How do you secure AI agents? Least privilege, human approval and prompt injection controls

You secure an AI agent by limiting which tools, data and permissions it holds, requiring a human to approve high-impact actions, and designing the system on the assumption that some injected instructions will reach the model. Joint guidance released on 1 May 2026 by CISA, the NSA and the Australian, Canadian, New Zealand and UK cyber agencies says organisations should never give agents broad or unrestricted access and should confine them to low-risk, non-sensitive work.

The sections below set out what that guidance, the OWASP GenAI Security Project, NIST and the UK National Cyber Security Centre (NCSC) recommend, and why agents need controls that ordinary chatbots do not.

What makes AI agents harder to secure than chatbots?

Agents take actions, so a manipulated agent can cause harm directly instead of only producing a bad answer. The NCSC describes agentic systems as able to access data sources, remember context, make decisions, use tools and act in pursuit of a goal, sometimes without continuous human intervention and even by spawning sub-agents.

The joint guidance adds that each tool, data source and memory store an agent relies on widens the attack surface. It gives the example of malicious prompts planted in phishing emails to persuade an email-monitoring agent to download malware.

NIST's Center for AI Standards and Innovation (CAISI) calls this agent hijacking: an attacker hides instructions in data the agent ingests, and the agent then takes unintended, harmful actions. In CAISI tests published on 17 January 2025, red-team attacks raised the success rate from 11% for the strongest baseline attack to 81%, and repeating attacks lifted the average success rate from 57% to 80%.

How should least privilege apply to an agent's tools?

Give each agent only the tools, functions and permissions its task needs, and enforce those limits in the systems it calls rather than in the model. OWASP's Excessive Agency entry (LLM06:2025) tells developers to restrict callable extensions to the minimum necessary and to implement authorization downstream instead of letting the LLM decide whether an action is allowed.

OWASP's own illustration is a read-only extension that connects to a database with an identity that can also update, insert and delete records. The NCSC's version of the rule is minimum access for the shortest time, with temporary credentials revoked once a task ends.

Identity matters as much as scope. The joint guidance asks developers to build every agent as a distinct principal with its own keys or certificates, and to stop agents from changing their own privileges or delegating without expiry timers and recorded grant chains.

When should a human approve what an agent does?

A person should sign off before any high-impact or privileged action is carried out. OWASP makes human-in-the-loop approval a mitigation for both prompt injection and excessive agency, and the joint guidance calls for human control points such as live monitoring, interruption and mandatory approval of decision-making steps.

Approval only works if reviewers can keep up. The NCSC warns that problems are harder to spot when agents act faster than people can meaningfully review, and it wants named owners for each agent's access, monitoring, incident review and shutdown.

Can prompt injection against agents be fully prevented?

No, according to the NCSC, which treats it as a residual risk that no product can remove. Its December 2025 advice is to focus design effort on deterministic, non-LLM safeguards that constrain what the system can do.

OWASP adds that untrusted content should be kept separate and clearly labelled so it has less sway over the prompt. In practice, the tool limits and approval gates above are what cap the damage when an injected instruction does land.

Which frameworks should agent security map to?

Start with the OWASP Top 10 for Agentic Applications, published on December 9, 2025, which OWASP describes as a peer-reviewed list of the most critical risks for autonomous AI systems, built with more than 100 experts.

The joint guidance recommends threat modelling against current agentic risk taxonomies such as the OWASP project and MITRE ATLAS, and aligning agent controls with Zero Trust principles. The NCSC points to ETSI EN 304 223 for baseline AI security requirements that cover agentic systems.

For rollout, the NCSC advises tightly bounded pilots with clearly defined tasks before any expansion, and the joint guidance wants every tool call logged in a human-readable form. A practical first step for a security team is an inventory of agents already running, listing for each one the tools it can call, the identity it uses and the person who can switch it off.