Agent Security in 5 Days

Threat modeling: the lethal trifecta, trust boundaries, and how to use two OWASP lists as checklists

Start with the lethal trifecta test to see where an agent is actually dangerous: once private data, untrusted content and outbound communication coexist, one successful prompt injection becomes one data exfiltration. Then draw it as a trust boundary diagram and walk both OWASP lists against it.

An injection range and the input side: what four tiers of defense stop, and where each one fails

Build a reproducible injection range, bolt on delimiters, provenance markers, spotlighting and a detector one tier at a time, and use attack success rate together with task completion to see exactly how far each tier gets — and why none of them is a boundary.

Architectural defense: six design patterns, and how plan-then-execute drives attack success to zero

Move the defense out of the prompt and into the structure: what action-selector, plan-then-execute, map-reduce, dual LLM, code-then-execute and context-minimization each constrain, then land two of them on the range so attack success hits zero while the agent keeps working.

Runtime controls: capabilities, approval gates, egress allowlists, sandbox layers, secrets and tenancy

Assume the injection already happened and use the runtime to contain the damage: declare each tool's capability and risk tier, gate the dangerous ones on human approval, allowlist filesystem paths and network egress, separate the policy layer from the isolation layer, and handle secrets, per-user credentials and tenant isolation.

Red teaming: keeping an attack suite alive, wiring it into CI, and what to do after an incident

Turn four days of defenses into a loop you can keep running: maintain an attack suite that grows, write a red-team script that produces a report, gate CI on both numbers, and add rogue-behavior detection, a kill switch and a minimal incident response plan.