# What is Agentic AI Security?

> Agentic AI security is the practice of protecting AI systems that pursue goals through delegated access to tools, services or other agents.

- Canonical URL: https://yellowcube.eu/glossary/agentic-ai-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Such a system may plan steps, retain memory, select tools and act for a user. Its security boundary includes the model, orchestration code, prompts, memory, tool interfaces, credentials, connected data, other agents and the action environment.

Risks include indirect prompt injection, manipulated tool results, excessive permissions, credential exposure, poisoned memory, cross-agent impersonation and harmful chains of permitted actions. Failures can also occur without an attacker when an agent misunderstands a goal or optimizes the wrong objective. Controls should limit what the agent can observe and change, with stronger approval for consequential actions.

### Key points

- **Bound authority:** Give each tool and workflow narrowly scoped, short-lived credentials; restrict destinations, data, action types, spending and execution time; and require approval for high-impact steps.
- **Context and memory protection:** Separate users and tasks, label and validate untrusted content, control what persists, record provenance and prevent retrieved instructions from silently overriding authorized goals.
- **Observation and containment:** Log prompts, decisions, tool calls and results where proportionate; detect abnormal action chains; use sandboxes, rate limits, transaction checks and reliable stop or rollback mechanisms.
- **Whole-system assurance:** Test realistic multi-step attacks and accidental failures, including tool compromise, memory poisoning, cascading agents and recovery from partially completed actions.
- **Important limitation:** Agentic AI security is an emerging field with unsettled terminology, protocols and assurance methods. Conventional software, identity and AI risk controls remain necessary, but they may not fully address delegated and adaptive behavior.

### Related terms

[AI security](<https://yellowcube.eu/glossary/ai-security/>) · [Prompt injection](<https://yellowcube.eu/glossary/prompt-injection/>) · [Least privilege](<https://yellowcube.eu/glossary/least-privilege/>) · [AI risk management](<https://yellowcube.eu/glossary/ai-risk-management/>) · [DevSecOps](<https://yellowcube.eu/glossary/devsecops/>)

### Sources

[NIST AI 800-5: Summary Analysis of Responses to the RFI Regarding Security Considerations for AI Agents](https://www.nist.gov/publications/summary-analysis-responses-request-information-regarding-security-considerations-ai) · [NIST: Tool Use in Agent Systems](https://www.nist.gov/news-events/news/2025/08/lessons-learned-consortium-tool-use-agent-systems) · [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.