AI Agent Security: Where It Fits in the Stack

What Is AI Agent Security?

AI agent security is the set of controls that limit what an AI agent can access and do, and that stop it when it is hijacked. It covers the model, the tools and MCP servers the agent calls, the identity it acts under, and the host it runs on.

MITRE ATT&CK’s Campaign C0062 documents a likely China-nexus espionage actor using Claude Code agents and MCP tools for reconnaissance, exploitation, credential harvesting, and exfiltration against about 30 organizations, with minimal human involvement. If your developers run coding agents or your teams wire agents into Salesforce, these controls decide how far a hijacked agent gets. Get them right, and it runs out of road fast.

What Are the Top AI Agent Security Risks?

The top AI agent security risks are goal hijack, tool misuse, identity and privilege abuse, supply-chain compromise, and rogue agents, all entries in the OWASP Top 10 for Agentic Applications 2026.

EchoLeak (ASI01) shows goal hijack without a single click: the National Vulnerability Database (NVD) record for CVE-2025-32711 describes AI command injection that let an unauthorized attacker disclose information from an enterprise AI assistant over a network, with no user interaction required. The assistant held private data, read untrusted content, and could send data outward. Remove any one of those capabilities, and the exfiltration path closes.

In the Salesloft Drift breach, an example of identity and privilege abuse (ASI03) at scale, the FBI reported that UNC6395 used compromised OAuth tokens for the Salesloft Drift application to reach victims’ Salesforce instances and exfiltrate data. The Financial Industry Regulatory Authority (FINRA) confirmed the breach impacted more than 700 organizations, and the stolen tokens let attackers impersonate Drift inside Salesforce and Google Workspace.

Any agent holding OAuth tokens to SaaS apps faces the same exposure, because the attackers used stolen tokens, not prompt injection. That distinction determines where in the AI agent security stack you place enforceable controls.

Where Does Security Belong in the AI Agent Stack?

Security belongs in two kinds of controls across the AI agent security stack: behavioral controls shape what your agent attempts, while infrastructure controls enforce what it can do. Build the infrastructure layer as the boundary that holds when behavioral guidance fails.

The rule is the same at every layer: the control has to live somewhere the agent cannot reach or rewrite, even with its own credentials.

NIST’s post on agentic identity explains why one layer cannot carry the load. Model-only guardrails are not yet equipped for agentic security challenges, and an agent pursuing a goal can probe multiple paths, reach unexpected tools or data, or find orphaned credentials to escalate privileges.

Behavioral Controls Guide What an Agent Attempts

Behavioral controls reduce how often your agent attempts something harmful. Options include hardened system prompts, prompt injection filtering at the ingestion boundary, approval gates for high-impact actions, and written governance policy. They cannot guarantee safe behavior because the model reads instructions and data as one token stream. 

MITRE ATLAS’s OpenClaw investigation shows the cost of a missing gate: destructive operations, including credential use and external data transmission, required no approval even when old, untrusted memory influenced the agent. Keep human approval for those actions, but bind the approver’s identity to the agent’s, an open problem the National Cybersecurity Center of Excellence (NCCoE) concept paper raises.

Infrastructure Controls Decide What an Agent Can Do

Infrastructure controls set the agent’s actual reach across the AI agent infrastructure stack. Give each agent a unique non-human identity with short-lived, scoped credentials. Restrict it to allowlisted tools and APIs. Confine it to sandboxed execution with default-deny outbound networking. Require MCP servers to validate token audience, and keep signed, identity-linked action logs. Even a fully hijacked agent cannot exceed these limits.

NIST’s draft Cyber AI Profile, NIST IR 8596, gives your team the identity rule: “Assign each AI agent with a unique identity and credentials and treat them with the same security precautions as privileged users.” NIST IR 8587 applies its token-protection guidance whenever agents use signed tokens to reach systems, data, tools, or APIs.

At the tool layer, MCP security starts with the MCP authorization spec, which requires every MCP server to validate that access tokens were issued specifically for it as the intended audience. Skipping that check exposes the server to the confused deputy attacks the spec’s security requirements cover.

Approval gates need the same protection from tampering: in CVE-2026-25253, documented in the OpenClaw investigation, cross-site request forgery against the agent’s local gateway led to a configuration change that disabled user confirmation. Approval gates count as infrastructure only when the agent, and anyone who hijacks it, cannot reach the switch. Map these boundaries onto your AI agent architecture before you decide how to secure AI agents individually. Each agent inherits the weakest boundary among the layers it touches.

How Do You Secure AI Agents?

Secure your AI agents by inventorying them, scoping each identity, allowlisting tools, sandboxing execution, logging actions, and gating irreversible steps. These AI agent security best practices align with CISA’s May 2026 guidance, written with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and international partners: “Begin with agentic AI use cases that are low-risk and non-sensitive” and “Avoid granting broad or unrestricted access, especially to sensitive data or critical systems.”

1. Inventory and identify: Start with discovery, because agents deployed locally or outside IT review rarely appear in a central identity repository. Include developer workstations whose MCP configuration files grant access to internal services, then provision one identity per agent with short-lived, scoped tokens.
2. Restrict execution: Allowlist required tools and APIs, strip unnecessary capabilities before production, sandbox execution, default-deny egress, and inject credentials only for the session.
3. Record and gate actions: Turn on signed, identity-linked logs of prompts, retrieved context, tool calls, and outputs before granting write access. Require explicit confirmation for destructive or irreversible actions and use staged or reversible deletes.
4. Replay before expanding scope: Re-run recorded actions in an isolated production clone, and raise an agent’s authority only after the first three steps are in place and the replay stays inside blast-radius caps.

Not every agent needs these controls at full strength. The right depth depends on the authority each agent holds.

Scale Controls to Each Agent’s Authority

Match control depth to the authority each action class carries. AWS’s Agentic AI Security Scoping Matrix, as the Cloud Security Alliance (CSA) extended it in December 2025, sorts agents by agency and autonomy.

CSA’s extension scores each agent on permission level and risk exposure, from read-only and low-risk to read-write and high-risk. A read-only agent that acts on its own carries different risks than a write-capable agent requiring approval. 

Apply the model per action class across your AI agent architecture, so an agent can read logs independently and every write, send, spend, or delete waits for a person. Containment depends on knowing exactly what a compromised agent could reach, so record each agent’s scope now.

How Do You Find and Contain a Compromised AI Agent?

Find compromised agents through semantic, infrastructure, and identity indicators, then contain them in an evidence-preserving order. Tearing down the pod before capture loses the rest of the chain.

Semantic indicators include mismatches between the original request and tool-call parameters or between a declared tool call and what ran. A summarization task ending in an outbound call is another indicator. Infrastructure indicators come from the AI agent infrastructure stack: an inference container spawning a shell, installing a package, writing to unfamiliar paths, or opening unexpected outbound connections. Identity indicators include credentials minted outside approved lineage, blocked calls retried through another connector, disabled logging, or approvals arriving in bulk.

Once an indicator fires, run the incident response phases in this order:

1. Freeze and capture: Revoke the agent’s permissions and halt execution together. Before teardown, capture prompt history with timestamps, retrieved context with provenance, the tool-call sequence, identity assumptions, downstream agent invocations, and the large language model (LLM) output trace. Keep kernel-level capture running.
2. Revoke and isolate: Revoke tokens, API keys, and certificates for the whole identity because concurrent sessions and MCP connections need simultaneous cutoff. Isolate the host, container, or workload and scope the blast radius through the identity graph. 
3. Quarantine trust: Remove the agent’s tool and protocol access while preserving the identity record. Notify downstream systems holding trust relationships with it.
4. Eradicate and re-provision: Restore known-good model versions and configurations, fix the failed boundary, and issue new credentials only after verifying the environment is clean. Require human validation for high-severity cases.

Rehearse containment before you need it: the CSA CISO Community’s emergency guidance recommends agentic AI tabletop exercises, including a rogue agent attacking a third party. Map each step to one of the frameworks below so an agent incident is handled the same way every time.

Which AI Agent Security Frameworks Apply?

Match each framework to the question it answers: the OWASP Top 10 for Agentic Applications 2026 names what can go wrong, MITRE ATLAS shows how attackers do it, CSA MAESTRO structures the threat model, NIST IR 8596 and IR 8587 set identity and token rules, and CISA’s May 2026 guidance scopes adoption risk. For securing agentic AI inside a compliance program, ISO/IEC 42001 and the EU AI Act supply the governance shell.

OWASP Top 10 for Agentic Applications and Agent Control Standard

The OWASP Top 10 for Agentic Applications 2026, released on December 9, 2025, gives security engineering and AI platform teams a shared vocabulary for the ten agent risks mapped earlier, from goal hijack to rogue agents. In September 2026, the OWASP GenAI Security Project added the Agent Control Standard, which extends that guidance toward runtime enforcement.

MITRE ATLAS

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is the knowledge base of adversary tactics, techniques, and case studies against AI systems, structured like ATT&CK and now covering agent-specific techniques such as AI agent context poisoning and credential harvesting through agent tools. Threat hunters use it to map agent incidents to named techniques. MITRE publishes monthly content releases, and v2026.09 is current as of September 2026.

CSA MAESTRO and the AI Controls Matrix

Published by the Cloud Security Alliance on February 6, 2025, CSA MAESTRO is a threat modeling framework built for agentic AI that breaks an agent system into seven layers, from foundation models to the agent ecosystem. Security architects pair it with the AI Controls Matrix v1.1, released June 22, 2026, and its 247 control objectives across 18 domains for governance, risk, and compliance (GRC) mapping.

NIST IR 8596 and IR 8587

NIST’s agent guidance centers on identity and tokens, and the two documents are at different stages. IR 8596, the Cyber AI Profile behind the identity rule above, remains an initial preliminary draft from December 2025. IR 8587 on token protection became final in September 2026. The NCCoE has proposed an agent identity and authorization project that applies IR 8587 alongside NIST SP 800-207 and SP 800-63-4.

CISA Agentic AI Guidance

CISA’s Careful Adoption of Agentic Artificial Intelligence (AI) Services guide, published May 1, 2026 with ASD’s ACSC and other partners, gives developers, vendors, and operators best practices for adopting agentic systems. It names privilege creep, behavioral misalignment, and obscure event records as the risks agentic systems add, and it asks organizations to account for agentic AI in their security model and risk posture.

ISO/IEC 42001

ISO/IEC 42001 is a certifiable standard for AI management systems, first published in December 2023, that gives GRC teams and CISOs the governance structure an agent program operates within. It contains no agent-specific controls, so pair it with one of the technical frameworks above.

EU AI Act

The EU AI Act, Regulation (EU) 2024/1689, is mandatory for providers and deployers of in-scope AI systems, but it defines no AI agent category. An agent falls under the Act as an AI system. The 2026 Digital Omnibus moved high-risk obligations for stand-alone systems to December 2, 2027. Pick one AI agent security framework as your control baseline, map the Act’s obligations onto it, and connect both to tools governing prompts, identities, cloud assets, investigations, and response.

Secure AI Agents with SentinelOne

Agents act at machine speed. The controls around them have to keep pace, from a place the agent cannot reach. SentinelOne Prompt Security governs agents, MCP servers, and prompts, while Singularity™ Identity stops credential theft and privilege escalation at runtime. Singularity Endpoint protects the hosts agents run on, and Purple AI with Singularity Hyperautomation accelerates investigation and response.

Prompt Security finds every AI agent and MCP server in your environment through an MCP Gateway, browser extension, security plugins, and API integrations, then maps every connector, tool, and plugin each agent touches. It scores each agent and MCP server for risk, guards against jailbreak attempts, enforces policy on what agents can access and do, and keeps a searchable, timestamped log of every session, action, and tool. Singularity Identity blocks lateral movement, automates remediation that disables compromised identities, and continuously scans for weak, exposed, or compromised credentials across Active Directory and cloud identity providers including Entra ID, Okta, Ping, Duo, and SecureAuth.

Singularity Endpoint applies Behavioral AI on the workstations and cloud workloads where coding and desktop agents run. It stops fileless malware, supply chain attacks, and zero-day exploits in real time, online or offline. It can contain a compromised host autonomously, without waiting on a manual isolation step, and 1-Click rollback reverses unauthorized changes. AI Security Posture Management in Singularity Cloud Security discovers AI pipelines and models in cloud accounts.

Purple AI™ Agentic Investigation runs alert analysis, surfaces the evidence, and tells your security operations center (SOC) what to do next. IDC’s Business Value study found that customers identified threats 63% faster and remediated them 55% faster. Singularity Hyperautomation, built into the Singularity Platform, runs no-code response workflows, including the containment steps above.

Request a SentinelOne demo to see how your team can give every AI agent a boundary it cannot cross.

Unleash AI-Powered Cybersecurity

Elevate your security posture with real-time detection, machine-speed response, and total visibility of your entire digital environment.

Get a Demo

Conclusion

Every AI agent security control follows one rule: it has to live somewhere the agent cannot reach or rewrite, even with its own credentials. Behavioral controls reduce how often an agent attempts something harmful. Infrastructure controls set the hard limit on what a hijacked agent can do. Start with inventory, because you cannot scope, gate, or contain an agent you don’t know exists.

From there, match each agent’s controls to the authority it holds, record its scope before you ever need to contain it, and rehearse the response before an incident forces one. The frameworks already name the risks, and the controls that contain them already exist. Build the boundaries now, and a compromised agent runs into limits your team set in advance.