AI Agent Security: Prompt Injection, Tools, and Trust Boundaries
Browse articles on prompt injection, AI agent trust boundaries, tool authorization, request assembly, orchestration risk, and security controls.
Start by problem
Choose the article path by the decision or control you need first.
-
LLM Integration Trust Boundaries: Threat Modeling Before AI AgentsThreat-model the first LLM boundary before adding tools or agents
-
LLM Prompt Injection: OWASP Boundary Failures and ControlsAudit prompt injection and trust-boundary failures in agentic systems
-
Connected Apps and MCP Security: Permissions, Data, and ActionsControl tool use, connected apps, and write-path authority
Core articles
14 published articles
-
Role-Play Jailbreaks: A Testable False-Premise MechanismA research-grounded analysis of how role-play may introduce a false safety premise that changes an LLM's interpreta...
-
LLM Improper Output Handling: Risks, Controls, and Test CasesA sink-aware security model for validating, authorizing, encoding, and testing LLM output before it reaches browser...
-
LLM Prompt Injection: OWASP Boundary Failures and ControlsAn architecture-level mapping of prompt-injection-related LLM application failure modes to OWASP LLM Top 10 and NIS...
-
AI Agent Security Audit: 8 Trust-Boundary CheckpointsA practical audit of eight trust boundaries where untrusted content can influence context assembly, planning, tool ...
-
Gmail and WhatsApp AI Agents: Private-Message Security RisksHow Gmail and WhatsApp content can steer tool-using AI agents, and how least privilege, explicit approval, provenan...
-
Connected Apps and MCP Security: Permissions, Data, and ActionsSecurity analysis of connected apps, external tools, and remote MCP servers as capability, scope, approval, disclos...
-
Web Retrieval Prompt Injection Boundary in LLM SystemsA threat model for browsing-enabled and tool-using LLM systems where retrieved web content can steer routing, tool ...
-
LLM Integration Trust Boundaries: Threat Modeling Before AI AgentsWhy LLM security begins at the integration layer: it turns model inputs and outputs into access to data,...
-
AI Agent Orchestration Loops: Security Risks and ControlsHow multi-step orchestration (controller) loops change the threat model in tool-using systems, and where to enforce...
-
Social Engineering in AI Systems and Decision PipelinesThreat model of social engineering against AI decision pipelines; maps prompt injection to enforcement controls out...
-
LLM Prompt Assembly Security: Policy and Untrusted DataAn engineering guide to preventing authority confusion in prompt assembly by separating authoritative policy from u...
-
Request Assembly Threat Model for AI AgentsA reviewer-oriented threat model for request assembly in AI assistants: what enters context, what gets prioritized ...
-
LLM Boundary Assurance Failures: Client-Captured Security ReportClient-observed security report on text-only confirmations of privileged state or actions where the public article ...
-
Tool-Using LLM Systems: Privilege Bleed and Integrity-Signal FailuresTwo vendor-agnostic control-plane failure patterns—privilege persistence across interaction boundaries and non-enfo...
Section resources
Context, reusable contracts, related links, and external baselines for this topic.
About this section About this section
Scope
- Focus: security properties of LLM-powered agentic applications (orchestration/workflows, routing/selection, policy enforcement, session boundaries & context isolation, tool invocation, write-path enforcement).
- Output style: engineering-oriented; emphasis on testable claims, explicit system boundaries, and mitigation guidance.
- Public-safe disclosure: some writeups omit PoC strings and raw evidence artifacts; request private evidence under coordinated disclosure when required.
Non-goals (out of scope for this section)
- General application security guidance that is not specific to agentic applications and orchestration/control-flow.
- Model-training security or claims about mechanism-level cognition.
Reusable contracts Reusable contracts
Mapped procedures and policies
-
Choose allowed sources for factual answers
Pick a facts-only boundary (allowed sources + refusal contract).
-
Web Verification & Citations Policy
When you cite web sources, enforce verification + citation rules.
-
Security report (client-captured): control-plane assurance failures at the LLM boundary
Client-observed artifacts vs claims requiring server-side confirmation (explicitly labeled).
-
Run the engineering quality gate — procedure
Use the engineering quality gate for structural/code correctness (not writing verification).