AI Security

Introduction

Agents introduce new attack surfaces: prompt injection, tool abuse, data exfiltration, jailbreaks. Defence is layered: input filters, tool scopes, output filters, audit.

Beginner analogy: assume every user (and every web page the agent visits) is hostile.

Understanding the topic

Core concepts:

• Prompt injection: external content overrides instructions.
• Tool abuse: agent calls dangerous tool wrongly.
• Data exfil: agent leaks secrets via tool args.
• Jailbreaks: user bypasses safety prompts.
• Mitigations: input sanitisation, scoped tools, output filters, audit.

Syntax reference

Visual workflow / architecture:

user / web content ─► sanitise ─► agent
                                      │
                                      ▼
                              tool scopes + audit
                                      │
                                      ▼
                              output filter ─► user

Real-world use

OWASP LLM Top 10, Anthropic's prompt-injection research, Microsoft's Skeleton Key disclosure.

Best practices

• Treat ALL external input as untrusted (including web pages your agent reads).
• Scope tools tightly; use allow-lists.
• Audit destructive actions.

Common mistakes

• Trusting tool outputs — many injection vectors live there.

Hands-on exercise

Interview preparation — practice these questions:

• Q1. What is prompt injection?
• Q2. Three defence layers.
• Q3. Scenario: your agent reads a webpage that says 'ignore previous instructions'. What protects you?