The short answer
Agentic AI security, often called AI agent security, protects AI systems that plan and act for themselves, calling tools, APIs and other agents with real permissions. Testing an agent means attacking its tools, credentials, memory and approval steps to see whether it can be driven into actions it should never take, then fixing the permissions that allowed it.
On this page
- What is agentic AI security?
- What are the agentic AI security risks?
- How do you test an AI agent?
- How is an agent test scoped?
- What do you get from an agentic AI security test?
- AI agent security: how do you secure AI agents?
- Why choose Sovereign Secure for agentic AI security testing?
- Ready to test your AI agent?
Agentic AI security is about what an AI system can do, not only what it can say. An AI agent plans steps, calls tools and APIs, reads and writes data, and sometimes hands work to other agents, all with permissions someone granted it. If an attacker can steer the agent, they inherit those permissions. Testing an agent therefore means attacking the whole chain: the instructions it receives, the content it reads, the tools it calls, the credentials it holds and the human checks meant to stop it.
Agent and tool-use testing is part of our AI red teaming service. This page explains how that work is scoped and delivered when the system under test is an agent rather than a chatbot.
What is agentic AI security?
Agentic AI security is the set of controls, and the testing that proves them, for AI systems that take actions on their own. A chatbot’s worst case is usually a harmful or leaked answer. An agent’s worst case is whatever its tools allow: sending email, issuing refunds, changing records, running code or deleting data.
Three things make agents harder to secure:
- Untrusted input arrives from everywhere. Agents read emails, tickets, documents, web pages and tool results, and any of them can carry instructions. This is indirect prompt injection, and for agents it is usually the main way in.
- Impact depends on permissions, not the model. The same model is harmless with read-only search and dangerous with write access to a CRM, a payments API or a shell.
- Steps chain together. An agent can combine individually harmless actions, such as reading a file and then sending a message, into a harmful outcome that no single control was designed to catch.
Agent risks map mainly to Excessive Agency (LLM03 in the 2026 edition) in the OWASP Top 10 for LLM Applications. On 9 December 2025 OWASP’s GenAI Security Project also published a separate Top 10 for Agentic Applications, a useful companion list for teams building agents.
What are the agentic AI security risks?
The main agentic AI security risks are misuse of an agent’s tools, more autonomy or access than the task needs, exposed credentials, poisoned memory, misplaced trust between agents, and approval steps that can be bypassed. Securing AI agents starts with this threat model, and it is the one we test against.
| Risk | What goes wrong | Example abuse case |
|---|---|---|
| Tool and function misuse | The agent calls a legitimate tool with attacker-chosen arguments, or in an order nobody intended | Text hidden in a support ticket persuades the agent to issue a refund to a different account |
| Excessive agency | The agent has more tools, permissions or autonomy than its job needs | A summarising agent that only needs to read a mailbox can also send and delete |
| Privilege and credential exposure | Tokens, API keys or a user’s delegated access reach the model, logs or other tools, or are used beyond their intended scope | The agent is talked into printing an API key from its configuration, or uses an admin token for a routine task |
| Memory and context poisoning | Malicious content is written into long-term memory, a vector store or shared context and shapes later sessions or other users | A planted “note” in memory tells the agent to copy future invoices to an outside address |
| Multi-agent trust | Agents accept instructions or data from other agents without checking the sender or whether the request is in scope | A low-privilege research agent passes a crafted task to a high-privilege operations agent |
| Human-in-the-loop bypass | Approval prompts are skipped, misleading or easy to rubber-stamp | The approval screen says “update record” while the real call deletes it, or a risky action is split into small steps that each fall below the approval threshold |
Agents also inherit the conventional risks of the systems around them: injection and broken authorisation in the APIs they call, unsafe handling of their output downstream, and runaway loops that burn compute and money. Those are tested in the same engagement.
How do you test an AI agent?
You test an AI agent by modelling what it can reach, then trying to make it misuse that reach through every input it trusts. An agent engagement runs in five stages:
- Threat model the agent. We map its goals, tools, data sources, identities and trust boundaries, and identify the actions that would cause real harm. A short threat modelling exercise at this point focuses the test on what matters.
- Review tools and permissions. For each tool we compare the permissions granted with what the task needs, check how credentials are stored and passed, and note which actions cannot be undone.
- Attack the inputs. Direct attempts through the user interface, then indirect injection through the content the agent reads: documents, emails, tickets, web pages, retrieved data and tool results.
- Attack the controls. We test approval steps, rate and spend limits, allow-lists, memory writes and agent-to-agent hand-offs, looking for ways to bypass, mislead or exhaust them.
- Chain and prove. Where weaknesses combine, we build them into an end-to-end attack path and demonstrate the impact safely, using test data and agreed targets.
The APIs and web application behind the agent get the same manual testing as any API penetration test, because an agent is only as safe as the endpoints it can call.
Agents take real actions, so safety is planned up front. We agree a test environment, test accounts and data, which tools may run for real and which are stubbed or sandboxed, and a way to stop the agent immediately.
How is an agent test scoped?
Scope is set by what the agent can reach, not by how many prompts we send. These are the questions we ask, and why each one changes the effort:
| Scope item | What we ask | Why it matters |
|---|---|---|
| Agents and workflows | How many agents there are and what each one is for | Each agent has its own goals, tools and failure modes |
| Tools and functions | Which tools each agent can call, and which ones write, send, pay or delete | Write and irreversible tools need the deepest testing |
| Data sources | Mailboxes, tickets, file stores, websites, vector stores and memory | Every source the agent reads is a route for indirect injection |
| Identities and permissions | Service accounts, OAuth scopes, API keys and delegated user access | Sets the blast radius if the agent is hijacked |
| Agent and tool connections | Agent-to-agent links, orchestration frameworks and Model Context Protocol (MCP) servers | Trust between components is a common gap; our guide to MCP security covers the protocol’s own risks |
| Human approval points | Which actions need sign-off and what the approver sees | Approvals are a key control and a common bypass target |
| Environment | Staging, sandboxes, test data and rollback options | Decides what can be tested for real, and how safely |
We fix the scope and price in a written proposal before testing starts. Our penetration testing quote form collects most of what we need.
What do you get from an agentic AI security test?
You get the standard deliverables of our AI and LLM testing, plus three agent-specific sections that make the results usable by the people who own the tools and permissions.
- Attack paths. Step-by-step chains from an untrusted input to a real impact, showing each control that failed along the way.
- Abuse cases. Each realistic misuse scenario we tried and its result, so you can see what held as well as what failed, and reuse the cases as regression tests.
- Permission review. A tool-by-tool table of the permissions each agent holds against what its task needs, with least-privilege recommendations.
- Findings and ratings. Reproduction steps, risk ratings and remediation advice for each issue, with an executive summary for non-technical stakeholders.
- Coverage record. A record of what we tested against the OWASP Top 10 for LLM Applications.
- Retest and attestation. A retest of fixed findings, an updated report and an attestation letter for customers and auditors.
The report also feeds AI governance work: independent testing is evidence for MEASURE 2.7 (security and resilience) in the NIST AI Risk Management Framework, and for the verification and validation that ISO/IEC 42001 expects before release, which matters if you are working towards ISO 42001 certification.
AI agent security: how do you secure AI agents?
AI agent security is mostly a design problem, not a prompt-writing one: most agent findings are fixed by changing what the agent can reach and who checks what it does. The controls below follow the nine areas of the OWASP AI Agent Security Cheat Sheet, and each one is something an agent test can check.
| Control | What it means in practice | OWASP cheat sheet area |
|---|---|---|
| Least privilege for tools | Give each agent the fewest tools and the narrowest permissions its task needs, with separate read and write tools, and enforce authorisation outside the model | Tool security and least privilege |
| Credentials out of the model | Tools authenticate on the agent’s behalf with short-lived, scoped tokens, so no key or token ever sits in the prompt or context | Tool security and least privilege; data protection and privacy |
| Untrusted input stays data | Treat everything the agent reads, including tool results and other agents’ messages, as data, never as instructions | Input validation and prompt injection defence |
| Protected memory | Control what is written to memory, keep it separate per user or session, and let users and administrators review and clear it | Memory and context security |
| Approval for irreversible actions | Require human sign-off for actions that send, pay, change or delete, and show the approver the exact action and its parameters | Human-in-the-loop controls |
| Limits on outputs and destinations | Check outputs before they are acted on, and allow-list destinations for email, web requests and file shares | Output validation and guardrails |
| Logging and a stop switch | Log every tool call with its inputs, set rate, spend and loop limits, alert on unusual behaviour and keep a way to stop the agent | Monitoring and observability |
| Trust between agents | Authenticate messages between agents and check the sender’s permissions at the receiving agent | Multi-agent security |
| Adversarial testing | Test abuse cases before release and after each change to tools, permissions, data sources or the model | Secure agent testing and adversarial validation |
The NCSC’s guidelines for secure AI system development cover the same ground across design, development, deployment, and operation and maintenance.
Why choose Sovereign Secure for agentic AI security testing?
- Agent testing is part of a published scope. Agent and tool-use testing sits alongside prompt injection, data leakage and output handling in our AI and LLM penetration testing.
- The systems around the agent are covered too. We test web, API, network, cloud, mobile, hardware and IoT, wireless, source code and red team engagements, so connected systems can be scoped into the same engagement.
- ISO 27001 certified. Your prompts, data and test accounts are handled under a certified information security management system.
- A PCI SSC Qualified Security Assessor (QSA) company, which matters when agents touch payment data or card-processing systems.
- Fixed scope and price, with any retest and its window agreed in your proposal.
Ready to test your AI agent?
Tell us what your agent does, which tools and data it can reach and when it goes live. Request a fixed-price proposal through our penetration testing quote form, or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
