Security for the agentic era

Introduction

AI systems are no longer just chatbots. They read files, query CRMs, write SQL, update tickets, and interact with business data. This new capability comes from modern building blocks such as frameworks, open-source libraries, and emerging protocols that make it easy to connect models to tools and databases.

Most companies now use safety-aligned LLMs with basic guardrails. That is good, but not enough. The biggest risks do not sit inside the model. They emerge in the workflow around it: connectors, memory, retrieval systems, and protocols. In this environment, a poisoned document, a booby-trapped webpage, or a poorly scoped tool can quietly leak or manipulate sensitive data. This is the security problem leaders need to understand.

Why this matters: the OWASP Foundation ranks prompt injection as the top risk for LLM applications because agents now act on what they read¹.

Why today’s AI systems have more vulnerabilities

The agentic stack is a system of many moving parts stitched together at high speed. That creates new and practical ways things can go wrong:

Untrusted inputs drive actions. Agents that can browse or read files may follow hidden instructions planted in a webpage or document. This technique, known as indirect prompt injection, has been shown to work on real websites². The content an agent consumes can silently control what it does, even if the user’s request was harmless.

Natural language to database means new injection paths. Many agents translate plain English into SQL queries to answer business questions. Recent research shows that these Prompt-to-SQL (P2SQL) paths can be exploited so that harmless requests are converted into malicious commands³. The very convenience of natural language interfaces can therefore become a new attack vector.

Poisoned knowledge bases steer answers. When agents use retrieval-augmented generation (RAG), just a small number of crafted documents in the knowledge base can bias retrieval and steer outputs for weeks⁴. A single manipulated page in an internal wiki can quietly distort many answers without detection.

New protocols expand both power and risk. Standards such as the Model Context Protocol (MCP) make it simple to connect agents to tools and data sources. This flexibility is valuable, but Microsoft and others warn that loose discovery, weak permissions, or untrusted servers can expose sensitive data and enable “tool poisoning”⁵. MCP should be treated like a production API: tools must be allow-listed, manifests signed, and privileges minimized.

Backdoors can survive fine-tuning. Studies show that sleeper behaviors—malicious instructions that activate only under rare conditions—can persist even after safety training⁶. This highlights the importance of verifying fine-tuned or open-source models rather than assuming they are safe because they passed initial checks.

Safety is not security

Safety is about reducing harmful or biased text. Security is about preventing harmful or unintended actions such as exposing sensitive data when workflows are manipulated. Guardrails help, but configuration, permissions, and inputs determine whether an agent quietly does the wrong thing.

What leaders should do now

You do not need a research lab. You need basic discipline applied to this new stack:

Scope what agents can do. Give each agent only the minimum tools and data it needs. Use short-lived credentials. Sensitive actions such as exporting customer records should require human approval or a second factor.

Lock down protocols and connectors. Use allow-lists for approved MCP servers and tools. Require signed manifests. Turn off auto-discovery of new capabilities. Monitor which tools are called, by whom, and with what prompts.

Harden memory and retrieval. Validate what gets written to long-term memory. Version and rollback so poisoning can be undone. Quarantine external sources and down-rank suspicious or newly added documents until reviewed.

Test continuously like you test software. Add adversarial tests to CI/CD. Insert a fake poisoned document and confirm the agent ignores it. Run indirect prompt injection test pages. Probe for P2SQL vulnerabilities in a safe sandbox. Verify MCP configurations restrict agents to trusted servers with least privilege. Both OWASP and Microsoft emphasize this workflow-level verification¹⁵.

Key takeaways

• Most models are safety-aligned. The risk lies in the system around them.
• Rapid adoption with connectors, protocols, and open-source glue also creates the largest attack surface.
• The business impact is data leakage and manipulation through poisoned inputs or over-privileged tools.
• Treat agent security as configuration and testing, not just prompts and policies.

Conclusion

The agentic era is here because it is fast and useful. That same speed introduces new, fixable vulnerabilities. Secure systems come from tight permissions, careful connectors, clean knowledge bases, and continuous tests that simulate real attacks. If you verify the workflow, not only the model, you will deploy AI that is genuinely trustworthy at scale.

Footnotes

1. OWASP Foundation. OWASP Top 10 for Large Language Model Applications (2025). ↩ ↩²

2. Ferrag, M. A., Tihanyi, N., Hamouda, D., Maglaras, L., & Debbah, M. (2025). From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agent Workflows. arXiv:2506.23260. ↩

3. Pedro, R. R., Coimbra, M. E., Castro, D., Carreira, P., & Santos, N. (2025). Prompt-to-SQL Injections in LLM-Integrated Web Applications: Risks and Defenses. In Proceedings of ICSE 2025. ↩

4. Zou, W., Geng, R., Wang, B., & Jia, J. (2025). PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of LLMs. In Proceedings of USENIX Security 2025. Originally posted as arXiv:2402.07867 (2024). ↩

5. Microsoft Security Research. (2025). Plug, Play, and Prey: The Security Risks of the Model Context Protocol. Microsoft Tech Community Blog. ↩ ↩²

6. Hubinger, E., Carlsmith, J., Jagielski, M., Carlini, N., Kolter, J. Z., Fredrikson, M., & Nasr, M. (2024). Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. arXiv:2401.05566. ↩