Agent security glossary
Plain, citable definitions for the core terms of autonomous-agent security — the vocabulary the rest of the research relies on.
- 01Prompt injection
- An attack that smuggles attacker-controlled instructions into a model’s input so the agent follows them instead of the developer’s intent. It is the root class behind most agent compromises.
- 02Indirect prompt injection
- Prompt injection delivered through content the agent fetches — a web page, document, email or tool output — rather than typed by the user. The payload lies in wait until the agent reads it.
- 03Excessive agency
- When an agent holds more permissions, tools or autonomy than its task requires, so a single error or injection turns into real damage. The fix is least privilege per action.
- 04Tool poisoning
- Tampering with a tool — its description, parameters or output — so it steers an otherwise honest agent toward harmful actions. Common in untrusted MCP servers and plugin ecosystems.
- 05Model Context Protocol (MCP)
- An open protocol that lets agents connect to external tools and data through standardized servers. Its convenience also makes it a supply-chain attack surface worth securing deliberately.
- 06Confused deputy
- An attack where a privileged agent is tricked into misusing its authority on behalf of a less-privileged attacker — for example, reading a secret the requester could never access directly.
- 07Data exfiltration
- Moving sensitive data out across a trust boundary — often via an agent that is induced to send secrets to an attacker-controlled URL, tool or message. The final step of many agent attacks.
- 08Guardrail
- A control that constrains what an agent may receive or do — input/output filters, policy checks, allow-lists or human approval. Effective guardrails are layered and tested against their own bypasses.
- 09Red teaming
- A structured practice of attacking your own agent the way an adversary would — building payloads, running them against the system and scoring the outcome — to find weaknesses before someone else does.
- 10MITRE ATLAS
- A public knowledge base of adversary tactics and techniques against AI systems, modeled on MITRE ATT&CK. It gives teams a shared vocabulary for describing, mapping and detecting attacks on agents.
- 11OWASP Top 10 for Agentic Applications
- A 2025 list (the "ASI" categories, ASI01–ASI10) cataloguing the most important security risks specific to autonomous agents — from Agent Goal Hijack to Rogue Agents — distinct from the original OWASP LLM Top 10.
- 12Zero trust
- A security model that trusts no request by default and verifies every one — identity, scope and context — at the moment it is made. For agents it means each tool call is authorized afresh, not granted once.
- 13Agent identity
- A verifiable, cryptographic identity for a non-human agent — issued via mTLS, signed tokens or a framework like SPIFFE — so its actions can be authenticated, scoped and audited rather than blindly trusted.
- 14Capability-based security
- An access model where the right to act is a narrow, unforgeable token tied to a specific resource and operation, rather than an ambient permission. It lets an agent hold exactly the authority a task needs and no more.