Agent security: so no one can trick them

What you'll see in this lesson

1. Why an agent is easier to trick

   An agent reads third-party content and also acts: if someone slips it an order, it can carry it out with your permissions.

2. Prompt injection: direct and indirect

   Someone slips an order into what the agent reads: in the chat (direct) or hidden in a website, an email or a PDF (indirect).

3. There's no final patch: limit the damage

   The model can't reliably tell an order from data, so the real defense is limiting what it can do if it falls for one.

4. Poisoned MCP servers

   The model reads and obeys the description of each MCP tool, so a malicious server can hide orders there.

5. Exposed keys: the most expensive mistake

   A key in the code, in a .env pushed to GitHub or inside the agent's context ends up, sooner or later, in the wrong hands.

6. Isolated environment: let it work inside a box

   A sandbox limits which files the agent sees and which domains it connects to, even if it gets tricked.

7. Minimal permissions: only what's essential

   Give the agent just what its task needs: OWASP calls giving it more «excessive agency» (LLM03).

8. Human approval and logs

   Anything that can't be undone is approved by a person, and every action the agent takes is logged.

9. Summary: agents that don't get fooled

   Design as if the agent will be tricked: if it falls for something, it shouldn't be able to do serious harm.