Securing AI agents: prompt injection, tool permissions and least privilege

A chatbot that gives a wrong answer is embarrassing. An agent that follows a malicious instruction hidden in an email, and then forwards your files, is a breach. As AI systems gain the ability to act, their security model has to change.

The OWASP Top 10 for Large Language Model Applications (2025 edition) ranks prompt injection first and lists excessive agency, meaning giving a model more permissions or autonomy than the task needs, among the top risks. The two are connected: injection is how an attacker steers the model, and agency determines how much damage the steering can do.

Why prompt injection is hard to “fix”

Language models do not reliably separate instructions from data. If an agent reads a web page, a PDF or an inbound email, text inside that content can look like an instruction. Filters help, but no filter is perfect. The practical approach is to assume some injection will get through and to design so that it cannot cause serious harm.

Six controls that limit the blast radius

1. Least privilege for tools. Give each agent only the tools and scopes its job requires. A summarising agent needs read access, not send or delete.

2. Separate identities. Run agents under their own service identities with their own permissions, not with a user’s full session. That keeps actions auditable and revocable.

3. Human approval for consequential actions. Payments, external emails, data deletion and permission changes should require a person to confirm, with the proposed action shown in plain language.

4. Treat model output as untrusted input. Validate anything the model produces before it reaches another system: parameters, URLs, code and SQL. The same rules you apply to user input apply here.

5. Constrain what it can reach. Limit outbound network destinations and the data sources an agent can retrieve from. Many exfiltration paths depend on the agent being able to fetch or post to an attacker’s URL.

6. Log and monitor. Record prompts, retrieved content, tool calls and approvals. Alert on unusual patterns, such as a sudden spike in tool calls or access to data outside the agent’s normal scope.

Test like an attacker

Before launch, and after every significant change, run adversarial tests: documents with hidden instructions, emails that ask the agent to reveal its system prompt, requests to call tools outside its role. Keep the cases in your evaluation suite so regressions are caught automatically.

The principle

Assume the model can be persuaded. Security comes from what the agent is allowed to do, not from what it is told to do.

Our Software & AI Engineering practice designs agents with these controls built in, and reviews existing AI features against them.