Topics / Build Securely / AI Security
AI Security
Secure AI-assisted systems and agents.
Intended audience: Beginners, practitioners, and security engineers relevant to this discipline.
4 results
Designing Human Approval Gates for AI Agents
How to design an approval gate for an autonomous AI agent's tool-driven actions — file writes, shell commands, API calls, merges — that holds even when the agent's own reasoning has been manipulated: classifying actions by reversibility and blast radius, enforcing the boundary outside the agent's output, why prompt injection defeats an instruction-only gate, and what rollback looks like for an ungated action.
Threat Modeling AI Agents with Tool Access
A method for threat modeling an AI agent's tool-access attack surface — file writes, shell commands, network calls, API keys — by enumerating its tool inventory as trust boundaries and mapping each identified threat to least privilege, human-approval gates, audit logging, or execution sandboxing.
Prompt Injection in AI-Assisted Engineering
What prompt injection actually is for AI coding and agentic tools — direct versus indirect injection, why the SQL-injection/XSS comparison helps but breaks down, and the landscape of mitigations: untrusted-data framing, least-privilege tool scoping, human approval for consequential actions, and instruction/data provenance separation.
Preventing Sensitive Data Leakage Through AI Tools
How sensitive data — source code, customer data, credentials, and internal documentation — actually leaks through AI-assisted tools: an unclear-retention chat interface, an agent's own tool output and logs, an overly broad context window, and a third-party plugin or MCP server with its own data egress path. Covers concrete mitigations that hold up against routine use: classifying data before it reaches an AI tool, reviewing a tool's actual data handling before adoption, scoping and redacting what an agent can read and log, and auditing what actually left the boundary.
Related categories