Thien Ban BUI

Posted on Sep 23 AI-assisted

Your AI Agent Has Too Much Power

#ai #webdev #automation #opensource

If you've connected an LLM to tool calling, APIs, or database queries recently, you know the feeling: agents are terrifyingly unpredictable.

Giving an LLM the ability to decide its own next step means shifting from passive text generation to active system execution. In demos, it looks like magic: the agent reasons, picks a tool, fetches data, and loops until the task is solved.

In real life?

An indirect prompt injection slipped inside an ingested PDF instructs your agent to exfiltrate private DB records via an outbound HTTP webhook.
A looping reasoning process burns 80,000 reasoning tokens in 12 turns on a dead-end premise, costing 50x more than expected.
Sensitive customer PII (credit cards, emails, internal keys) is handed directly to third-party model providers inside execution context.

The traditional answer to this is the classic LLMOps sledgehammer: spin up Docker containers for Langfuse, Helicone, OpenLit, a vector database, ClickHouse, Redis, and an S3 bucket just to trace calls and apply basic guardrails.

For most developers and lean teams, the monitoring infrastructure ends up costing more in maintenance and compute than the LLM calls themselves.

There is a better way: handling security, guardrails, and cost controls in-process, directly at the application runtime level.

1. The Anatomy of an Agent Failure

When building autonomous workflows or multi-step agents, security vulnerabilities aren't theoretical — they fall into three clear failure modes:

[User / External Input]
         │
         ▼
 ┌───────────────┐
 │   Prompt /    │  <-- 1. Prompt Injection / Malicious Context
 │ Ingested Data │
 └───────┬───────┘
         ▼
 ┌───────────────┐
 │  LLM Engine   │  <-- 2. Token Loop & Budget Drainage (Hallucination)
 └───────┬───────┘
         ▼
 ┌───────────────┐
 │ Tool Execution│  <-- 3. Unauthorized Side-Effects / PII Exfiltration
 └───────────────┘

Unchecked Tool Execution & Side-Effects: Once an agent has tools, an injection is no longer just a jailbreak: it becomes Remote Code Execution (RCE) or arbitrary API manipulation.
Context Contamination & Data Leaks: If your RAG or tool outputs include raw PII, your LLM will gladly send it over the wire to external APIs or echo it into log sinks.
Runaway Loops & Cost Explosion: Without per-turn token limits and hard budget circuit-breakers, recursive tool loops can easily drain your monthly quota in minutes.

2. The Solution: Zero-Infra Control Plane with avantGate

Meet AG-Men (avantGate's in-process engine): a tiny, sub-millisecond guardian that sits directly between your model's thoughts and your backend APIs.
Avant Gate runs directly in your TypeScript process.

The Journey of an Intercepted Run

Imagine a user submits an invoice query packed with an indirect prompt injection and a customer's raw credit card. Here is how the AG-Men defend your runtime step by step:

The Cleaner (Local PII Sanitizer): Before a single byte leaves server memory, The Cleaner scrubs emails and credit cards on the fly. The external LLM never catches a glimpse of the private data.
The Breaker (Budget Circuit-Breaker): Turn three hits an infinite recursive loop triggered by the injection. The Breaker detects the runaway token surge, trips the fuse, and cuts the execution instantly.
The Law (Deterministic Guardrails): The hallucinating agent tries to force an unvetted database write. The Law blocks it cold against a strict Zod contract — zero unauthorized side-effects.
The Shapeshifter (Resilient Fallback): The primary model throws a sudden 529 Overloaded. The Shapeshifter catches the fall mid-air and swaps to a backup provider, landing the mission safely without a glitch.

3. Hands-on: Securing an Agent Workflow

Here is how you wrap your agent runtime with avantGate in TypeScript:

Step 1: Initialize the Control Plane

import { AvantGate } from 'avantgate';

const gate = new AvantGate({
  budget: {
    maxCostPerMinute: 0.50, // Circuit breaker: halts calls if threshold is reached
    maxTokensPerTurn: 4000
  },
  pii: {
    redact: ['email', 'credit-card'],
    maskChar: '*'
  },
  fallback: [
    'anthropic/claude-3-5-sonnet',
    'openai/gpt-4o-mini'
  ]
});

Step 2: Safe Tool Execution & Workflow Interception

In an agentic workflow, you must never let the model invoke tools with unchecked parameters. You can intercept and validate both the step input and the agent's intent:

import { z } from 'zod';

// Define strict contract for the tool
const SearchDatabaseSchema = z.object({
  query: z.string().max(200),
  limit: z.number().int().min(1).max(20),
});

async function runSecuredAgentStep(userPrompt: string) {
  // 1. AvantGate sanitizes input (PII redaction) & checks budget in-process
  const safeExecution = await gate.run(async (context) => {

    const response = await context.completion({
      model: 'anthropic/claude-3-5-sonnet',
      messages: [{ role: 'user', content: userPrompt }],
      tools: [
        {
          name: 'search_database',
          description: 'Search internal records',
          parameters: SearchDatabaseSchema,
        },
      ],
    });

    // 2. Validate agent tool calls before execution
    if (response.toolCalls) {
      for (const call of response.toolCalls) {
        if (call.name === 'search_database') {
          const validatedArgs = SearchDatabaseSchema.parse(call.args);
          return await executeInternalSearch(validatedArgs);
        }
      }
    }

    return response.content;
  });

  return safeExecution;
}

If an injection attempts to inject DROP TABLE or trigger a recursive chain that blows past your token limits, avantGate halts the execution context before it wrecks your infrastructure.

4. Why In-Process Beats External LLMOps for 90% of Use Cases

Concern	External LLMOps Stack	In-Process Control Plane (avantGate)
Infra overhead	Docker, Postgres, ClickHouse, Redis	Zero (Pure TypeScript module)
Network Latency	Additional network hops per call	Sub-millisecond (runs in memory)
Data Privacy	Prompts/logs stored in external databases	Zero egress (data never leaves your runtime)
Maintenance	Migrations, backups, version upgrades	Update avantGate

Conclusion & Next Steps

Agents are the future of software engineering, but building agents without deterministic boundaries is an invitation for disaster. You don't need a 5-container infrastructure stack to build secure, cost-contained AI tools.

Check out the project and docs on GitHub:
👉 Avant Gate

How are you currently handling runaway agent loops and tool validation in your stack? Let's discuss in the comments below! 🚀

DEV Community