AI Agent Security Articles on Prompt Injection and Tool Use
Technical articles on AI agent security, prompt injection, trust boundaries, authorization, tool-use controls, orchestration risks, and agent workflow failures.
Start by problem
Choose the article path by the decision or control you need first.
-
LLM Integration Trust Boundary: Threat Modeling Before AI AgentsThreat-model the first LLM boundary before adding tools or agents
-
LLM Prompt Injection: 10 Boundary Failures and ControlsAudit prompt injection and trust-boundary failures in agentic systems
-
Connected Apps and MCP Security: Permissions, Data, and ActionsControl tool use, connected apps, and write-path authority
Core articles
-
LLM Improper Output Handling: Risks, Controls, and Test CasesA sink-aware security model for validating, authorizing, encoding, and testing LLM output before it reaches browser...
-
LLM Prompt Injection: 10 Boundary Failures and ControlsAn architecture-level mapping of prompt-injection-related LLM application failure modes to OWASP LLM Top 10 and NIS...
-
AI Agent Security Audit: 8 Trust-Boundary CheckpointsA practical audit of eight trust boundaries where untrusted content can influence context assembly, planning, tool ...
-
Gmail and WhatsApp AI Agents: Security RisksHow Gmail and WhatsApp content can steer tool-using AI agents, and how least privilege, explicit approval, provenan...
-
Connected Apps and MCP Security: Permissions, Data, and ActionsSecurity analysis of connected apps, external tools, and remote MCP servers as capability, scope, approval, disclos...
-
Web Retrieval Prompt Injection Boundary in LLM SystemsA threat model for browsing-enabled and tool-using LLM systems where retrieved web content can steer routing, tool ...
-
Request Assembly Threat Model for AI AgentsA reviewer-oriented threat model for request assembly in AI assistants: what enters context, what gets prioritized ...
-
LLM Prompt Assembly Security: Policy and Untrusted DataAn engineering guide to preventing authority confusion in prompt assembly by separating authoritative policy from u...
-
Social Engineering in AI Systems and Decision PipelinesThreat model of social engineering against AI decision pipelines; maps prompt injection to enforcement controls out...
-
LLM Boundary Assurance Failures: Client-Captured Security ReportClient-observed security report on text-only confirmations of privileged state or actions where the public article ...
-
LLM Integration Trust Boundary: Threat Modeling Before AI AgentsWhy agent-layer threat modeling is incomplete: the first high-leverage control point is the LLM integration trust b...
-
AI Agent Orchestration Loops: Security Risks and ControlsHow multi-step orchestration (controller) loops change the threat model in tool-using systems, and where to enforce...
-
Tool-Using LLM Systems: Privilege Bleed and Integrity-Signal FailuresTwo vendor-agnostic control-plane failure patterns—privilege persistence across interaction boundaries and non-enfo...
Section resources
Context, reusable contracts, related links, and external baselines for this topic.
About this section About this section
Scope
- Focus: security properties of LLM-powered agentic applications (orchestration/workflows, routing/selection, policy enforcement, session boundaries & context isolation, tool invocation, write-path enforcement).
- Output style: engineering-oriented; emphasis on testable claims, explicit system boundaries, and mitigation guidance.
- Public-safe disclosure: some writeups omit PoC strings and raw evidence artifacts; request private evidence under coordinated disclosure when required.
Non-goals (out of scope for this section)
- General application security guidance that is not specific to agentic applications and orchestration/control-flow.
- Model-training security or claims about mechanism-level cognition.
Reusable contracts Reusable contracts
Mapped procedures and policies
-
Choose allowed sources for factual answers
Pick a facts-only boundary (allowed sources + refusal contract).
-
Web Verification & Citations Policy
When you cite web sources, enforce verification + citation rules.
-
Security report (client-captured): control-plane assurance failures at the LLM boundary
Client-observed artifacts vs claims requiring server-side confirmation (explicitly labeled).
-
Run the engineering quality gate — procedure
Use the engineering quality gate for structural/code correctness (not writing verification).