GenAI & LLMs · August 2026

Agent security from first principles to production

A practical guide to securing AI agents, tools, memory, protocols, and multi-agent workflows—from threat modeling to incident recovery.

RAG retrieval augmented generation overview

AI agents can read documents, call APIs, update records, coordinate tasks, and hand work from one system to another. That ability is what makes them useful—and what makes their security model different from a conventional chat interface. An agent is not only generating text; it is interpreting untrusted input, selecting tools, carrying identity and memory, and producing side effects in the world.

The One+i Agent Security repository is an open, source-linked learning path for understanding those risks and building safer systems. It turns security from a final checklist into a set of design decisions that can be learned, tested, reviewed, and improved.

Start with the system, not the model

A model is only one component of an agentic system. The attack surface also includes prompts, retrieved content, tools, credentials, memory, orchestration logic, external protocols, queues, logs, and the people who approve actions. A useful threat model asks four questions: what can enter the system, what can the agent access, what can it change, and how will the team detect and recover from a mistake?

Layered agent security guardrails across inputs, identity, tools, evidence, approvals, and monitoring — Secure agents by layering controls around inputs, identity, tools, evidence, approvals, and recovery.

The learning path: Learn → Lab → Checkpoint

The curriculum is organized into Beginner, Intermediate, and Advanced paths. Each lesson combines a concept explanation, source-linked reading, practical material, and a checkpoint. The sequence is deliberately hands-on: learners move from understanding a risk to implementing a small control and then testing whether the control behaves as intended.

Beginner foundations: boundaries before autonomy

The beginner path introduces security foundations and threat modeling, tool policy, authorization, approval, prompt injection, and untrusted content. Its capstone is a secure research assistant with narrow tools, explicit evidence, and policy boundaries. The central lesson is simple: an agent should have only the access and autonomy required for its job.

Prompt injection is an input-control problem

Prompt injection is often described as a clever sentence that tricks a model. In practice, the deeper issue is authority confusion: instructions from a webpage, document, email, or tool result are treated as if they came from a trusted operator. Defenses should separate instructions from data, label provenance, constrain tool arguments, validate outputs, and require approval before sensitive or irreversible actions. No prompt can replace a permission boundary.

Intermediate controls: identity, memory, and protocols

As systems become useful, they need identity propagation and memory. That creates new questions: whose permissions should an action use, how long should a memory live, can a user delete it, and could one tenant’s context leak into another’s response? The intermediate path also covers MCP gateway security, workflow policy, release gates, incident response, containment, idempotent recovery, and safe replay.

Treat memory as sensitive state, not a convenience cache. Minimize what is stored, attach ownership and retention metadata, encrypt it appropriately, filter retrieval by authorization, and make deletion and correction observable. For protocols such as MCP, place a controlled gateway between the agent and tools so authentication, authorization, validation, rate limits, and audit logging are consistent.

Advanced practice: test failure, not only success

Production readiness requires adversarial evaluation. Test malicious documents, poisoned tool results, confused-deputy scenarios, excessive agency, cascading multi-agent failures, replayed requests, partial outages, stale permissions, and attempts to bypass a kill switch. Measure whether the system refuses safely, limits blast radius, preserves evidence, and recovers without duplicating side effects.

A production release gate

Before expanding autonomy, document the allowed tools, data classes, identity model, approval points, failure states, monitoring signals, rollback procedure, and accountable owner. A release gate should answer: can the team explain what the agent did, prove which evidence it used, revoke access quickly, stop execution, and restore a known-safe state? If any answer is no, the system is not ready for more autonomy.

A practical security loop

Agent security is continuous: model the threat, implement a narrow control, evaluate expected and adversarial behavior, observe real usage, and update the policy. The goal is not to eliminate every possibility of failure. It is to make failures bounded, visible, recoverable, and increasingly rare.

Explore the course and test your understanding

The repository includes Python labs, notebook companions, secure research and support-workflow scenarios, incident-response exercises, governance material, and a security tools guide. The Learning Hub provides the guided curriculum; the interactive quiz checks understanding across foundations through production governance.

Explore the Agent Security repository ↗

Open the Agent Security Learning Hub ↗

Take the Agent Security Knowledge Check ↗