AI agent security: know what every agent can touch

AI agent security means each agent can reach only what its job needs, risky actions wait for a person, and every action lands on a record you can show an auditor. I’m Mo Tawfik Khalifa, chief product officer and forward deployed engineer at Instruxi, where I lead product for GVNR, a guard that checks AI agent actions before they run. I map the agents your teams already use, cut their access down, put a person in front of the risky actions, and test them by trying to trick them.

Data leaks are the worry at the top of the list. In Splunk’s survey of 650 CISOs in July and August 2025, more than three-quarters said data leaks were their top concern (Cybersecurity Dive on the Splunk report). A November 2025 survey by NeuralTrust, an AI security vendor, found 73% of CISOs “very” or “critically” concerned about AI agent risks and only 30% with mature safeguards in place (SecurityInfoWatch; vendor survey).

Worried your agents can reach more than they should?

These are the worries security people write about AI agents, in their own words, and what I do about each one.

What does an AI agent security review cover?

Six things, for each agent:

1. Identity. The agent has its own account and short-lived tokens, so you can see and switch off exactly that agent.
2. Reach. Every system it can touch, and whether it can read, write, or neither.
3. The check before acting. Allow, deny or ask a person, decided outside the model, before the action runs.
4. Limits. Spend caps, rate limits and a stop when it repeats the same call over and over.
5. The record. Every decision, with who approved it, kept so entries cannot be quietly changed later.
6. Tests. Prompt injection, a poisoned tool description, and requests over the limit, run before launch and again after each change.

How do I secure one agent, step by step?

1. List. Every agent running in the company, who owns it, which tokens and MCP servers it holds, and what text it reads from outside.
2. Map. I draw each agent the way the diagram below shows: inputs it cannot trust on one side, your systems on the other, a level on every line.
3. Cut. Read-only first, scoped tokens, its own identity. Most agents need far less than they were given.
4. Gate. Risky actions go to a person for approval: money, deletes, anything that leaves the company.
5. Test. I try to trick it, then fix what gets through and test again.
6. Hand over. The map, the rules and the record go to a named owner on your team, with written notes on how to change them.

Try setting the customer list and outside email to full access, then play it again. The model is the same; the only thing that changed is what it could reach. That is why I fix the map first and treat the model’s good behaviour as a bonus, not a control.

Do you need an agent security review or a penetration test?

A penetration test attacks your systems from outside. An agent security review looks at what your own agents can already do from inside, with keys you gave them. An agent that reads customer email and holds a database password is an inside path a normal test may never try. If you run agents in production, do the review first, then let your testers aim at what is left.

What have I built and written on agent security?

Questions people ask

What is AI agent security?

Making sure each AI agent can reach only what its job needs, that risky actions wait for a person, and that every action lands on a record you can show an auditor. It covers the agent’s identity, its tokens and tools, the checks before it acts, and tests that try to trick it.

Can prompt injection be stopped?

Not inside the model. Any text an agent reads, from a web page, a ticket or a file, can carry instructions, and no model ignores them every time. What you can control is what a tricked agent can reach. If it has no way to email outside addresses or export customer data, an injected instruction to do that fails at the check, whatever the model decides.

What does least privilege mean for an AI agent?

The agent gets its own identity, not a person’s login, and only the tools and data its job needs. It starts read-only. Each write action is added one at a time, with a limit, and the riskiest ones ask a person first.

Do MCP servers need a security review?

Yes. An MCP server is code that runs with the tokens you give it, and many ask for broad access. I pin the version, scope each token to the job, check what the server can reach on the network, and put approval in front of risky tools. The 12 checks are in my MCP security checklist.

What should an AI agent audit log show?

For every action: which agent, acting for whom, what it tried, what the check answered (allow, deny or ask a person), who approved it, and when. It should be written by the check, not by the agent, and protected so entries cannot be quietly changed afterwards.

Which AI agents do you work with?

Any. Support agents, internal workflow agents and coding agents such as Cursor, Codex, Claude Code and Gemini CLI, plus anything that connects through MCP. The checks sit outside the model, so the same map works whichever model runs the agent.

1. 30-minute call. Which agents you run, what they can reach, what worries you.
2. A written plan in 48 hours. What to map and test first, and the risks.
3. Start, or not. Use the plan with your team or with me. I reply to every email within one working day.

If you run AI agents and want to know what they can touch, write to m@tawfik.tv with the agents you use and the systems they connect to.