What is AI agent security?
AI agent security is the practice of keeping autonomous AI systems safe, predictable, and controlled when they take actions on real systems. Agents can call tools, APIs, and workflows, so a single decision can change data or trigger operations in your environment.
An AI agent uses a large language model (LLM) to reason about a task, then plans and executes steps, like reading logs, calling a cloud API, updating a record, and sending a message, without a human running each command.Â
In cloud environments, agents run inside containers, serverless functions, or workflow engines and use service accounts, API keys, and cloud roles to access resources, making each agent a non-human identity with real permissions. The OWASP LLM Top 10 identifies prompt injection, insecure tool handling, and excessive agency as leading risk categories for AI systems, all of which apply directly to agentic deployments.
25 AI Agents. 257 Real Attacks. Who Wins?
From zero-day discovery to cloud privilege escalation, we tested 25 agent-model combinations on 257 real-world offensive security challenges. The results might surprise you đź‘€
Why AI agents create a new attack surface
AI agents introduce a different kind of risk than traditional AI models because they take actions. When an agent can call tools, trigger workflows, or use cloud APIs, any manipulation of its reasoning can turn into real changes in your environment, not just a misleading response. According to the Wiz State of AI in the Cloud 2026 report, at least 57% of organizations have deployed self-hosted AI agent technologies, and agent-driven architectures have emerged as one of the fastest-growing and least governed attack surfaces in enterprise AI.
Several properties make the attack surface larger:
Actions, not answers: A prompt injection no longer changes text; it can change state, trigger tool calls, or initiate downstream operations.
Live system access: Agents operate with credentials and roles, so their decisions run with real permissions. A single agent can also span multiple clouds and SaaS platforms, which frequently bypasses standard identity monitoring and creates severe blind spots.
Tool and API chaining: A single request may trigger multiple steps the agent chooses autonomously.
External influence: Agents can be steered through data they read, not just through direct prompts.
Persistent state: Memory and context can store instructions that shape future agent behavior, a technique sometimes called memory poisoning.
Supply chain exposure: Frameworks, plugins, and retrieval systems introduce new dependencies, each a potential entry point.
The core security question shifts from "Can someone influence the model?" to "If they do, what can the agent reach or change?" That shift, from text generation to execution with access, is what makes AI agent security a distinct discipline from traditional model security.
AI agent security threats: 6 risk categories to address
Most AI agent incidents fall into a small set of repeatable patterns. These risks matter because they translate influence over a model's reasoning into unintended actions backed by real permissions.
1. Unauthorized actions through agent logic
Small manipulations in input or context can push an agent into taking steps outside its intended scope. This may look like triggering a workflow prematurely, running destructive API calls, or chaining tools in ways the original designer never anticipated. This is business logic exploitation, not a traditional code vulnerability, which means standard application security controls often miss it entirely. This problem is exacerbated by shadow AI, when employees spin up their own agents outside security's view, each one carrying permissions no one is tracking.
2. Identity misuse and privilege escalation
Each agent is a non-human identity (NHI), and NHIs often get broad, persistent permissions granted for convenience, which makes them easy targets. If an attacker influences the agent's decision-making, they gain effective control over those privileges. A compromised agent identity can assume roles, modify resources, or provision new access paths. In cloud environments, this kind of lateral movement can escalate into full account compromise.
3. Data exposure through unbounded retrieval
Agents abstract access to data behind tools, and with the right input, an agent can be convinced to reveal sensitive data from a store, aggregate private records, or export information to an external location. This is data exfiltration through automation, not a direct database exploit, and it often leaves no obvious trace in traditional security logs.
4. Business logic bypass and silent failures
Agents embed business logic in prompts, policies, and tool definitions. If guardrails are incomplete, attackers can bypass approval gates, trigger actions without validation, or hide unsafe steps inside long tool chains. These failures often produce no logs that look overtly malicious, making them significantly harder to detect and investigate.
5. Supply chain risk through agent tools and plugins
Agents depend on frameworks, plugins, retrievers, and embedding models. If any component is compromised, the agent trusts the output, acts on tampered context, or fetches malicious data. This creates supply chain risk at the tool layer, not just the code layer, and your agent's security posture is only as strong as its least-secured dependency.Â
Compromised embedding models or retrieval systems can also deliver data poisoning that shifts agent behavior over time, a risk Wiz Research documented in its MCP security briefing when analyzing how tool-layer dependencies can introduce attacker-controlled behavior.
6. Prompt injection and model-level abuse
Prompt injection ranks among the most exploitable attack vectors in agentic deployments:
Direct prompt injection manipulates the agent's system prompt or user input to redirect its behavior, effectively hijacking the agent's reasoning loop.
Indirect prompt injection plants instructions inside external content the agent retrieves, like documents, emails, web pages, and database records, where the agent has no way to distinguish trusted instructions from attacker-controlled data.
The blast radius is significant. An agent that reads untrusted content and acts on it can exfiltrate sensitive data, modify records, or trigger downstream tool calls, all without a human in the loop. When testing 25 agent-model combinations against 257 real-world offensive security challenges, Wiz's Cyber Model Arena benchmark confirmed prompt injection attacks require dedicated controls rather than generic input filtering.
These risk categories share a structural pattern:
The model can be influenced
The agent holds real access
Tools execute the result
Understanding these patterns helps you design controls that limit what an agent can reach and validate what it does.
Best practices for AI agent security
Security for agentic workflows spans CloudSec, AppSec, and SecOps, and defining those ownership boundaries early prevents control gaps from forming. This is also where AI governance frameworks begin, with clear ownership, scoped permissions, and documented agent behavior.
The practices below map directly to the threat categories above, moving from foundational identity controls through runtime defense, a model Wiz has applied to its own security operations as AI moves to the center of how security teams work.
| Practice | Threat categories addressed |
|---|---|
| 1. Dedicated agent identities with least privilege | Unauthorized actions, identity misuse, data exposure |
| 2. Inventory of all agents and workloads | Supply chain risk, identity misuse |
| 3. Context-aware risk prioritization | Unauthorized actions, data exposure, business logic bypass |
| 4. Secure configurations and guardrails | Business logic bypass, unauthorized actions |
| 5. Runtime behavior monitoring | Unauthorized actions, business logic bypass, prompt injection |
| 6. Validation and sanitization of inputs and retrieval sources | Prompt injection and model-level abuse |
1. Establish dedicated agent identities with least privilege
The most effective way to control an AI agent is to control its identity. If the agent lacks a permission, it cannot use that permission, even if its reasoning is manipulated. Treat every agent as a first-class non-human identity with its own scoped access, never sharing keys or inheriting broad roles from a service or user account.
A secure IAM pattern for agents includes four elements:
A separate role or service account per agent, with every agent tied back to a named human owner
Least-privilege permissions scoped to actual tasks
Short-lived credentials with automatic rotation
Secrets stored in a secret manager rather than in prompts or environment variables
In cloud environments, this means using native identity primitives, like AWS IAM roles with STS temporary credentials, Azure Managed Identities, GCP Service Accounts with Workload Identity, and Kubernetes service accounts with RBAC and cloud federation such as IRSA. Regular permission reviews should ask which agent identities carry admin-level rights, which permissions go unused, and whether any agent can reach sensitive data or powerful APIs that it should not touch.
2. Inventory all AI agents and workloads
You cannot secure what you cannot see. An unknown agent with unknown permissions is an unmanaged risk, and this problem compounds quickly as organizations adopt popular agentic frameworks like LangGraph, AutoGen, CrewAI, and LlamaIndex, as well as purpose-built agentic workflows that span development and production environments.
The Wiz State of AI in the Cloud 2026 report observes a broad range of agentic frameworks and implementations across environments, with no single framework emerging as dominant, so visibility can't assume a standard stack. Each framework brings its own orchestration patterns, tool registries, and memory management, which means agents can proliferate across the broader agentic AI ecosystem without a central record of what exists. This challenge is covered in depth in Wiz's analysis of securing software in the age of agentic coding.
An effective agent inventory captures the fields that matter for risk assessment:
Owner
Purpose
Tools and APIs accessible
Permissions granted
Data stores reachable
Deployment environment
Shadow agents, which are those spun up informally or outside standard provisioning processes, are a particular concern. Treat any undiscovered or ad hoc agent as high-risk by default, as it creates the right posture and pushes teams to register agents as part of the deployment workflow rather than as an afterthought.
3. Apply context-aware risk prioritization
Not every agent misconfiguration carries the same risk, and blanket rules waste remediation time. The right frame is attack-path thinking: for each agent, evaluate risk based on what it can access and how it can act.
A high-priority combination looks like an internet-reachable agent runtime with write access to a sensitive data store, or an agent that can modify CI/CD pipelines and read production secrets. Either scenario connects external exposure to high-impact action in a way a single misconfiguration score would not capture. Prioritization should target the fix that breaks the whole attack path. This corrects the combination of permissions, access paths, and identity scope rather than resolving isolated findings one by one.
GenAI Security Best Practices [Cheat Sheet]
This cheat sheet provides a practical overview of the 7 best practices you can adopt to start fortifying your organization’s GenAI security posture. Inside you’ll find:
4. Enforce secure configurations and guardrails by default
Baseline configuration templates, whether built with infrastructure as code (IaC) or policy-as-code, give agent deployments a secure starting point. For example, with minimal permissions, no unnecessary network exposure, and restricted tool scopes. All AI-specific settings, including model permissions, input and output sanitization, and network policies, need validation before an agent or inference endpoint reaches production.
One principle that belongs in every high-stakes deployment is human-in-the-loop approval for consequential tool calls. An agent can read from a database autonomously, but writing to or deleting from that database should require explicit user approval. This scopes autonomous action to operations where the cost of a mistake is recoverable and prevents the configurations that produce the most damaging attack paths, depending on the use cases the agent supports.
5. Monitor AI agent runtime behavior for drift and misuse
Behavioral monitoring closes the gap between policy and reality. Detection works by establishing what the agent normally does and alerting on deviations, such as unusual API calls, unexpected data access patterns, and network egress to destinations outside expected behavior.Â
Effective logging for an agent-driven incident requires more than generic application logs. Minimum telemetry includes:
Agent identity
Tool calls made
Prompts received
Retrieval sources queried
Policy decisions logged
Without this data, investigating a suspicious agent action is guesswork. Combining runtime signals with identity and environment context helps security teams distinguish genuine exploitation attempts from anomalous but benign events.
Wiz's AI runtime threat detection traces activity from model input through to real-world impact. It provides the visibility level needed to investigate agentic incidents effectively. For active investigations, capabilities like Wiz Blue Agent investigate suspicious runtime activity grounded in a full graph context.
6. Validate and sanitize agent inputs and retrieval sources
Prompt injection requires dedicated controls because it operates at the content layer, not the network or identity layer. Validation for user-facing prompts should filter inputs that attempt to override the agent's system instructions or redirect its task.
Indirect injection is harder because the attack surface is everywhere the agent reads. Agents should treat all external content as untrusted, particularly when that content can influence tool calls or downstream actions. Content retrieved from documents, emails, web pages, or database records needs sanitization before it passes into the agent's reasoning loop. If the agent acts on what it reads, the pipeline delivering that content is part of your attack surface.
100 Experts Weigh In on AI Security
Learn what leading teams are doing today to reduce AI threats tomorrow.
How Wiz helps secure AI agents
AI agent security is about controlling what agents can do, not how models behave alone. The combination of identity controls, runtime monitoring, and continuous visibility is what closes the gap between agent deployment and agent security.
Wiz maps agent identities, permissions, and reachable resources into a unified security graph so teams can see where an agent's access creates a real attack path rather than a configuration finding. This view surfaces the combinations that matter in practice: an internet-reachable agent runtime with broad access to a sensitive data store or an operations agent that can modify CI/CD pipelines and read production secrets. Rather than chasing isolated findings, teams can break the whole path, with direct ownership context so the right team remediates the risk at the source.
To prevent misconfigurations from returning, Wiz maps agent identities and permissions back to the code and IaC that defined them, so you fix the template rather than just the running instance.
As part of Wiz's AI-Application Protection Platform, Wiz AI-SPM extends this model across AI resources in your cloud, detecting misconfigurations in inference endpoints, agent runtimes, and orchestration flows, including deployments without guardrails, unsafe tool scopes, or excessive access to sensitive data. For a field-ready overview, the Securing AI Agents 101 guide covers the key questions every security team should ask.
Book a demo to see how Wiz maps AI agent risk in your environment. Or, get the free AI security assessment.
Develop AI Applications Securely
Learn why CISOs at the fastest growing companies choose Wiz to secure their organization's AI infrastructure.
