Agentic AI Security Guide: Responding to Prompt Injection and Data Leaks
Agentic AI security starts with limiting both what an agent can read and what it can do. Prompt injection can redirect an agent through instructions hidden in outside content, so a warning in its prompt is not enough. Start with restricted connections, review consequential actions, and follow a clear containment process if a leak is suspected.
π Key actions at a glance
Treat instructions inside emails, webpages, and attachments as outside content, not user authorization.
Connect only the folders and functions needed; begin with read-only access where available.
Require review of the actual details before external sharing, deletion, or payments.
If a leak is suspected, stop automated runs, disconnect access, and preserve evidence.
𧩠How does prompt injection reach an agent?
Agentic AI uses tools, such as search or connected applications, to work toward a goal. Prompt injection places malicious instructions in the material an AI processes to divert it from that goal. When those instructions arrive through third-party content, the attack is called indirect prompt injection.
For a hypothetical example, an agent summarizing a supplier email encounters a request embedded in the message to send a customer list elsewhere. If it follows that text as a command, a reading task can become an unauthorized action. Familiar document formatting or inclusion in search results does not establish trust.
π Start by reducing connected permissions
An email summarizer does not need permission to send messages. Connect a task-specific folder rather than an entire account, and use redacted copies when personal identifiers are unnecessary. Keep passwords and API keys out of conversations and reference documents.
Before approving an action, check the recipient, exact attachment, and deletion target. If the service cannot restrict access or provide meaningful review, avoid connecting sensitive information to its automated actions.
π οΈ Builders must enforce controls outside the model
AI guardrails check inputs, outputs, or proposed actions. Separate outside content from trusted instructions and screen for suspicious requests, but do not rely on keyword blocking or another AIβs verdict as the only protection.
The code executing each tool should verify the user's permissions, destination, and permitted data. Require a new approval if the recipient or attachment changes after review. Protect execution logs too: they should support investigation without becoming another store of exposed secrets.
π¨ What should you do after a suspected leak?
Contain execution. Stop active and scheduled agent runs, then revoke the affected connections.
Preserve evidence. Retain the suspicious material, timestamps, tool calls, and transfer records. Deleting a chat does not recall information already sent.
Establish exposure. Determine what actually left the system and where it went. Revoke and replace exposed credentials; notify your security team for workplace incidents.
Validate before restarting. Fix the cause, test the affected path with dummy data, and reconnect only the permissions required.
Open your AI serviceβs connected-app settings and remove one permission that your current task does not need.