Your AI agent’s attack surface is everything it reads.
In traditional software, attackers often need write access to compromise a system.
With AI agents, sometimes all they need is to write an issue comment.
A malicious instruction can hijack an agent and exploit the tools, credentials, and permissions it already has.
The uncomfortable lessons from agentic security:
• 🔓 Prompt injection is structural. Better instructions alone won’t solve it.
• 🛡️ Belief isn’t a security boundary. An agent can be persuaded to ignore its rules.
• 🔑 Scope capabilities by effect, not by name. An approved command isn’t necessarily a safe command.
• 🚫 Remove unnecessary access. Don’t tell an agent to protect secrets—avoid exposing those secrets in the first place.
• 🔍 Track provenance. An issue comment, a tool response, and a trusted instruction shouldn’t become indistinguishable text.
The core principle:
Don’t tell it. Take it away.
In Chapter 11 of The Agentic Development Lifecycle, I explore real-world attack mechanisms, why allowlists can fail, and why structural controls offer a stronger defence than prompts alone.
📖 Read Chapter 11 — Verification & Security:
The Agentic Development Lifecycle — Chapter 11
💬 Challenge: What’s the most dangerous permission your AI coding agent has—and does it actually need it?
Top comments (1)
Agreed on provenance, and I'd push one step past it: an allowlist can only express what the owner can enumerate.
The dependency that actually caught me was not a path or a command. It was a scarce seat that ran through someone else's account, plus a platform requirement I didn't own. No permission list could name it, so a longer allowlist would not have caught it. That authority is only knowable from the task side: before work starts the agent declares what its runtime actually reaches, and the owner marks which of those they actually cover. Otherwise "don't tell it, take it away" quietly becomes "take away what we remembered to name."
One more failure mode worth a line in the chapter: verification costs runtime, so it is the first thing cut when a budget tightens, and a check that never ran looks exactly like a passed one in the log.