wrong creates exploitable privilege escalation paths that traditional IAM never anticipated.

From NHI theory to operational practice: how to store, scope, rotate, and monitor API keys, system prompts, and ephemeral agent tokens across the full deployment lifecycle.

API keys for model providers have a blast radius unlike traditional credentials. System prompts encode proprietary business logic that teams rarely treat as secrets. This is a practical guide to treating AI credentials as the first-class secrets they are — with concrete patterns for storage, rotation, agent scoping, and incident response.

When agents call agents, trust chains form. This post explains how delegation goes wrong and what safe orchestration looks like.

When Agent A delegates a task to Agent B, the security properties of the entire system reduce to the weakest trust model in the chain. This post maps the attack taxonomy unique to orchestrator-worker architectures — privilege escalation, agent impersonation, confused deputy, tool-chain hijacking — and pairs each with concrete defenses grounded in published research.

Escalation attacks in multi-agent pipelines — the concrete exploit path when trust delegation lacks privilege boundaries.

Multi-agent architectures introduce a trust escalation problem analogous to privilege escalation in OS security. When orchestrators delegate permissions to subagents, the attack surface multiplies. This post maps the attack classes, draws the OS and service-mesh analogies, and offers concrete defenses.

The confused deputy problem applied to LLM tool use — why least-privilege is the structural fix, not prompt hardening.

A 1988 operating systems paper describes exactly the threat model facing LLM agents with OAuth integrations. Classic infosec's confused deputy maps onto AI tool use in ways most developers haven't internalized — and the mitigations that follow from it aren't the ones getting deployed.

Runtime containment: how circuit breakers interrupt runaway or compromised agents before they cause irreversible harm.

Your agent will eventually get confused. The question is whether it fails safely or catastrophically. Here are the engineering patterns — borrowed from distributed systems and adapted for AI agents — that make the difference.

Synthesises the whole picture: layered defenses across identity, tool use, memory, and network for production agent deployments.

Securing an AI agent isn't one control — it's a stack. A structured guide to layering security controls across the full agent architecture, from model selection through orchestration, tool execution, and output validation.

Caps the path: applying zero-trust network principles to AI agents — never implicit trust, always verify, least-privilege access.

Zero-trust was designed for human users on networks. AI agents break its assumptions: they act autonomously, spawn child agents, inherit permissions, and run long-lived sessions. Here's how to adapt zero-trust principles specifically for multi-agent and LLM deployment contexts.