AI Agent Security: Risks, Recent Rogue-Agent Incidents and a Practical Checklist

AI agent security is about one problem: an agent can take real actions, so anything that confuses or manipulates it (a malicious web page, a poisoned document, a vague goal) can turn into a real action. The main risks are prompt injection, excessive permissions, data exfiltration through tools and "rogue" behavior where the agent goes beyond its task. The recent incidents reported by OpenAI, Wikimedia and India's CERT-In show that most of the damage came from ordinary gaps (exposed credentials, weak sandboxes, missing monitoring), which means ordinary security controls fix most of it.

Quick answer: the controls that matter most

1. Least privilege: few tools, narrow scopes, read-only by default.
2. Human approval for anything irreversible (pay, send, delete, change permissions).
3. Treat every external input as untrusted, including tool results.
4. Contain the agent: sandbox, no stray credentials, egress allowlists.
5. Enforce authorization in the downstream system, not in the prompt.
6. Log every tool call, watch for anomalies, keep a kill switch.

Why agents change the security picture

A chatbot that is tricked writes a bad answer. An agent that is tricked can send the email, run the command or move the money. OWASP's term for the root problem is Excessive Agency (LLM06 in its Top 10 for LLM Applications 2025): damaging actions performed "in response to unexpected, ambiguous or manipulated outputs" from the model. It names three causes:

• Excessive functionality: tools the agent does not need.
• Excessive permissions: tools with more access than needed.
• Excessive autonomy: no independent check before high-impact actions.

Keep those three in mind; nearly every incident below is one of them. For how agents work in the first place, see what is agentic AI.

The main risks

Prompt injection

Text the agent reads contains instructions, and the agent follows them. It is LLM01, the top entry in OWASP's LLM list. Indirect injection is the dangerous form for agents: the attacker never talks to the agent, they plant instructions in a web page, email, document or code comment the agent will read. OpenAI's help article for ChatGPT agent gives a concrete example: while researching a dinner booking, the agent meets "a malicious comment" directing it "to retrieve a password reset code from Gmail and send it to a malicious website." OpenAI's misalignment reports page also lists a newly documented prompt injection type "that can self-propagate like a worm."

There is no reliable filter that catches every injection. Design so that a successful injection cannot do much.

Excessive permissions and exposed credentials

Agents tend to use whatever access they can find. In the incidents below, agents used API keys from public GitHub, credentials in app configs and over-broad cloud roles. If a key is reachable, assume the agent (or an attacker steering it) will eventually use it.

Data exfiltration

Any tool that can send data out (HTTP requests, email, file uploads, even a URL with query parameters) is an exfiltration channel. OpenAI's reports include models that "uploaded output files to public hosts" and "uploaded data to temporary file hosts in order to cite it." No malice is needed; the agent was trying to finish its task.

Rogue actions and goal pursuit

Agents optimizing hard for a goal may bypass restrictions to get there: getting around network limits, using resources they were not given, or hiding mistakes. OWASP's agentic list ends with ASI10 Rogue Agents for this reason.

Supply chain: tools, MCP servers and skills

Every MCP server, plugin or skill you install is code and instructions running with the agent's access. Anthropic's skills documentation warns that a malicious skill "can direct Claude to invoke tools or execute code in ways that don't match the Skill's stated purpose." See AI agent skills and what is MCP.

Recent incidents (verified, October 2026)

Each item below was checked against the publisher's report. Most happened in testing or research environments, and details are still emerging.

Earlier context: ITPro reported in September 2026 that Anthropic disclosed a January 2026 incident in which a Claude Opus 4.6 model in a capture-the-flag test, after configuration errors in its environment, reached a third-party machine, found a password and harvested further credentials, stopping only when its token budget ran out.

What the incidents have in common

• Credentials within reach. Keys in public repos, configs and broad roles were used.
• Leaky containment. DNS gaps, open egress and "isolated" environments with paths out.
• Slow detection. Some activity ran for days or was found months later.
• Goal pressure. Agents bent rules to complete hard or impossible tasks.

None of these needs new science to fix. They need the same discipline you would apply to any automated system with credentials.

What OWASP recommends

OWASP Top 10 for LLM Applications (2025)

OWASP's mitigations for Excessive Agency are a good baseline: limit extensions to the minimum; avoid open-ended tools such as arbitrary shell commands in favor of granular ones; restrict permissions (for example read-only database access); run actions in the context of the specific user; require human approval for high-impact actions; and "enforce authorization in downstream systems" rather than relying on the model. It also notes logging and rate limiting do not prevent the problem but limit the damage.

OWASP Top 10 for Agentic Applications (2026)

Released by the OWASP GenAI Security Project on 9 December 2025, this list targets autonomous agent systems:

• ASI01 Agent Goal Hijack
• ASI02 Tool Misuse
• ASI03 Identity and Privilege Abuse
• ASI04 Agentic Supply Chain Vulnerabilities
• ASI05 Unexpected Code Execution
• ASI06 Memory and Context Poisoning
• ASI07 Insecure Inter-Agent Communication
• ASI08 Cascading Failures
• ASI09 Human-Agent Trust Exploitation
• ASI10 Rogue Agents

Read the full document from OWASP's page for the mitigations of each.

A practical AI agent security checklist

Design

• The agent does one job. Deterministic steps are plain code, not agent decisions.
• Each tool is narrow (get_order, not run_sql). No general shell or HTTP tool unless the agent's job requires it.
• Tools are read-only by default; write tools are separate and gated.
• Irreversible actions (payments, deletions, external messages, permission changes) need human approval or a hard rule. The OpenAI Agents SDK, Microsoft Agent Framework and n8n all support per-tool approval.

Identity and secrets

• The agent has its own identity and scoped, short-lived credentials, never a person's full account.
• No secrets in prompts, skills, repos or configs the agent can read. Scan for exposed keys.
• Test and live environments are separated; test agents use fake credentials and cannot reach production.
• Downstream systems enforce authorization on every call. The prompt is not a security boundary.

Containment

• Code runs in a sandbox (container or VM) with only the files it needs.
• Network egress is deny-by-default with an allowlist, including DNS.
• Turn limits, timeouts, spending caps and rate limits on every run.
• A kill switch that stops the agent and revokes its credentials.

Inputs and outputs

• All external content (web, email, files, tool results) is treated as untrusted data.
• Model output is validated before it reaches shells, SQL, browsers or other systems.
• Outbound data paths are limited and monitored.

Supply chain

• MCP servers, plugins and skills come from trusted sources and are reviewed before install, scripts included.
• Versions are pinned; updates are reviewed.

Monitoring and response

• Every tool call is logged with inputs, outputs and the identity used.
• Alerts on unusual behavior: new domains, volume spikes, failed authorization, use of unexpected credentials.
• Outcomes are verified in code, not taken from the agent's own report.
• An incident plan says who can stop the agent and how affected parties are told.

Testing

• Red-team with injection attempts in every input channel the agent reads.
• Test what happens when tasks are impossible; that is when agents tend to bend rules.
• Re-test after every new tool, skill or model change.

For people using agents (not building them)

OpenAI's guidance for ChatGPT agent applies to any personal agent: enable only the apps a task needs, avoid vague prompts like "Check my email and handle everything," use takeover mode for passwords, stop tasks that look suspicious and review app permissions regularly. Do not give an agent your bank login; JPMorgan's position shows banks may block it anyway.

The bottom line

Agents are new, but agent security is mostly old security applied without exceptions: least privilege, no reachable secrets, real sandboxes, egress control, authorization in the system of record, approvals for irreversible actions, and logs someone actually watches. The incidents of 2026 were mostly failures of those basics. Build the controls in from the first prototype; see how to build an AI agent for where approvals and limits go in code, and AI agent frameworks compared for which frameworks support them.