--- title: "AI agents and models ยท Agent Wranglers" url: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models updated: 2026-10-20 licence: "All rights reserved" --- # AI agents and models By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20. > Attacks on your own AI features. Prompt injection, leaked data, tools that do too much, poisoned memory and runaway costs, with the test for each. **For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models`. ## Required - [Resist direct prompt injection](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/direct-prompt-injection): Assume any user can talk your model into ignoring its instructions. Enforce every limit in code outside the model, never only in the prompt. - [Resist indirect prompt injection](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/indirect-prompt-injection): Treat every page, file, email and tool result the model reads as data that may contain hostile instructions. - [Give agent tools the least power they need](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/least-privilege-tools): Give the model only the tools its task needs, each with the narrowest rights, acting as the user and never as an administrator. - [Ask a person before the agent spends or deletes](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/human-approval): Require a clear yes from the user before the agent pays, sends a message, deletes data or changes an account. - [Treat model output as untrusted](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/untrusted-model-output): Handle every model answer like text from a stranger. Escape it before showing it, and never run it as code, SQL or a shell command. - [Keep secrets out of the system prompt](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/no-secrets-in-prompt): Write the system prompt as if it will be published. It holds no keys, passwords, internal addresses or private rules. - [Scope what the model can look up to the user](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/scoped-retrieval): Let the model find only the documents and records the current user may read. Never search one shared index across all customers. - [Allow only reviewed tools and servers](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/pinned-tools): Connect your agent only to tools and MCP servers you have reviewed. Pin their versions and descriptions so they cannot change without review. - [Limit cost, steps and loops](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/cost-and-loop-limits): Cap the tokens per answer, the steps per task and the spend per user per day. Stop the agent when any cap is hit. - [Break the lethal trifecta](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/lethal-trifecta): Never give one agent all three of private data, untrusted content and a way to send data out. Remove at least one. - [Accept only tokens issued for your MCP server](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/mcp-token-audience): An MCP server you run accepts only access tokens issued for it. It never passes a client's token on to other APIs. - [Use models and data from trusted sources](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/trusted-model-sources): Load models, adapters and training or search data only from sources you have reviewed, pinned by version or hash. - [Check every model answer against a schema](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/validate-model-output): Parse every model answer your code acts on against a schema before you use it. Reject, retry or fall back when it does not match. - [Keep a switch that turns the agent off](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/agent-kill-switch): Be able to switch off an agent, or one of its tools, for every user at once and without a deploy. - [Run code the model writes in a sandbox](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/sandbox-model-code): Run code or commands a model writes only in a throwaway sandbox. It has no secrets, no network and fixed limits on time, memory and disk. ## Recommended - [Protect agent memory](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/memory-poisoning): Save to long-term memory only what the user said or approved, and keep each user's memory apart. - [Ground answers in your own data](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/grounded-answers): Let the model state prices, policies and account facts only from your own tools and documents, and show where each came from. - [Send models only the private data they need](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/private-data-to-models): Send a model provider only the personal data a task needs, under terms that forbid training on it. - Previous: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup) - Next: [Hostile agents and bots](https://agentwranglers.se/playbook/adversarial-testing/hostile-agents-and-bots) - [All chapters](https://agentwranglers.se/playbook/adversarial-testing)