The 2025 OWASP Top 10 for LLM and generative AI applications identifies prompt injection, sensitive information disclosure, supply-chain risk, improper output handling, excessive agency, vector and embedding weaknesses, and unbounded consumption among the major risk categories. These risks become more consequential when a model is connected to tools.
An agent is not simply a chatbot with better instructions. It is an application that combines probabilistic model output with deterministic software, identities, data, and side effects. Security therefore depends on how the surrounding system constrains the model when it is wrong, manipulated, or uncertain.
Prompt injection is an input problem and a trust problem
Prompt injection can arrive through direct user instructions or indirectly through content the system retrieves, such as documents, websites, tickets, and email. An instruction embedded in data may attempt to override the application's intended behavior, disclose information, or trigger a tool call.
No prompt can guarantee that another prompt will never influence a model. Teams should reduce reliance on model obedience by separating instructions from data where possible, labeling provenance, restricting retrieved content, validating proposed actions, and requiring deterministic authorization outside the model.
Give every tool a narrow contract
A general-purpose service account gives an agent a large blast radius. Prefer purpose-built tools with small input schemas, explicit output schemas, bounded operations, and identities scoped to the minimum resources required. A tool for checking invoice status should not also be able to modify payment instructions.
Validate tool arguments independently of the model. Enforce allowed values, resource ownership, transaction limits, and business rules in application code. If an action is high impact, irreversible, externally visible, or difficult to verify, place a human approval gate before execution.
Control retrieval and memory as data systems
Vector stores and agent memory are data repositories, not neutral model accessories. Apply tenant isolation, access control, retention, deletion, encryption, provenance, and ingestion validation. Retrieval should honor the user's permissions at query time rather than assuming that indexing-time access was sufficient.
Long-term memory deserves particular skepticism. Store only what the workflow requires, distinguish user assertions from verified facts, and make memory reviewable and correctable. Otherwise, an early error or malicious instruction can quietly shape later decisions.
Validate outputs before they cross a trust boundary
Improper output handling occurs when downstream software treats model-generated content as trusted code, markup, commands, or structured data. Use schema validation and context-appropriate encoding. Do not send raw model text into a shell, database query, browser DOM, or privileged API.
For decisions presented to people, include the evidence needed for review. A citation is not automatically correct merely because it looks plausible; retrieval systems should retain source identifiers and verify that cited passages support the output.
Design for observation and recovery
Agent traces should connect the user request, retrieved sources, model and prompt versions, proposed actions, approvals, tool calls, and resulting changes. Logs must avoid becoming an uncontrolled copy of sensitive prompts and responses, so retention and access need the same care as the production data path.
Operational safeguards include rate and cost limits, concurrency controls, timeouts, circuit breakers, replay protection, kill switches, and rollback procedures. Unbounded consumption is both a reliability concern and a security concern when attackers can force expensive loops or oversized context processing.
Agentic AI security checklist
- Inventory every model, retrieval source, memory store, tool, identity, and external service in the agent path.
- Treat user, retrieved, and model-generated content as untrusted at each boundary.
- Use narrowly scoped tools and service identities with explicit input and output schemas.
- Enforce authorization and business rules in deterministic code outside the model.
- Require approval for consequential, irreversible, external, or difficult-to-verify actions.
- Test direct and indirect prompt injection, data leakage, tool abuse, malformed output, and runaway loops.
- Log enough context to reconstruct an action while controlling sensitive-data exposure and retention.
- Provide rate limits, budget limits, circuit breakers, revocation, and a tested recovery procedure.
The architecture test
Ask what happens if the model is confidently wrong or follows a hostile instruction. If the answer is that a highly privileged action executes immediately, the design is depending on model behavior where it should depend on system controls.
Secure agentic systems make authority explicit. They limit what can be seen, what can be proposed, what can be executed, and what requires a person. That discipline allows teams to gain useful automation without turning every model failure into an operational incident.