AI Agent Security Checklist

Does each agent receive only the tools and actions required for its task?

Broad write, shell, browser, or production access increases the impact of an incorrect plan or malicious instruction.

Does the agent use its own identity instead of inheriting a human administrator session?

A distinct identity makes permissions, revocation, and audit trails easier to enforce.

Do deployments, payments, account changes, destructive actions, and external messages require explicit approval?

Human approval should sit at the boundary where an action becomes difficult to reverse or affects another person.

Are production secrets, private keys, and privileged environments separated from routine agent work?

An agent cannot leak or misuse credentials it cannot access.

Is the agent prevented from granting itself or another agent broader permissions?

Delegation should not become an unreviewed path around authorization controls.

Are webpages, files, tickets, emails, tool output, and retrieved documents treated as data rather than trusted instructions?

Indirect prompt injection can arrive through content the agent was asked to inspect.

Can the system distinguish operator policy from retrieved content and lower-trust messages?

Clear trust boundaries reduce the chance that untrusted text changes the agent's objective.

Are generated commands, URLs, queries, and structured arguments validated before a tool executes them?

Model output is a proposal, not an authorization decision.

Are advisories, CVE records, and retrieved security documents timestamped and traceable to their source?

A defensible response plan needs current evidence and a way to distinguish official guidance from copied claims.

Is shared memory limited by task, tenant, sensitivity, and retention period?

Shared context can unintentionally move instructions or sensitive data between agents and users.

Do specialist agents have narrower permissions than the planner or manager coordinating them?

Task specialization improves focus only when delegation does not multiply authority.

Does the coordinating agent check evidence and policy before acting on a specialist result?

A manager should synthesize evidence, not automatically execute every subagent recommendation.

Can reviewers tell which agent requested, approved, and executed each action?

Multi-agent systems need attribution at the action level, not one combined transcript.

Are new tools, prompts, models, and workflows evaluated in an isolated environment before production access?

The cited studies used sandboxed environments; production systems need the same separation for defensive testing.

Are there limits on actions, retries, time, cost, and affected resources?

Long-running agents can repeat a bad action at machine speed without explicit limits.

Can an operator quickly pause the workflow and revoke active credentials?

Containment should not depend on the same agent that may be behaving incorrectly.

Are tool calls, permission decisions, approvals, failures, and external effects logged without recording unnecessary secrets?

Useful logs support investigation while privacy limits reduce secondary exposure.

Is there a tested plan for unexpected actions, prompt injection, credential exposure, and incorrect external messages?

Teams need a predefined containment and recovery path before an agent incident occurs.