What Makes An AI Agent Different From A Chatbot, And Why Security Teams Care
A chatbot writes text for a person to read. An agent turns model output into actions with real permissions. That shift changes who can attack it and what they can achieve.
KNOWLEDGE HUB / AI
Agentic AI Security
The new risks that appear when AI agents can act, and how to keep them in bounds.
The Lethal Trifecta And The Rule Of Two: A Simple Test For Risky Agents
Two short rules of thumb explain which agents an attacker can turn against you. Both reach the same answer, which is to limit the capabilities an agent can combine.
The OWASP Agentic Risk Lists Explained
OWASP publishes three related lists for agent risk. Here is what Excessive Agency, the agentic threat taxonomy and the Agentic Top 10 each cover, and how they fit together.
Prompt Injection Becomes Agent Hijacking: Lessons From Real Incidents
When a model can act, hidden instructions in an email or web page can steer real tools. How agent hijacking works, what EchoLeak showed, and where defenders can break the chain.
Securing The Model Context Protocol: Tool Poisoning, Rug Pulls And The Spec
MCP connects agents to tools and data. This guide covers where it has been attacked, what the 2026-07-28 specification requires, and what is still left to the people deploying it.
Identity For Non-Human Actors: Least Privilege, Short-Lived Credentials And Approvals
Agents act with real credentials. How to give each agent its own identity, keep its access narrow and short-lived, and place human approvals where they actually reduce risk.
Threat Modelling An Agent System With MAESTRO And The Five Risk Categories
A practical way to threat model AI agents, combining the CSA's seven-layer MAESTRO framework with the five risk categories in the May 2026 joint government guidance.
When Agents Talk To Agents: Impersonation, Cascades And Collusion
Multi-agent systems add risks a single agent does not have. How trust between agents breaks, how one compromise spreads, and the controls that contain it.
Testing Agents Before Attackers Do: Benchmarks And Large-Scale Red Teaming
How AgentDojo, InjecAgent and a large public red-teaming competition measure agent hijacking, what they found, and how to use their results without being misled.