Guides 3 min read

AI agent security: prompt injection, permissions, leaks

AI agents with tool access are a new attack surface. What prompt injection is, why Gartner ties 25% of breaches to agents by 2028, and how to protect yours.

by Tsunami Digital Team August 8, 2026

AI agent security is the practice of protecting AI agents - software that reads your data, uses tools, and acts in your systems - from manipulation, data leakage, and abuse. An agent with access to your inbox, database, and APIs is a new attack surface your firewall was never designed to see.

What is prompt injection?

Prompt injection is an attack where malicious instructions are hidden inside content an AI reads - an email, a web page, a PDF - so the model treats attacker text as a command. OWASP ranks it the top risk for LLM applications, and it is not theoretical. In June 2025, researchers at Aim Security disclosed EchoLeak (CVE-2025-32711), a zero-click flaw in Microsoft 365 Copilot: one crafted email could make Copilot leak internal data - no click required. Microsoft patched it before known abuse, but the attack class clearly works.

How big is the risk?

Gartner predicts that by 2028, 25% of enterprise breaches will be traced back to AI agent abuse, by external attackers and malicious insiders alike. Its April 2026 forecast adds: by 2028 a quarter of enterprise generative AI apps will see five or more minor security incidents a year (9% in 2025), and by 2029 15% a major one annually. That is not a reason to avoid AI agents - it is a reason to deploy them like any system that touches money and data: deliberately.

The three-ingredient no-go zone

An agent becomes dangerous when three things meet in one workflow: access to sensitive data, exposure to untrusted content, and the ability to communicate externally. Security researcher Simon Willison calls this the “lethal trifecta”; Gartner calls the combination a “no-go zone” - together, the three form a ready-made exfiltration channel. The practical rule: any agent may have two of the three. If a use case needs all three, redesign it - split the workflow, add an approval step, or remove the external channel.

How to secure an AI agent

Least privilege. The agent gets its own narrowly scoped identity - not an employee’s inherited role.
Treat all external content as untrusted input - every email, document, and page it reads.
Human approval for irreversible actions: payments, deletions, sending data outside.
Log every tool call so you can audit what the agent did and why.
Limit egress - an agent that cannot reach arbitrary URLs cannot leak to them.
Red-team before launch and monitor in production, especially MCP-connected agents with many tools.

This is standard security discipline applied to a new component - and under NIS2, agent incidents are reportable like any other.

Frequently Asked Questions

What is prompt injection? An attack that hides malicious instructions in content an AI reads, tricking it into following the attacker instead of the user. OWASP ranks it the top LLM risk.

Can prompt injection be fully prevented? No - no reliable filter exists yet, so defenses limit what a compromised agent can do: permissions, approvals, egress control.

Are AI agents safe for business use? Yes, when scoped properly. The risk comes from combining sensitive data, untrusted content, and external communication in one unsupervised flow.

What is the “lethal trifecta”? Private data access, exposure to untrusted content, and the ability to communicate externally. Together they let an attacker extract data through the agent.

Do GDPR and NIS2 apply to AI agents? Yes. Leaked data is a personal-data breach under GDPR, and for NIS2-covered companies agent incidents carry the usual reporting duties.

Deploying AI agents?

We build and audit AI agents with least-privilege permissions, approval gates, and full audit trails - so automation does not become your next breach.

Reach out at [email protected] or via the form on our homepage.

All articles