OWASP's AI Agent Security Cheat Sheet

AI agents are autonomous systems powered by Large Language Models (LLMs) that can reason, plan, use tools, maintain memory, and take actions to accomplish goals. This expanded capability introduces unique security risks beyond traditional LLM prompt injection. This cheat sheet provides best practices to secure AI agent architectures and minimize attack surfaces.

Prompt Injection (Direct & Indirect) : Malicious instructions injected via user input or external data sources (websites, documents, emails) that hijack agent behavior. (See LLM Prompt Injection Prevention Cheat Sheet )

Tool Abuse & Privilege Escalation : Agents exploiting overly permissive tools to perform unintended actions or access unauthorized resources.

Data Exfiltration : Sensitive information leaked through tool calls, API requests, or agent outputs.

Memory Poisoning : Malicious data persisted in agent memory to influence future sessions or other users.

Goal Hijacking : Manipulating agent objectives to serve attacker purposes while appearing legitimate.

Excessive Autonomy : Agents taking high-impact actions without appropriate human oversight.

High-Impact Action Abuse : Agents executing irreversible, financial, administrative, or externally visible operations without independent validation.

Decision and Approval Manipulation : Attackers influencing risk scores, model confidence, or approval thresholds to bypass safeguards.

Cascading Failures : Compromised agents in multi-agent systems propagating attacks to other agents.

AI Console Malicious Configuration : AI developer consoles can be compelled to consume data that contains instructions driving malicious changes to the underlying LLM configuration.

Denial of Wallet (DoW) : Attacks causing excessive API/compute costs through unbounded agent loops.

Sensitive Data Exposure : PII, credentials, or confidential data inadvertently included in agent context or logs.

Supply Chain Attacks : Compromising third-party tools, APIs, or data sources used by agents.

1. Tool Security & Least Privilege ¶

Grant agents the minimum tools required for their specific task.

Implement per-tool permission scoping (read-only vs. write, specific resources).

Use separate tool sets for different trust levels (e.g., internal vs. user-facing agents).

Require explicit tool authorization for sensitive operations.

Bad: Over-permissioned Model Context Protocol (MCP) tool configuration ¶

Good: Scoped MCP tool with allowlist ¶

Tool Authorization Middleware ¶

Enforce authorization in the execution component, outside the agent's context. A user_confirmed flag is insufficient: the component must verify that the approval belongs to the current actor and exact tool call, remains valid, and has not already been consumed. Check and consume the approval in one atomic step immediately before execution so concurrent or repeated requests cannot reuse it. Changes to the target or parameters require new approval. Apply the High-Impact Action Integrity Controls and the Transaction Authorization Cheat Sheet . Fail closed for unknown tools or missing approval requirements.

2. Input Validation & Prompt Injection Defense ¶

Treat all external data as untrusted (user messages, retrieved documents, API responses, emails).

Implement input sanitization before including external content in agent context.

Use delimiters and clear boundaries between instructions and data.

Apply content filtering for known injection patterns.

Consider using separate LLM calls to validate/summarize untrusted content.

Please refer to the LLM Prompt Injection Prevention Cheat Sheet for detailed techniques.

3. Memory & Context Security ¶

Validate and sanitize data before storing in agent memory.

Implement memory isolation between users/sessions.

Set memory expiration and size limits.

Audit memory contents for sensitive data before persistence.

Use cryptographic integrity checks for long-term memory.

Bad: Unvalidated memory storage ¶

Good: Validated and isolated memory ¶

4. Human-in-the-Loop Controls ¶

Require explicit approval for high-impact or irreversible actions.

Implement action previews before execution.

Set autonomy boundaries based on action risk levels.

Provide clear audit trails of agent decisions and actions.

Allow users to interrupt and rollback agent operations.

Action Classification Example ¶

Only the two mapped low-risk tools skip human review in this example. Medium, high, critical, and unmapped tools require it. This classification does not grant permission to run a tool; the execution component must still check the actor's authorization and any required approval for the exact action.

High-Impact Action Integrity Controls ¶

For destructive, financial, administrative, or externally visible actions, add controls beyond a simple approval prompt:

Separate decision-making from execution. The agent can propose an action, but a policy service or execution component should independently validate scope, privilege, and approval state before execution.

Bind approval to the exact action. Include the actor, tool name, target resource, normalized parameters, timestamp, and expiry in the approval record.

Use short-lived authorization artifacts and replay protection for irreversible operations.

Require step-up authentication for critical actions such as account recovery, payment initiation, privilege changes, bulk deletion, or production deployment.

Make high-impact actions idempotent where possible and require explicit duplicate confirmation when idempotency is not possible.

Fail closed when risk classification, approval validation, policy lookup, or audit logging fails.

5. Output Validation & Guardrails ¶

Validate agent outputs before execution or display.

Implement output filtering for sensitive data leakage.

Use structured outputs with schema validation where possible.

Set boundaries on output actions (rate limits, scope limits).

Apply content safety filters to generated responses.

Output Validation Pipeline ¶

6. Monitoring & Observability ¶

Log all agent decisions, tool calls, and outcomes.

Implement anomaly detection for unusual agent behavior.

Track token usage and costs per session/user.

Set up alerts for security-relevant events.

Maintain audit trails for compliance and forensics.

Log structured decision metadata for high-risk actions, including action classification, risk score when applicable, authorization outcome, approval identifier, execution result, and policy version.

Monitor for drift in approval behavior, repeated approval bypass attempts, elevated privilege usage, abnormal tool invocation frequency, and sudden increases in high-risk actions.

When the logs come from a component you did not build, see the Verifying Third-Party Agent Execution Evidence Cheat Sheet for how to judge what such a record establishes.

For elapsed-time windows, use Python's timedelta.total_seconds() ; the seconds attribute excludes whole days.

7. Multi-Agent Security ¶

Implement trust boundaries between agents.

Validate and sanitize inter-agent communications.

Prevent privilege escalation through agent chains.

Isolate agent execution environments.

Apply circuit breakers to prevent cascading failures.

Secure Multi-Agent Communication ¶

Authenticate communicating agents and enforce the sender's permissions at the receiving service before executing a request. A valid message signature does not grant permission to perform the requested action.

When message signatures are needed, use a maintained protocol implementation. Protect the sender, intended recipient, message type, payload, creation and expiry times, and a unique message identifier. For HTTP, RFC 9421 explains why verification must require all security-relevant components to be signed .

Enforce a bounded validity window and reject repeated message identifiers before execution. A timestamp check alone permits repeated execution within that window; see RFC 9421's replay considerations . Check and record each identifier in one atomic step, and keep the record for the entire acceptance window, including any clock-skew allowance. that state across every receiver instance that can accept the message, and reject messages when it is unavailable; RFC 9449's DPoP replay guidance notes that single-use checks may not be feasible when servers behind one endpoint have no shared state . Keep transport encryption: message signatures do not provide confidentiality .

8. Data Protection & Privacy ¶

Minimize sensitive data in agent context.

Implement data classification and handling rules.

Apply encryption for data at rest and in transit.

Enforce data retention and deletion policies.

Comply with privacy regulations (GDPR, CCPA).

Data Classification and Handling ¶

9. Secure Agent Testing & Adversarial Validation ¶

AI agents should undergo structured security testing before production deployment and after material changes to prompts, tools, memory, retrieval, policies, or model providers. Testing should exercise both application controls and agent-specific failure modes.

Abuse-Case Test Matrix ¶

Maintain repeatable test cases for:

CI/CD and Release Gates ¶

Run adversarial test suites in CI/CD for agent templates, tool policies, and prompt changes.

Include regression tests for previously observed injection, memory poisoning, and tool-abuse failures.

Block releases when high-risk tool policies, approval logic, or credential scopes change without updated tests.

Keep red-team prompts and expected denials version controlled, but do not store secrets or live customer data in test fixtures.

Review test changes carefully; attackers may try to weaken or remove security tests in the same pull request that changes agent behavior.

Validation Evidence ¶

For production agents, retain evidence that shows:

The tested agent version, model provider, tool policy, and retrieval configuration.

The abuse cases executed and their expected results.

The approval, denial, timeout, or circuit-breaker behavior observed.

Any accepted residual risk and the compensating control.

Apply least privilege to all agent tools and permissions.

Validate and sanitize all external inputs (user messages, documents, API responses).

Implement human-in-the-loop for high-risk actions.

Isolate memory and context between users/sessions.

Monitor agent behavior and set up anomaly detection.

Use structured outputs with schema validation.

Sign and verify inter-agent communications.

Classify data and apply appropriate protections.

Separate decision-making from execution for irreversible operations.

Perform structured adversarial testing before production deployment.

Enforce token, cost, retry, and tool-chain limits.

Log structured decision metadata for high-risk actions.

Give agents unrestricted tool access or wildcard permissions.

Trust content from external sources (websites, emails, documents).

Allow agents to execute arbitrary code without sandboxing.

Store sensitive data in agent memory without encryption/redaction.

Let agents make high-impact decisions without human oversight.

Ignore cost controls (unbounded loops can cause DoW).

Pass unsanitized data between agents in multi-agent systems.

Log sensitive data (PII, credentials) in plain text.

Rely solely on model output for authorization decisions.

Skip adversarial testing after prompt, tool, memory, retrieval, or provider changes.

Permit unlimited recursion, retries, or tool chaining.

OWASP LLM06:2025 Excessive Agency

NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)