Read as
Last updated: April 29, 2026
Agents are LLMs that call tools. Permissions matter exponentially.
Agents are LLMs that call tools. Permissions matter exponentially.
The threat model
An agent compromised via prompt injection in any input source (user query, retrieved doc, tool output) executes attacker’s instructions with the agent’s permissions.
Defences
- Least privilege per agent — only the minimum tools needed for its purpose
- Read-only by default — write actions require additional confirmation
- User-confirmation for destructive or external actions
- Sandboxed execution for code-generation agents
- Output validation before tool calls (don’t blindly call API with LLM-generated args)
- Audit log of every agent action
The “lethal trifecta”
An agent with: (1) access to private data, (2) exposure to untrusted content, (3) ability to communicate externally — has all the elements for catastrophic data exfiltration. Avoid this combination.
🧠
Check your understanding
Module Quiz · 5 questions
Pass with 80%+ to mark this module complete. Unlimited retries. Each question shows an explanation.
Want this for your team?
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.
Book team training call
Replies in 4 working hrs · India-only · Senior consultants