Because an agentic AI tool can take actions, errors can have amplified impact. Beyond cybersecurity basics, which we do not list here, system owners must test for common agentic generative AI vulnerabilities and attack patterns.

Tests for Known Risks

A popular proposed agentic security framework posits that there are three primary identified cybersecurity risks known together as the “lethal trifecta”:

1. An agent processes untrustworthy inputs/prompts.
2. An agent has access to sensitive systems and/or data.
3. An agent can change state in internal systems or communicate externally to exfiltrate information.

High-stakes agentic systems should demonstrate baseline resilience to these risks, as determined by a cybersecurity expert, before AI agent deployment and during periodic reassessment on a schedule similar to other cybersecurity best practices by testing for prompt injection resistance (both direct and indirect), sensitive information disclosure, unauthorized actions or excessive agency, knowledge-source poisoning, and indirect injection.

Harness Requirements and Minimum Necessary Autonomy

All AI agents exist within a proper runtime environment (sometimes called a “harness”) vetted by security experts, similar to many internal organization applications. The environment may be a virtual machine, container, or other self-contained environment that should perform the following standard cybersecurity actions:

• Policy enforcement: Enforce predetermined allow-and-deny rules for potentially risky actions independent of the agent.
• System alerts and circuit breakers: Report anomalous activity to the security lead and, if appropriate, immediately halt execution of the action.
• Logging and traceability: Log tool actions, harness decisions (allow/deny), data inflow and outflow, and other relevant actions.
• Input sanitization: Run a sanitizer on any user- or external agent–collected inputs to rewrite imperative prompts that could override the agent’s instructions.

To mitigate risks represented by the lethal trifecta, systems should also reduce exposure to the minimum number of the three major risks. In no case should more than two be permitted at any given time.

For the risks not eliminated, agents should follow traditional IT principles of least privilege and least autonomy. The principle of least autonomy means that hard-coded or deterministic patterns should be followed where decision and planning freedom is not necessary.

Planned, Repeatable, and Scalable Red Teaming

Red teaming is a simulation of a real-world cybersecurity attack meant to test for system vulnerabilities. For generative agentic AI systems, red teaming should combine manual probing with systematic measurement and automation.

• Plan red teaming as a life-cycle practice: Conduct initial manual red teaming to identify harms and attack surfaces, then translate findings into measurable test sets for ongoing issues.
• Use automation for repeatability: Use automated systems that operate as open frameworks designed to help teams proactively identify risks in generative AI systems and scale red-teaming activities.

Next section: Principle 4: Create an Accessible Audit Trail