How do you secure AI agents?
By Nick Jang, founder of MINERVA Studio ·
The short answer
AI agent security is protecting systems in which an AI model doesn't just answer but acts: reads files, calls APIs, sends messages, moves money. The core problem is that an agent can be steered by anything it reads, so a hidden instruction in an email or web page can turn its own permissions against you. The controls that work are mostly structural rather than clever: give each agent its own identity and only the permissions it needs, check every tool call against a written policy before it runs, hold irreversible actions for a person, watch what it does, and keep a way to stop it at once. OWASP's Top 10 for Agentic Applications and NIST's 2026 agent security work are the main references.
The main threats
| Threat | What happens |
|---|---|
| Goal hijack (prompt injection) | Instructions hidden in content the agent reads redirect what it's trying to do. |
| Tool misuse | The agent calls a legitimate tool in a harmful way, or with arguments it shouldn't. |
| Identity and privilege abuse | The agent acts with more access than its task needs, often a person's own credentials or a shared service account. |
| Memory and context poisoning | False information planted in what the agent remembers or retrieves shapes later decisions. |
| Supply chain | A malicious or compromised plugin, tool server or model the agent depends on. |
| Unexpected code execution | The agent writes and runs code that does something it shouldn't. |
| Cascading failures | One agent's error spreads through others that trust its output. |
| Rogue agents | An agent acting outside its intended purpose, through compromise or drift. |
The full list, with the other two categories, is in the risks of agentic AI.
Controls that work
- An identity per agent. Not a person's login and not a shared account. Each agent's actions should be traceable to it and to the person or system it works for. Singapore's 2026 agentic framework and NIST's identity and authorization work both point here.
- Least privilege, short-lived. Only the tools and data the task needs, with credentials that are scoped, time-bound and revocable.
- A policy check on every tool call, before it runs, against rules written down and decided by someone accountable, deny by default. See policy as code.
- Human approval at the right checkpoints: payments, external messages, deletions, anything irreversible or above a limit.
- Separate content from instructions where possible, and treat everything the agent reads as untrusted.
- Sandbox code execution and limit network access.
- Vet tools and plugins like any other software supplier, and pin their versions.
- Log every decision with its inputs, and monitor for unusual patterns.
- A kill switch held by a named person.
- Red team the agent before launch and after changes; see AI red teaming.
Prompt-level defences, such as telling the model to ignore injected instructions, help but can be bypassed. Singapore's framework makes the same point: a control built into the system's structure, like a tool the agent simply doesn't have, is stronger than one written into a prompt. See AI guardrails.
What the references say
- OWASP publishes the Top 10 for Agentic Applications (December 2025) and the LLM Top 10; see the OWASP Top 10 for LLMs.
- NIST's CAISI asked for input on securing AI agent systems in January 2026 and launched the AI Agent Standards Initiative in February, with security and identity as one of its three workstreams; see NIST and agentic AI.
- Singapore's IMDA published the Model AI Governance Framework for Agentic AI, updated in May 2026, with detailed practices on identity, permissions and approvals.
- OSFI's 2026 AI bulletin sets technology and cyber practices for generative and agentic AI at Canadian banks and insurers.
MINERVA gives each agent an identity bound to its policy, checks every tool call against that policy, holds high-risk calls for a named approver, keeps a kill switch with a named person, and records every decision. See Know Your Agent.
Related questions
What is the biggest security risk with AI agents?
Goal hijacking through prompt injection: instructions hidden in content the agent reads can redirect it to use its own permissions against its owner. Limiting those permissions and checking each action matters more than trying to filter every input.
How do you secure an AI agent?
Give it its own identity and only the permissions it needs, check every tool call against a written policy, require human approval for irreversible actions, sandbox code, vet its tools, log and monitor its decisions, keep a kill switch and red team it.
Should an AI agent use a person's credentials?
It's better not to. A separate identity with scoped, short-lived permissions makes the agent's actions traceable and limits the damage if it is manipulated.
Are there standards for AI agent security?
Not finished ones. OWASP's Top 10 for Agentic Applications is the most used checklist; NIST launched an AI Agent Standards Initiative in February 2026; Singapore's agentic AI framework gives practical controls.
Sources
- OWASP GenAI Security Project — Top 10 for Agentic Applications
- NIST — CAISI request for information about securing AI agent systems (12 January 2026)
- NIST — Announcing the AI Agent Standards Initiative (17 February 2026)
- IMDA — Model AI Governance Framework for Agentic AI, version 1.5
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.