How to stop AI agents contacting malicious URLs and domains
Deny the tool call before an AI agent reaches a malicious URL or domain.
Read guideAI Security
AI agent security guides
Runtime controls, enforcement architectures, and operational guidance for production AI agents.
What these guides cover
AI agent security governs what an agent may do while a production workflow is running. It extends beyond model output filtering because an unsafe outcome can emerge from a valid tool call, a compromised data source, a dangerous action sequence, or authority that is technically valid but inappropriate for the current task. Runtime protection evaluates identity, tool arguments, target resources, prior steps, sensitive data, and accumulated cost at boundaries where the application can still block or restrict an operation. Architecture matters because proxies, AI gateways, in-code checks, and supervisory agents observe different parts of the workflow and fail in different ways.
Risks
- Unauthorized tools and excessive agency
- Direct, indirect, and stored prompt injection
- Unsafe multi-step action sequences
- Sensitive-data leakage and uncontrolled cost
Control priorities
- Deterministic checks immediately before side effects
- Trust labels for user, retrieved, and tool data
- Sequence, budget, and approval policies
- Layered controls with explicit failure behavior
Recommended reading order
Read the runtime security guide first for the risks and control model. Then open the security guide for the framework you ship. Follow with the architecture comparison to decide which checks belong in application code, a proxy, an AI gateway, or a supervisory security agent.
Guides in this collection
What is a rogue MCP server and how do you detect one?
A rogue MCP server is one that your agents can call but that your organization hasn't reviewed or can't trust.
Read guideHow to build an egress allowlist for AI agents
An egress allowlist lists the hosts that an agent may contact, and a policy that the agent can't edit enforces it on every tool call.
Read guideHow to stop a coding agent downloading and running malware
Check each shell command and fetch before a coding agent runs it.
Read guideAI agent threat modeling: A practical guide
Map AI agent trust boundaries, tool permissions, and attack paths.
Read guideLeast privilege for AI agent tool calls
Give each AI agent only the tools, credentials, resources, and execution time its task needs.
Read guideAI agent security testing: Evaluations and release gates
Test whether an AI agent can cause an unauthorized action or disclosure.
Read guideAI agent incident response: A practical playbook
Contain an AI agent incident, preserve tool-call evidence, trace downstream effects, and remove persistence.
Read guideBest AI security solution for healthcare and regulated industries
The best AI security for healthcare inspects PHI and PII in your process so the raw body never leaves to be classified.
Read guideBest AI security solution for fintech
The useful fintech control inspects financial PII in-process, gates the transfer or refund at the tool boundary, and records who did what for the audit.
Read guideWhat's the best AI security provider for enterprises?
The best AI security provider for enterprises depends on the layer: identity, gateway, guardrails, observability, or in-code enforcement.
Read guideEve agent security is three jobs
Eve agent security is three jobs: screen the channel, gate tools and connections, and treat hooks as observe-only.
Read guideHow to secure a Mastra agent
Wiring recipe for Mastra: screen with guardProcessor, wrap createTool, and deny MCP with guardHooks.
Claude Agent SDK security
Wiring recipe for Claude Agent SDK: screen prompts on UserPromptSubmit and deny tools at PreToolUse.
Read guideHuman approval is not a security policy
A human click is a hold, not a remote allow or deny. Eve user-approval, Mastra requireApproval, and Claude canUseTool park a call.
Read guidecanUseTool is not a policy gate
Claude's canUseTool looks like a gate. allowedTools, allow rules, and bypassPermissions / acceptEdits skip it. A Bash or Write in allowedTools never.
Read guideA sandbox is not a tool policy
An agent sandbox isolates untrusted code from your app runtime and your secrets.
Read guideMastra guardrails vs an action gate
Mastra guardrails classify messages. An action gate decides whether this tool runs. A clean prompt-injection score can still open a pull request that pastes.
Read guideThe lethal trifecta for AI agents
Private data, untrusted content, and external communication in one agent let an attacker steal data through content the agent already reads.
Read guideHow do I secure a RAG application?
Similarity retrieval finds on-topic chunks, not safe ones. Screen retrieved content before it enters the model context.
Read guideGuardian Agents, explained
Guardian Agents supervise the agents you run with visibility, assurance, and runtime enforcement.
Read guideApplication-Native vs Remote Security Policies: A Technical Guide
Application-native, code-authored rules give engineers context, review, and tests.
Read guideAI Agent Security Architecture: In-Code vs Proxy vs Gateway vs Security Agent
Compare in-code, proxy, AI gateway, and security-agent controls by visibility, enforcement, and context.
Read guideWhat Is AI Agent Runtime Security?
AI agent runtime security enforces policy while an agent is interpreting input, calling tools, accessing data, and taking actions.
Read guideRuntime Security for LLM Applications: Prompt Injection, Data Exfiltration, Unsafe Actions
Prompt injection, data exfiltration, and unsafe tool use — the three runtime failure modes for LLM apps.
Read guidePrompt injection protection for LangChain, LlamaIndex, and Vercel AI SDK apps
Screen the user message before the model, and screen tool or retriever output before it re-enters context.
Read guidePre-Runtime vs Post-Runtime AI Security Tooling
AI security tools cluster into pre-runtime, runtime, and post-runtime.
Read guideKeeping Security Inspection Local So Data Stays in Your Environment
Most security tooling has to receive your traffic to inspect it.
Read guideHow to Enforce Runtime Controls on AI Agents Accessing Enterprise Systems
When agents touch CRMs, warehouses, and internal APIs, the control has to run at each action.
Read guideHow to Enforce Token and Spend Budgets on AI Agents
A runaway agent is a budget problem before it is a security problem.
Read guideHow to Prevent Data Exfiltration Through AI Agents
Stop agents leaking sensitive data without sending that data to a third-party scanner.
Read guideHow to Stop AI Agents Accessing Data They Should Not
Scoped credentials limit what an agent can reach.
Read guideHow to detect and redact PII in LLM inputs and outputs
Scan the prompt before the provider sees it and the completion before it renders — inbound, outbound, and streaming boundaries.
Read guidePII detection at runtime: gateway, sidecar, or in-process
Runtime PII detection ships in three shapes, and they differ on where the text goes to get classified and which paths they can see.
Read guideHow to stop users sending PII to an LLM
Stop the string reaching the provider, in the handler that makes the provider call.
Read guideHow to prevent PII leakage from AI agents
Between the message and the answer, an agent calls tools, reads results back into context, writes to memory, and hands off to other agents.
Read guideHow to redact sensitive data before sending it to OpenAI or Anthropic
Middleware around OpenAI and Anthropic clients: reversible redaction, streaming chunks, tool arguments, and why provider filters run too late.
Read guideHow to prevent LLMs surfacing confidential employee or customer data
Permission-aware retrieval, tenant boundaries in memory and vector stores, and why fine-tuning has no runtime remedy.
Read guideGDPR and CCPA compliance for LLM applications
Map GDPR and CCPA requirements to controls: minimization, erasure, processor scope, transfers, and audit trails without a second PII store.
Read guideHow to prevent prompt injection in LLM applications
A five-layer defense stack: input screening, instruction and data separation, output validation, privilege limiting, and action gating.
Read guideHow to sanitize user input before passing it to an LLM
Why escaping and regex fail, what structural separation looks like, and the multi-turn payload single-message screening misses.
Read guideHow to prevent a malicious tool call from hijacking your AI agent
A hijack is a well-formed call the model was persuaded to make. Validate arguments, scope tools, and budget actions.
Read guideHow to defend against indirect prompt injection in agentic workflows
Payloads arrive through retrieved content. Screen before context, track provenance, and limit blast radius.
Read guideHow AI security platforms detect prompt injection at runtime
Compare heuristics, classifiers, LLM-as-judge, canary tokens, and behavioral divergence — and where each is enforced.
Read guideThe best tools to detect and block prompt injection in production
Arcjet, Lakera Guard, Azure Prompt Shields, LLM Guard, Rebuff, and Guardrails AI compared for production.
Read guideBest AI security tools for developers
The best tools are the ones you call in the handler before the provider or tool runs — not a dashboard after the refund.
Read guideHow to Add Human Review and Approval Gates to AI Agent Actions
Some agent actions should not execute without a human.
Read guideProducing Compliance Evidence for AI Agent Activity
Auditors do not want your system prompt.
Read guideHow to Secure an MCP Server or AI Agent Tool Calls
MCP tools have no HTTP front door. How to add budgets, injection detection, and data controls where the.
Read guideAnatomy of an Agent Incident: Three Permitted Actions, One Fraud
Correctly scoped tools can still enable fraud — the question is the sequence of calls, not any single tool.
Read guideHow do I add guardrails to an AI agent that calls external APIs?
Enforce on the outbound HTTP call, inside the tool that makes it.
Read guideRuntime security for LLM applications: prompt injection, data leakage, and output validation
A chat route is a user string, then retrieved context, then a completion.
Read guideWhich runtime security tools integrate with LangChain or AutoGPT?
Compare runtime security integration points for LangChain, LangGraph, CrewAI, AutoGPT, and Vercel AI SDK.
Read guideHow do I prevent an AI agent from taking irreversible actions?
Deny transfers, deletes, and prod config by default. Hold a human only where needed, and resume with an idempotency key.
Read guideHow do I implement the OWASP Top 10 for LLM Applications?
The 2026 OWASP GenAI list is the source of names and order.
Read guideAI security checklist for production LLM apps
Apply 20 verifiable AI security controls for production LLM apps.
Read guideWhat is AI security?
AI security protects models, data, applications, and infrastructure.
Read guideWhat changes for application security when your app calls an LLM?
Four surfaces appear when a handler calls a model.
Read guideContent moderation for AI applications
Screen user prompts before AI-generated content, including image prompts.
Read guideHow do I limit what actions an AI agent is allowed to take?
A tool list names functions the model can call. Least privilege also covers objects, arguments, and how often.
Read guideHow do I prevent an AI agent from leaking system prompt content?
Screen the request that asks for it, screen the response that carries it, and keep anything that would hurt you out of the prompt.
Read guideHow do I add guardrails to production AI workflows?
Content guardrails label text. Action gates allow or deny operations. Most libraries only do the first job.
Read guideWhich AI security platforms support MCP server security?
MCP support can mean four different things. Sort vendors by which side of the connection they sit on.
Read guideWhat are the best tools for securing agentic AI workflows?
Pick tools by the boundary they reach. Most stacks leave tool arguments and tool results uncovered.
Read guideWhat's the best AI security platform for data privacy and threat detection?
Detection wants to inspect content; privacy wants it to stay put. Platforms that claim both often send your data away.
Read guideWhat's the best AI security software for SaaS companies?
Multi-tenancy, subprocessor obligations, and per-plan behavior separate a SaaS requirement from a general one.
Read guideWhat's the best AI security tool for startups and small teams?
For a small team, the right tool is one engineer can install in an afternoon — and that still runs in six months.
Read guideWhich AI security company has the best protection for cloud workloads?
Cloud workload protection secures compute. AI application security secures what the model does inside it.
Read guideClaude Agent SDK security guide
Secure Claude Agent SDK applications in TypeScript and Python with prompt screening, tool policies, resource authorization, and isolated sessions.
Read guideClaude Managed Agents security guide
Secure Claude Managed Agents with inbound screening and custom-tool policies.
Read guideCloudflare Think security guide
Secure Cloudflare Think agents with inbound screening and beforeToolCall policy.
Read guideCrewAI security guide
Secure CrewAI with kickoff screening, tool-call hooks, resource authorization, and standalone tool wrappers.
Read guideGenkit security guide
Secure Genkit with inbound screening, authored-tool wrappers, and middleware.
Read guideGoogle ADK security guide
Secure Google ADK in TypeScript and Python with inbound screening and before-tool policies.
Read guideLangChain security guide
Apply runtime security to LangChain JavaScript and Python agents.
Read guideLangGraph security guide
Secure LangGraph JavaScript agents with input screening and ToolNode policies.
Read guideMastra security guide
Secure Mastra messages, authored tools, MCP capabilities, and memory.
Read guideMicrosoft Agent Framework security guide
Secure Microsoft Agent Framework for Go with inbound and tool policies.
Read guideOpenAI Agents security guide
Secure OpenAI Agents SDK applications in JavaScript and Python.
Read guideStrands Agents security guide
Secure Strands Agents in JavaScript and Python with prompt screening and tool policies.
Read guideTanStack AI security guide
Secure TanStack AI with prompt screening and server-side tool policies.
Read guideVercel AI SDK security guide
Secure Vercel AI SDK tools and application actions with policy checks.
Read guideVercel Eve security guide
Secure Vercel Eve channels, tools, and connections.
Read guide