What is an AI Agent Security?

Agents introduce a distinct threat surface beyond a typical chatbot's, because they can execute code, call external APIs, and touch stored credentials. Prompt injection, where malicious instructions hidden in a webpage, document, or tool output attempt to hijack the agent's behavior, is the signature attack: an agent summarizing an email shouldn't suddenly forward that email's contents somewhere else because the email itself contained a disguised instruction to do so. Defense in depth is standard practice: sandboxing limits blast radius if an agent is compromised, tool permissioning requires explicit scopes rather than blanket access, credential isolation keeps one tenant's tokens from ever being reachable by another tenant's agent session, and human-in-the-loop approval gates high-risk actions like financial transactions or irreversible deletions. Verified-claim tenant scoping, deriving a tenant's identity from a signed token rather than trusting a client-supplied value, is a core control since a spoofable tenant ID would let one tenant's agent act as another's.