An agent is a program that decides what to do next. When it holds credentials and calls tools against production systems, its behaviour becomes a security property of your infrastructure — and it is a program whose control flow is determined by text it reads at runtime.
The failure modes that matter
Prompt injection
Any untrusted content an agent reads — a web page, a code comment, an issue description, a file in a repository — can carry instructions. The model has no reliable way to distinguish "content to reason about" from "instruction to follow", because in natural language there is no such boundary.
Input filtering helps at the margins and fails against a determined attacker. The durable mitigation is to assume injection will succeed and constrain what it can achieve.
Over-broad tool access
Agents are typically given the union of every permission they might need, because scoping per-task is more work. That union is the actual blast radius of a successful injection.
Silent behavioural failure
Unlike a crash, an agent that behaves wrongly usually keeps running. It retries the same failing approach, takes a longer path than necessary, or quietly skips a step — burning tokens and time while reporting success. At scale these failures repeat thousands of times before anyone notices.
Containment that works
Scope permissions to the task
Issue credentials per run, scoped to what that run needs, expiring when it ends. This turns a total compromise into a bounded one.
Keep irreversible actions behind a human
Reading, analysing, and proposing can be autonomous. Deleting, deploying, and paying should require an approval step, because the cost of being wrong is asymmetric.
Make trajectories observable
You cannot secure behaviour you cannot see. Logging the full trajectory — every decision, tool call, and result — is what makes it possible to audit after an incident and to notice drift before one.
Treating agent output as untrusted
An agent's output is a suggestion, not an authority. Where it produces code, that code goes through the same review and test gates as anything a human wrote. Where it produces a finding, the finding is worth exactly as much as the evidence attached to it.