Risks
AI agent security risks
AI agent risks are the ways an attacker turns a model into actions: prompt injection, indirect prompt injection, excessive agency, sensitive information disclosure and MCP tool poisoning. Each page here defines one risk with OWASP or MITRE ATLAS references, shows an illustrative trace, and lists what an Agent Action Pentest tests.
Pages in this section
- 01Prompt injection in AI agentsInstructions in user input or ingested content override what the agent was told to do.
- 02Indirect prompt injection in AI agentsHidden instructions in emails, pages, files or tool results steer an agent that reads them.
- 03Excessive agency in AI agentsThe agent holds more tools, permissions or autonomy than the task needs.
- 04Sensitive information disclosure through agent actionsCustomer data, secrets or system prompts leave through output, links or tool calls.
- 05MCP tool poisoning and MCP server risksMalicious tool definitions or over-scoped MCP servers steer what the agent calls.
How these pages work
A language model on its own produces text. An agent turns that text into function calls with real credentials: it reads email, queries a CRM, refunds a charge, edits a record. Most of the security work therefore moves from "what will the model say" to "what can the agent be made to do", and the risks below are written from that second angle.
Each risk page follows the same structure so you can compare them. A plain definition with the matching OWASP Top 10 for LLM Applications entry or Agentic threat number, and MITRE ATLAS technique IDs where they exist. How the risk shows up across tools, MCP servers, money, data, outbound channels and tenants. An illustrative trace in the same format as our reports, clearly labeled as an example. The specific things we test, mapped to the four classes of an Agent Action Pentest. Mitigations taken from the cited source rather than invented.
The pages are related. Prompt injection is usually the way in, excessive agency decides how much damage follows, and sensitive information disclosure is often the result. MCP tool poisoning is a delivery channel specific to agents built on the Model Context Protocol. Reading two or three of them together gives a fair picture of how a real finding chains.
Every OWASP ID on these pages was checked against genai.owasp.org on the review date, and every ATLAS ID against the published MITRE atlas-data release. OWASP published a 2026 edition of its LLM list on 2026-08-03. The pages use the 2026 IDs and show the 2025 ID on a short line where it changed.
Not sure which of these applies to you? List your agent's tools and ask, for each one, what happens if the arguments come from an attacker. If any answer involves money, deletion, another customer's data or an outbound message, start with the matching risk page. When you want it tested, the offer is below.
Agent Action Pentest: $2,500 fixed. Written report within 72 hours of access, or a full refund.
See the offer or email yaz@plaw.io
Related pages
- AI agent security standards, mappedOWASP Top 10 for LLM Applications, OWASP Agentic AI threats and MITRE ATLAS, each mapped to what an Agent Action Pentest tests and what it leaves out of scope.
- AI agent framework securityHow AI agent frameworks like the OpenAI Agents SDK and LangChain expose tools, handoffs and guardrails, which risks apply, and what an agent pentest checks.
- AI agent integration securityWhat AI agents can do through Stripe, Slack, GitHub and Gmail: actions, abuse paths, least-privilege notes from vendor docs, and how we test each.
- AI agent security testing, comparedHow an agent action pentest compares with other AI security testing, such as AI red teaming, using public definitions only, and when each is the better fit.
Sources
Last reviewed: