Skip to content
REDMAW

AI Security

An AI agent with tools is an identity with reach

Agentic systems inherit access. Testing the model in isolation misses the part that matters.

RedMaw5 min read

Evaluating a model's refusals is a content problem. Evaluating an agent is an access problem. Once a model can call tools, it holds effective permissions, often granted broadly during a prototype and never narrowed.

Where injection becomes exploitation

Indirect prompt injection is only interesting because of what follows it. Untrusted content enters a context window, influences the agent's next action, and that action runs against a real system with real credentials.

  1. Malicious Input
  2. AI Agent
  3. Tool
  4. Production System

Each hop validated by successful exploitation

Practical testing scope

  • Which tools the agent can call, and with whose privileges
  • Which content sources can reach the context window
  • What the agent can read, write or trigger without human approval
  • Whether behavior regresses when a model, prompt or tool changes

Tags

  • ai security
  • agents
  • prompt injection
  • tool abuse

Keep going

Related

Further reading

Attack LibraryAI Systems

Indirect Prompt Injection

The attacker never talks to the model. The content the model reads does it for them.

· 7 min read
Attack LibraryAI Systems

RAG / Context Poisoning

If you can influence what gets retrieved, you can influence what the system does with it.

· 6 min read

Stop assuming you are secure. Prove it.

Continuously test what an attacker can actually reach across your applications, SaaS identities, internal infrastructure and AI systems.