Pillar · Agentic AI Security

Agentic AI Security

Crawdad Security·Published ·Updated
In short

Agentic AI security is the practice of protecting autonomous AI agents — systems that plan, call tools, and take actions on a user's behalf — from being manipulated into harmful behavior, and of limiting the damage they can do when they are. It differs from traditional AI security because an agent does not just generate text; it acts, using real credentials, across real systems. The security question shifts accordingly: not “what might the model say?” but “what will the agent do, and is anything watching the action itself?”

The field's canonical risk taxonomy is the OWASP Top 10 for Agentic Applications, published in December 2025.

Key facts

Why is securing AI agents different from securing a chatbot?

A chatbot generates text that a human reads and decides what to do with. An agent removes the human from that loop: it plans, calls tools and APIs, reads and writes data, reaches the network, and executes — often across many steps without review at each one. Three properties make this a different security problem.

Agents hold credentials. An agent that books meetings or queries databases does so as a privileged identity, often a shared key or an inherited user session. Agents can be steered by the data they read, because a model does not reliably distinguish instructions it was given from instructions embedded in the content it processes. And agents act at machine speed and scale, so a single manipulated input can trigger a cascade of actions faster than a human can intervene. The attack surface is no longer a single prompt and response; it is every tool call, every memory read and write, every hand-off to another agent, and every action taken against a real system.

What are the main threats to AI agents?

The OWASP Top 10 for Agentic Applications organizes them into ten categories (ASI01–ASI10): goal hijacking, tool misuse, identity and privilege abuse, agentic supply-chain compromise, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation, and rogue agents. Underneath the taxonomy, most attacks reduce to a few concrete mechanisms: an attacker plants an instruction in something the agent reads (a document, a tool description, a message from another agent), the agent follows it, and the agent takes a harmful action — reading a secret, sending data out, running a destructive command. The most consequential documented example is EchoLeak (CVE-2025-32711), a zero-click attack in which a single email caused Microsoft 365 Copilot to exfiltrate internal data.

How do you secure an AI agent?

The security model that has emerged through 2026 has three layers, and they are complementary rather than alternatives.

Identity and access treats each agent as a non-human identity with a defined owner and a scoped, least-privilege set of permissions. This is the necessary first layer and where much enterprise investment has gone. It answers: what may this agent reach?

Runtime protection inspects what the agent actually does — its tool calls, its data access, its network egress — as it happens, and blocks the dangerous actions. It answers: given what the agent is permitted to reach, is what it is doing right now actually safe?

Governance and observability produces the audit trail that ties behavior to a provable record, increasingly for regulatory reasons.

The critical point, and the reason all three are needed: identity governance is necessary but not sufficient. An agent can stay entirely within its permitted access and still be steered into harm — EchoLeak never exceeded its permissions. Identity controls do not inspect the action, only the entitlement. Effective agent security therefore pairs least-privilege identity with runtime inspection of the actual behavior.

What is “least agency”?

Least agency is the agentic counterpart of least privilege. It holds that an agent should be granted only the minimum autonomy required to complete a safe, bounded task — the narrowest set of tools, the least standing access, the smallest scope of action. The principle exists because the Replit incident of July 2025, in which an AI coding agent deleted a production database during a code freeze, demonstrated that a capable agent given broad standing power and no enforced boundary will eventually use that power in a way no one authorized. Constraining agency at design time reduces the blast radius of every other failure.

How does regulation affect agent security?

Recording and proving agent behavior is becoming a legal requirement, not only an engineering concern. The European Union's AI Act brings high-risk obligations into force in August 2026, including automatic recording of events over a system's lifetime — in effect an audit-trail mandate. The Colorado AI Act becomes enforceable in June 2026. Depending on context, the NIST AI Risk Management Framework, ISO/IEC 42001, and GDPR's automated-decision provisions also apply. The practical implication is that organizations deploying agents will increasingly need not only to control what agents do but to produce a verifiable record of what they did.

How Crawdad approaches agentic AI security

Crawdad provides the runtime layer of the model above: a local, on-device gateway that inspects every action an agent takes on the wire, enforces a readable policy over those actions, keeps the raw content of an agent's work on the machine by default, and writes a tamper-evident record of every decision. It operates at the action layer, complementary to agent identity — it does not replace least-privilege identity controls; it inspects whether what an agent is doing, within the access it has, is an attack. Crawdad publishes a public, reproducible benchmark of contemporary agent attacks under an open license.

Dedicated reference pages for Prompt Injection, the OWASP Agentic Top 10, Runtime Agent Security, and Non-Human Identity are being added to the Topics section.

Primary sources