The AI Agent Security Handbook

Threat Models, Sandboxes and Least Privilege

Introduction

1. What This Book Covers
2. Who Should Read This Book
3. How to Use This Book
4. What This Book Does Not Do
5. A Note on Sources
6. On Style and Conventions

Chapter 1: What Are AI Agents?

1. Defining AI Agents
2. Agents Versus Chatbots Versus APIs
3. Core Capabilities: Perception, Reasoning, Action
4. Real-World Agent Use Cases
5. Why Traditional Security Models Fail

Chapter 2: How Agents Work: Architectures and Mechanisms

1. Large Language Models as Control Planes
2. Function Calling and Tool Use
3. Autonomous Execution Loops
4. Memory: Short-Term, Long-Term and Working Memory
5. Retrieval-Augmented Generation (RAG)
6. Multi-Agent Systems and Coordination Patterns
7. Agent Frameworks and Orchestration Platforms

Chapter 3: The Emerging Threat Landscape

1. From Lab Research to Production Incidents
2. Taxonomy of AI Agent Attacks
3. High-Profile Cases and Lessons Learned
4. The Scale of the Problem: Agents at Scale
5. Regulatory and Compliance Pressure

Chapter 4: Trust, Boundaries and Assumptions

1. Security Assumptions in AI Systems
2. Defining Trust Boundaries for Agents
3. Assets Worth Protecting
4. Adversary Models and Motives
5. What Breaks: The Unique Failure Modes of Agents

Chapter 5: Attack Trees, Abuse Cases and Risk Assessment

1. Adapted STRIDE for AI Agents
2. Building Attack Trees for Agents
3. Abuse Case Diagrams
4. Quantifying Risk: Likelihood and Impact
5. Threat Modeling the Lifecycle: Design, Deploy, Operate

Chapter 6: Prompt Injection and Jailbreak Attacks

1. Direct Prompt Injection: Mechanisms and Variants
2. Indirect (Data) Injection: The Real Production Risk
3. Jailbreaks: Bypassing Alignment
4. Multi-Turn and Conversational Exploits
5. Defense Strategies: Separation, Validation and Monitoring
6. When Defense Is Impossible: Designing Around the Risk

Chapter 7: Tool Misuse and API Exploitation

1. How Tools Become Attack Vectors
2. Argument Injection and Malformed Inputs
3. Off-Spec and Off-Path Tool Use
4. Chained Tool Abuse: From Read to Root
5. The Confused Deputy Problem in Agents
6. Mitigating Tool-Based Attacks

Chapter 8: Data Exfiltration and Sensitive Information Leakage

1. Paths Data Can Escape
2. Exfiltration via Tool Outputs
3. Leakage Through Model Providers
4. Embeddings, RAG and Knowledge Store Risks
5. Log Poisoning and Side-Channels
6. Detection and Prevention

Chapter 9: Supply Chain, Model and Prompt Risks

1. Model Supply Chain Risks
2. Prompt Template Compromise
3. Third-Party Tools and Plugins
4. Framework and Library Vulnerabilities
5. Pretrained Knowledge Poisoning

Chapter 10: Multi-Agent Attack Surfaces

1. Trust and Trust Delegation in Multi-Agent Systems
2. Cross-Agent Prompt Injection
3. Shared Resource Contention and Abuse
4. Coordination Failures as Security Incidents
5. Poisoned Agent-to-Agent Communication
6. Securing Agent Teams

Chapter 11: Operating System Security for Agents

1. The Linux Security Model: Capabilities and Privileges
2. Seccomp: Restricting System Calls
3. User Namespaces and ID Mapping
4. Control Groups: Resource Limits for Untrusted Workloads
5. Read-Only Filesystems and Mount Namespaces
6. Composing Primitives for Strong Isolation

Chapter 12: Containers, Namespaces and Ephemeral Execution

1. Container Isolation: What It Is and What It Is Not
2. Hardening Container Runtimes
3. Network Policies and Pod Security
4. Immutable and Ephemeral Agent Execution
5. Breaking Out: Container Escape Scenarios
6. When Containers Are Enough (and When They Are Not)

Chapter 13: Virtual Machines and MicroVMs

1. Hardware Virtualization and Full VM Isolation
2. MicroVMs: Firecracker and Alternatives
3. gVisor: User-Space Kernel Isolation
4. Kata Containers and Confidential Computing
5. Performance, Latency and Cost Trade-offs

Chapter 14: WebAssembly and Fine-Grained Sandboxing

1. WebAssembly as an Isolation Primitive
2. Memory Safety and Capability-Based Access
3. Wasmtime, Wasmer and Agent Runtimes
4. Isolating Individual Tools in Wasm
5. Limits of WebAssembly for Agents
6. Hybrid Architectures: Wasm Plus Other Controls

Chapter 15: Network Segmentation, Browser Isolation and Peripheral Controls

1. Network Segmentation for Agent Environments
2. Egress Filtering and DNS Control
3. Browser Sandboxing for Web Agents
4. Controlling External Service Access
5. Per-Request Network Policies
6. Air-Gapped and Restricted Network Agents

Chapter 16: Capability-Based Security for Agents

1. Capabilities Versus Traditional RBAC
2. Designing Capabilities for Agent Tools
3. Capability Scoping and Delegation
4. Revocation and Expiration
5. Building a Capability-Based Agent Runtime

Chapter 17: Identity, Credentials and Just-in-Time Access

1. Identity for Agents: Who Are They?
2. Short-Lived Credentials and Tokens
3. Workload Identity: AWS, GCP, Azure, Kubernetes
4. OAuth 2.0 and OIDC for Agent Access
5. Just-in-Time Authorization Patterns
6. Credential Rotation and Revocation

Chapter 18: Policy Enforcement and Authorization

1. Declarative Policy for Agents
2. OPA and Rego for Agent Authorization
3. Tool-Level Access Policies
4. Workflow and Multi-Step Policies
5. Policy Testing and Validation
6. Integrating Policy Engines into Agent Runtimes

Chapter 19: Secrets Management for Agents

1. The Secret Management Problem for Agents
2. HashiCorp Vault and Alternatives
3. Per-Session and Per-Tool Secrets
4. Secrets in Prompts: What Not to Do
5. Ephemeral Credential Provisioning
6. Auditing Secret Access

Chapter 20: Human Approval Gates and Secure Human-in-the-Loop

1. When Humans Must Be in the Loop
2. Designing Approval Flows for Agents
3. Risk-Based Approval Gating
4. Secure Notification and Authentication
5. Avoiding Approval Fatigue and Automation Bias
6. Auditing Human Decisions

Chapter 21: Building a Secure Agent Runtime

1. The Security Model of an Agent Runtime
2. Process Model: One Agent Per Process?
3. Tool Execution Architecture
4. Fail-Closed and Secure Defaults
5. Input and Output Validation
6. Reference Architectures for Secure Runtimes

Chapter 22: Policy Engines, Tool Gateways and Permission Brokers

1. The Tool Gateway Pattern
2. Permission Brokers and Dynamic Authorization
3. Policy Enforcement Points
4. Rate Limiting and Quota Enforcement
5. Observability in Security Components

Chapter 23: Monitoring, Logging and Audit Trails

1. What to Log: The Audit Trail for Agents
2. Structured Logging and Schema Design
3. Tamper-Resistant Audit Storage
4. Real-Time Anomaly Detection
5. Alerting on Suspicious Agent Behavior

Chapter 24: Secure Memory, RAG and Knowledge Stores

1. Memory as an Attack Surface
2. Securing Vector Databases
3. Document Store Integrity
4. Knowledge Base Poisoning and Defense

Chapter 25: Defense-in-Depth Architecture

1. The Layered Defense Model for Agents
2. Designing for Failure Modes

Chapter 26: Reference Implementation: A Secure AI Agent System

1. System Overview and Design Goals
2. Project Structure
3. The Agent Core
4. Security Middleware
5. The Tool Gateway
6. The Policy Engine
7. The Sandbox Layer
8. Running the Full System
9. Adversarial Test Suite

Chapter 27: Multi-Tenant and Cloud Deployments

1. Kubernetes Security for Agent Workloads
2. Multi-Tenant Isolation
3. Cloud Provider Patterns

Chapter 28: Security Testing and Red Teaming

1. Security Testing Pyramid
2. Automated Prompt Injection Testing
3. Red Team Playbooks

Chapter 29: Incident Response for AI Agents

1. Detection Patterns
2. Containment Strategies
3. Recovery

Chapter 30: Governance, Compliance and Audit Readiness

1. Regulatory Landscape
2. Control Mapping
3. Building a Governance Program

Chapter 31: Production Readiness Checklist and Security Review

1. Pre-Deployment Checklist
2. Runtime Checklist
3. Emergency Response Checklist

Chapter 32: The Future of AI Agent Security

1. Emerging Attack Surfaces
2. Next-Generation Isolation
3. The Arms Race
4. Final Recommendations

References