SimpleA plain explanation, one diagram and an analogy, with where the analogy breaks.
Guess first: when an agent is fooled, what limits the harm it can do? Show the answerWhat it is allowed to do. A fooled agent can only use the powers it was given.
An AI agent acts for you: it runs code, edits files, sends messages. Whatever it can do, a tricked or broken agent can do too.
So give it only what the job needs. An agent fixing a typo does not need your email or the power to delete servers. This is least privilege.
Run it in a sandbox: a closed room with its own copy of the files and no open door to the internet unless the task needs one.
For risky steps, such as deleting, paying or sending data out, have it stop and ask a person. Keep a log so you can see what it did.
These limits work even when the agent is fooled, because they do not depend on the agent noticing the attack.
Layers of limits around an agent
Task: what is it for?
Least tools: only what it needs
Sandbox: files and network fenced
Approval: a person for risky steps
Log: every action
Like: A temp worker given one office key, a visitor badge and a rule to ask before spending money. Where it breaks: A temp works at human speed. An agent can try thousands of actions a minute, so limits must be enforced by the system, not trusted to its judgement.
How it worksAn interactive demo first, then the mechanism: light maths, pseudo-code and trade-offs.
Excessive agency is OWASP's name for the root problem: excessive functionality (tools a task doesn't need), excessive permissions (tools that can do more than needed) and excessive autonomy (high-impact actions without checks).
Scoping maps each task to a minimal tool set and credential scopes: read-only tokens, single-repository access, short expiry. Credentials live outside the agent's environment where possible, so injected instructions cannot read them.
Sandboxing runs the agent's code and tools in a container or virtual machine with a restricted filesystem and an egress allow-list. The sandbox boundary, not the model, decides what can leave.
Human approval gates irreversible or outbound actions, showing the exact command or message. Audit logs record every tool call with its inputs, for detection and for investigation afterwards.
Trade-offs
Tight scopes mean more prompts and setup; loose scopes are convenient until something goes wrong.
Approval fatigue is real: if every step needs a click, people stop reading.
Sandboxes can be escaped by kernel or container bugs; keep them patched and layered.
ResearchWhere the simple picture breaks, open problems and primary sources.
Real cases. An overscoped build token let an attacker commit a destructive prompt into a released AI coding extension; the vendor says it was malformed and did not run (AWS-2025-015); prompt injection made a CI coding agent read its own environment and leak an API key (Microsoft, 2026).
Design patterns. Plan-then-execute, action selectors and dual-model isolation give agents provable resistance to injected control flow at some cost in flexibility (Beurer-Kellner et al., 2025; CaMeL).
Threat models. OWASP's Top 10 for Agentic Applications (December 2025) ranks the main risks of agents that plan, use tools and keep memory, building on its earlier agentic threat list, which covers privilege compromise, tool misuse and memory poisoning (OWASP, 2025; OWASP, Feb 2025).
Open questions. How to infer the minimal permission set for open-ended tasks automatically, and how to design approvals people don't rubber-stamp.
Security on this concept: 2 threats Pending expert review
An agent in a build pipeline leaks its keys Pending expert review
Exposed
API keys and tokens in the agent's environment
Pull requests, issues and comments the agent reads
Attacks
Prompt injection in an issue or comment that makes the agent read and post its secrets
The agent loop Plan, act with a tool, observe the result, and repeat until the goal is met.
Agent harnesses The program wrapped around a model that turns it into an agent: it runs tools, asks permission, manages context and keeps memory.
Coding agents Agents that work inside a code repository: read files, make edits, run commands and tests, and iterate until the checks pass.
Computer & browser use Agents that operate a screen like a person: look at a screenshot, then click, type and scroll.
Multi-agent systems Several agents with different roles or contexts work together on one task.
Responding to a compromised agent What to do when an AI agent has been hijacked or misbehaves: stop it, cut its access, find out what it touched, fix the cause and recover.