Lesson #9
Securing AI Agents: Cybersecurity Essentials
- 1
Indirect Prompt Injection
Category: Agents“IN-di-rekt PROMPT in-JEK-shun”
An attack where hidden instructions are planted in a document, email, or web page so an AI reading it obeys the attacker instead of you.
Think of it like… Slipping a fake work order into a stack of paperwork and hoping the crew just runs it.
Construction: A supplier PDF hides a line telling the estimating agent to approve any price change under $10,000.
Business: A support email contains hidden text instructing the AI assistant to forward the customer list.
Why this matters: Any agent that reads outside content can be given orders by that content, so untrusted text must never be treated as instructions.
Open full entry → - 2
Jailbreak
Category: Agents“JAYL-brayk”
A trick that talks an AI out of its own safety rules, usually by roleplay, pressure, or a clever rewording of the request.
Think of it like… Talking a new security guard into letting you in because you 'work here' and 'left your badge at home'.
Construction: A user convinces the site assistant to skip the safety checklist by framing it as a hypothetical training exercise.
Business: A customer-facing bot is coaxed into revealing internal discount policy it was told never to share.
Why this matters: Safety rules written only in the prompt can be argued away, so real limits must be enforced in code, not in wording.
Open full entry → - 3
Least Privilege
Category: Infrastructure“LEEST PRIV-uh-lij”
Giving a person or an AI exactly the access needed for the job and nothing more.
Think of it like… A subcontractor key that opens the one unit they're working in, not the whole building.
Construction: The scheduling agent can read job dates and write crew assignments, but cannot touch payroll.
Business: A reporting AI gets read-only database access, so even a compromised key can't delete a single record.
Why this matters: It's the cheapest security control there is: it shrinks the damage of every mistake and every breach.
Open full entry → - 4
Zero Trust
Category: Infrastructure“ZEE-roh TRUST”
A security approach where every request is verified every time, even from inside your own network or from your own AI.
Think of it like… Badging in at every door, not just the front gate.
Construction: The field agent re-authenticates before writing to job costs, even though it is already running on company hardware.
Business: An internal service checks the caller's identity on every request instead of assuming internal traffic is safe.
Why this matters: Once agents run inside your systems, 'inside means safe' stops being true — every action needs its own check.
Open full entry → - 5
Sandboxing
Category: Infrastructure“SAND-boks-ing”
Running code or an AI in a walled-off space where it can work freely but cannot reach anything important if it goes wrong.
Think of it like… A welding booth. Sparks fly all they want inside, and the rest of the shop never catches fire.
Construction: An agent tests a schedule change in a copy of the project plan before anything reaches the real crew calendar.
Business: AI-written code runs in an isolated container with no network access until a person reviews it.
Why this matters: Sandboxes turn a potential disaster into a contained mess, which is what makes it safe to let agents act at all.
Open full entry → - 6
Red Teaming
Category: Agents“RED TEEM-ing”
Deliberately attacking your own AI system to find weaknesses before an outsider does.
Think of it like… Hiring someone to try to break into your building so you learn which door is weak.
Construction: A tester feeds the estimating agent doctored plans to see whether it approves an impossible bid.
Business: Before launch, a team spends a week trying to make the support bot leak data or promise refunds.
Why this matters: You will find out where your AI fails either way — red teaming just makes sure it's you who finds out first.
Open full entry → - 7
Data Exfiltration
Category: Data“DAY-ta eks-fil-TRAY-shun”
Information being quietly moved out of your systems to somewhere it doesn't belong.
Think of it like… Materials walking off the job site one truckload at a time, so nobody notices until inventory day.
Construction: An agent with web access pastes customer addresses into an outside service to 'look up directions'.
Business: A compromised assistant summarizes the client list into an email sent to an attacker-controlled address.
Why this matters: Agents that can both read your data and reach the internet can leak it in one step, so those two powers need separating.
Open full entry → - 8
PII Redaction
Category: Data“P-I-I ree-DAK-shun”
Automatically stripping out personal details — names, addresses, card numbers — before text is stored or sent to an AI.
Think of it like… Blacking out the address on a document before you post it on the bulletin board.
Construction: Homeowner phone numbers are masked before job notes are sent to the model for summarizing.
Business: Support transcripts are scrubbed of customer names before being used to train or evaluate a bot.
Why this matters: You cannot leak what you never sent, so redaction is the simplest way to shrink privacy risk.
Open full entry → - 9
Audit Log
Category: Infrastructure“AW-dit LOG”
A tamper-resistant record of who did what, when, and to which record — including actions taken by an AI.
Think of it like… The site sign-in sheet. Anyone can check who was on the property and when.
Construction: Every price change the estimating agent makes is logged with the old value, new value, and timestamp.
Business: When a customer disputes a refund, the log shows whether a person or an agent approved it and on what basis.
Why this matters: Without an audit log you can't prove what an AI did, which makes both compliance and debugging impossible.
Open full entry → - 10
Supply Chain Attack
Category: Infrastructure“su-PLY CHAYN uh-TAK”
Getting into a company by compromising something it depends on — a vendor, a plugin, or a piece of borrowed code.
Think of it like… Tampering with the lumber delivery instead of breaking into the job site.
Construction: A malicious plugin added to the estimating tool skims customer data from every bid.
Business: An AI agent installs a package that looks legitimate but sends every API key it finds to an attacker.
Why this matters: Modern software is mostly other people's code, so your security is only as good as what you install.
Open full entry →