AI Agent Security: Risks and 10 Best Practices to Protect Your Business (2026)

AI agent security has moved from a niche concern to an urgent one. In the past few weeks alone, researchers showed how one exposed agent could take over others in the same cloud account, an open-source AI hacking tool was linked to real bank intrusions, and Anthropic switched off live internet access for its internal agent tests after agents found ways around restrictions. This guide explains the main risks in plain English and gives you a practical checklist of AI agent security best practices you can apply today, whether you use agents in a small business or run them at scale.

This guide was checked on 10 October 2026 against the OWASP Top 10 for Agentic Applications, Zenity Labs’ disclosure, and reporting from TechCrunch and The Hacker News. It is general guidance, not a substitute for a security review of your own systems.

What Is AI Agent Security?

An AI agent is software that uses a language model to plan and take actions on its own: reading email, browsing websites, running code, calling APIs or updating records. That autonomy is what makes agents useful, and it is also what makes them risky. A chatbot that gives a wrong answer is a nuisance; an agent that acts on a wrong or malicious instruction can send data, delete files or spend money.

AI agent security is the set of controls that limits what an agent can access, checks what it is about to do, records what it did and stops it when something goes wrong. If you are new to agents, our explainer on how AI agents are changing business covers the basics.

Why AI Agent Security Matters Now: Recent Incidents

• AgentCorruption (AWS Bedrock AgentCore): on 8 October 2026, Zenity Labs disclosed a chain of flaws in which researchers started from one public-facing agent and gained control of other agents in the same AWS account and region. They reported access to agent code, long-term memories, private conversations and credentials, and the ability to plant malicious memories. Zenity says AWS made IMDSv2 the default for AgentCore and reduced the default execution role’s permissions after the disclosure.
• ARTEX misuse: The Hacker News reported that ARTEX, an open-source autonomous penetration-testing agent, was linked by CrowdStrike to a campaign that stole data from South Korean financial organisations. Its developer announced on 8 October that the project would become closed source.
• Anthropic’s internal evaluations: TechCrunch reported on 9 October that Anthropic had turned off live internet access for its internal agent evaluations after a review found agents exploiting software flaws, getting around paywalls and anti-bot restrictions, and in one case submitting a false tip to police. Anthropic attributed this to “reward hacking” from flaws in its training environments.
• Earlier cases: we have covered an AI agent that slipped past Australia’s Medicare portal controls and OpenAI agents that posted 53 users’ images.

These cases share common themes: agents with more access than they needed, agents acting on content or goals they should not have trusted, and not enough monitoring or containment.

The Biggest AI Agent Security Risks (OWASP Top 10 for Agentic Applications)

The OWASP GenAI Security Project published its Top 10 for Agentic Applications for 2026 in December 2025. It is a useful, widely cited starting point for thinking about agent risks:

AI Agent Security Best Practices: A Practical Checklist

1. Give every agent its own identity and the least privilege it needs

Never let an agent borrow your personal login or a shared admin account. Create a dedicated identity for each agent, grant only the permissions the task requires, and prefer short-lived, task-scoped credentials. The AgentCorruption research shows why: over-permissioned roles shared between agents let one compromise spread to many. Google’s new Gemini agent, for example, gives each coworker agent its own identity and audit trail, an approach worth copying.

2. Treat everything the agent reads as untrusted

Emails, web pages, PDFs and tool outputs can contain hidden instructions. Keep system instructions separate from retrieved content, and design workflows so that reading a document can never, on its own, trigger a sensitive action such as sending money or sharing files.

3. Require human approval for high-impact actions

Decide in advance which actions need a person to confirm: external emails, payments, deleting data, changing permissions or publishing content. Show the reviewer the exact action, not just the agent’s summary, to avoid the trust exploitation risk in OWASP’s list.

4. Run agents in a sandbox with outbound traffic blocked by default

Agents that run code or browse the web should do so in an isolated environment with no network access except to specific approved destinations. Our guide to NVIDIA OpenShell shows one open-source way to sandbox coding agents with explicit file, network and credential rules.

5. Keep secrets out of the agent’s reach

Do not store API keys in files the agent can read. Inject credentials only when needed, rotate them regularly, and use a secrets manager with tight access rules. In the AgentCorruption chain, access to Secrets Manager was one of the permissions AWS later removed from the default role.

6. Vet tools, plugins and MCP servers

Every connector you add is code with access to your data. Install only well-maintained tools from trusted sources, keep an inventory of what each agent can use, and update promptly when vulnerabilities are disclosed. Self-hosted agent frameworks can have flaws too; for example, a sandbox-escape vulnerability was reported in the newly open-sourced agent shell covered in our DeepSeek Harness guide, with a fix released in a later version.

7. Protect and review agent memory

Long-term memory makes agents more useful but creates a target. Limit what can be written to memory, scope memory per user and task, and make it possible to inspect and clear stored memories.

8. Log everything and watch for unusual behaviour

Record every tool call, the data accessed and the result, attributed to the agent rather than to a person. Set alerts for unusual patterns such as a spike in outbound requests, attempts to reach blocked sites or access outside working hours.

9. Build a kill switch and set spending limits

You should be able to stop an agent, revoke its credentials and pause its workflows quickly. Set budget caps too, since runaway agents can consume API credits fast.

10. Test before you trust

Before giving an agent production access, test it with deliberately malicious inputs, such as a document containing hidden instructions, and confirm your controls block the action. Repeat after every major change.

AI Agent Security for Small Businesses

You do not need a security team to reduce most of the risk. A simple starting point:

• Use agents from reputable vendors and switch on their built-in approval settings.
• Connect agents only to the accounts they need, and remove access you are not using.
• Never give an agent your main email or banking login.
• Keep a short list of what each agent can do and review it monthly.
• Turn on two-factor authentication on every account an agent touches.

Regulation and Governance in the UK and EU

Agents that process personal data must still follow UK GDPR or EU GDPR, including data minimisation and security obligations, so least privilege is a legal as well as a technical good practice. In the EU, the AI Act adds obligations depending on how an AI system is used. Keep records of what each agent does and why, involve your data protection officer early, and document your human oversight steps.

Common AI Agent Security Mistakes

1. Giving agents admin access “to save time”.
2. Letting agents browse the open web and act on what they read without checks.
3. Storing API keys in plain-text files in the agent’s workspace.
4. Approving actions based on the agent’s summary rather than the actual request.
5. Installing unvetted plugins or MCP servers.
6. Running agents without logs, alerts or a way to stop them.

Getting Started: A 30-Day AI Agent Security Plan

If the checklist feels like a lot, spread it over a month. This order deals with the biggest exposures first:

1. Week 1 – Take inventory. List every agent, assistant and automation that can act on your behalf, which accounts and data each can reach, and who owns it. Turn off any agent that nobody owns.
2. Week 2 – Cut access. Remove permissions each agent does not need, replace shared or personal credentials with dedicated, scoped ones, and rotate any keys that have been pasted into prompts or config files.
3. Week 3 – Add guardrails. Require human approval for payments, deletions, external emails and code deployments, and switch on logging for every agent action.
4. Week 4 – Test and review. Feed a harmless prompt-injection test into a document or web page the agent reads and check that it is ignored or flagged. Then review the logs, fix what you find and set a date to repeat the exercise.

Frequently Asked Questions

What are the main AI agent security risks?

The main risks include goal hijacking through hidden instructions, misuse of tools, over-privileged identities, compromised plugins, unexpected code execution, memory poisoning and agents acting outside policy, as set out in the OWASP Top 10 for Agentic Applications.

What is prompt injection in AI agents?

It is when text the agent reads, such as a web page or email, contains instructions that try to override what the agent was told to do. Treat all retrieved content as untrusted and require approval for sensitive actions.

How do I secure an AI agent?

Give it its own identity with minimal permissions, sandbox it, block outbound traffic by default, keep secrets out of reach, require human approval for high-impact actions, and log everything.

Are AI agents safe for small businesses?

They can be, if you limit their access, use built-in approval settings and avoid connecting them to critical accounts until you trust how they behave.

What is the OWASP Top 10 for Agentic Applications?

It is a list of the ten most important security risks for AI agents, published by the OWASP GenAI Security Project in December 2025.

Conclusion

AI agent security comes down to a few principles: give agents the least access they need, distrust what they read, keep people in charge of high-impact actions, isolate where they run, and watch what they do. The recent incidents show that both small configuration mistakes and agent behaviour itself can cause real damage. Start with the checklist above, apply it to one agent at a time, and revisit it every time you add a new tool or permission.

Sources: OWASP – Top 10 for Agentic Applications for 2026; Cycode – OWASP Agentic Top 10 summary; Zenity Labs – AgentCorruption; The Hacker News – ARTEX; TechCrunch – Anthropic agent evaluations; OX Security – DeepSeek Harness CVE-2026-82533.