Published October 30, 2026
What changes when AI takes actions
OWASP describes AI agents as systems that plan, decide and act across multiple steps and systems, often on behalf of users and teams. OWASP's 2026 prompt injection entry says tool calls extend the blast radius to whatever the agent's tools can reach.
OWASP calls the underlying weakness excessive agency: damaging actions performed in response to unexpected, ambiguous or manipulated output from a model. It names three root causes: excessive functionality, excessive permissions and excessive autonomy. Excessive Agency is LLM03 in the 2026 edition of the OWASP Top 10 for LLM Applications.
One way to manipulate an agent is indirect prompt injection. NIST describes agent hijacking as an attacker inserting malicious instructions into data an agent may ingest, such as an email, a file or a website. OWASP's 2026 prompt injection entry states that no reliable prevention mechanism exists today.
OWASP advises designing on the assumption that injection will eventually succeed, and limiting what the model can do when it does.
Whose authority does the agent use
Decide for each agent whose rights it acts with. That sets the blast radius of every other failure.
| Model | How it works | Where it fits |
|---|---|---|
| On behalf of a user (delegated) | The agent gets a token scoped to one user and can do only what that user could do. | Assistants that work on one person's mail, calendar or files |
| Its own identity (autonomous) | The agent has its own identity, with permissions an administrator grants it directly. | Back-office agents that run without a user present |
| Shared service account or personal API key | The agent runs on an existing broad credential. | Avoid. Logs cannot tell one agent from another |
Microsoft Entra Agent ID supports both of the first two models. An agent that schedules meetings for one user uses delegated permissions and cannot exceed that user's access. An autonomous agent uses application permissions, which an administrator must consent to.
The guidance to work from
| Source | What it covers |
|---|---|
| OWASP Top 10 for LLM Applications | The 2026 edition was posted in August 2026 and announced September 2, 2026. Prompt Injection remains LLM01. Excessive Agency moved from LLM06 in 2025 to LLM03. |
| OWASP Top 10 for Agentic Applications 2026 | Released December 9, 2025. Ten risks, including ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI06 Memory and Context Poisoning and ASI10 Rogue Agents. |
| OWASP AI Agent Security Cheat Sheet | Tool scoping, approval rules, memory limits and logging. |
| OWASP Agent Control Standard | Donated to the OWASP GenAI Security Project, announced September 2026. Defines how agent platforms expose middleware hooks and how safety policies are enforced through them at runtime. |
| Model Context Protocol (MCP) specification | Version 2026-07-28. The authorization rules and security best practices for connecting agents to tools through MCP servers. |
| NIST NCCoE concept paper | Accelerating the Adoption of Software and AI Agent Identity and Authorization, draft, February 2026. Lists MCP, OAuth 2.0 and 2.1, OpenID Connect, SPIFFE/SPIRE, SCIM and NGAC as standards under consideration. |
The order of the work
- Inventory agents and their tools. For each agent, list the tools and MCP servers it can call, the credentials it holds and its human owner. Entra Agent ID records the accountable person or group as a sponsor, who can be contacted if a security incident happens.
- Give each agent its own identity. Retire shared service accounts and personal API keys. A separate identity lets you scope, log and revoke one agent without touching others.
- Cut tools and permissions to the task. OWASP's guidance: offer only the tools the task needs, avoid open-ended tools such as a shell, and grant read-only access where reading is enough.
- Enforce authorization outside the model. OWASP calls this complete mediation: the tool, an independent policy decision point or the downstream system checks each request against policy. OWASP's cheat sheet says a user_confirmed flag is insufficient.
- Treat all external content as untrusted. Emails, documents, web pages and tool output can carry instructions. OWASP advises separating and labeling that content and keeping credentials and state-changing functions in code.
- Define which actions need human approval. List the agent's actions by risk and require approval for the high-risk ones before they run.
- Log every decision and tool call. Then test the agent with injection attacks before production and after each change to its tools or model.
What takes longer than expected
- Finding the credentials. Check whether pilot agents run on a developer's token or a broad API key. Trace which systems each key reaches before you replace it.
- Scoping permissions for unpredictable work. The NCCoE concept paper asks how to establish least privilege for an agent whose required actions may not be fully predictable when it is deployed. Answer it one tool at a time.
- MCP servers. The MCP security guidance lists wildcard scopes such as `*`, `all` or `full-access` as a common mistake. It tells clients to warn users that a local MCP server runs with the same privileges as the client.
- Red-team results that do not settle. NIST attempted each of five agent hijacking attacks 25 times. The average success rate rose from 57% to 80%.
The detail plans leave out
- Token audience. The MCP specification requires servers to accept only tokens issued for them, and forbids passing a client's token through to downstream APIs. Clients must name the target server in each authorization and token request, as RFC 8707 resource indicators define.
- Approvals bound to the action. OWASP's cheat sheet binds each approval to the actor, tool, target, parameters and an expiry, and asks for new approval if the target or parameters change. It treats unmapped tools as high risk by default.
- Fail closed. OWASP's cheat sheet says to fail closed when risk classification, approval validation, policy lookup or audit logging fails.
- Memory. OWASP lists Memory and Context Poisoning as ASI06: corrupted memory changes an agent's behavior well after the original interaction. Its mitigations include isolating user sessions and expiring unverified memory. The cheat sheet adds size limits.
- Approval fatigue. OWASP's ASI09, Human-Agent Trust Exploitation, covers polished explanations that lead operators to approve harmful actions. OWASP advises showing the approver the exact action, not a summary.
Logging, platforms and vendor terms
For high-risk actions, OWASP's cheat sheet asks for the action classification, the authorization outcome, the approval identifier, the execution result and the policy version. Its example logger redacts passwords, API keys and tokens before writing. Tie each action to an agent identity and, for delegated agents, to the user.
Microsoft Entra limits agent privileges by design. It blocks roles such as Global Administrator, Privileged Role Administrator and User Administrator for agent identities. It also blocks Microsoft Graph permissions including User.ReadWrite.All and RoleManagement.ReadWrite.All, even with administrator consent. Agent identities created from one blueprint can be disabled together.
For vendor agents, ask which identity the agent runs as, which permissions it requests, what it logs, and how fast you can revoke its access.
Skills and operations
Name an owner for each agent and a security reviewer for each new tool it gains.
Operations needs a rehearsed way to stop an agent: disable its identity, revoke its tokens, remove its tools. Monitor for abnormal tool-call frequency, repeated attempts to bypass approval and sudden increases in high-risk actions, which OWASP's cheat sheet lists as signals.
Budget for red-teaming as a repeated activity. NIST's March 2026 analysis of a public competition, more than 250,000 attack attempts from over 400 participants, found at least one successful attack against every one of the 13 frontier models tested.
Settle these first
- Which agents are running today, and what credentials do they hold?
- Does each agent act on behalf of a user or with its own identity?
- Which tools does each agent need, and which can be read-only?
- Which actions require human approval, and who approves them?
- Where is authorization enforced, and is it outside the model?
- What is logged for each action, and how fast can you stop an agent?
Questions
- Can prompt injection be prevented?
- Not reliably. OWASP's 2026 entry states that no reliable prevention mechanism exists today. Limit what an injected agent can do: least privilege, authorization outside the model, separation of untrusted content and human approval for high-risk actions.
- What is excessive agency?
- OWASP's term for damaging actions performed in response to unexpected, ambiguous or manipulated model output. Its root causes are excessive functionality, permissions and autonomy. It is LLM03 in the 2026 OWASP Top 10 for LLM Applications.
- Should an AI agent have its own identity?
- Yes, so it can be scoped, logged and revoked on its own.
- Which agent actions need human approval?
- OWASP's cheat sheet rates sending email and running code as high risk, and deleting data and transferring funds as critical. It asks for step-up authentication for payment initiation, privilege changes and production deployment.
- Is MCP secure by default?
- Authorization is optional in the MCP specification. When used, it is based on OAuth 2.1, servers must accept only tokens issued for them, and token passthrough is forbidden.