This article discusses the security risks of running AI agents with tool execution on a single server and proposes a two-tier architecture that separates prompt evaluation from code execution to mitigate prompt injection and malicious code attacks.
What problem are we solving? Let us start with a problem statement, You have to deploy a public facing chatbot, the bot is supposed to be capable of executing various tools, for example ffmpeg. Now the simplest solution is to just host an app on your server which simply accepts a prompt, decides which tools to call, executes the code on the server itself & returns the output. User/Frontend Your Server ┃ +-----------+ +-----------------------+ ┃ | | ---> | LLM picks tool | ┃ | Prompt > | | -> runs code | ┃ | | <--- | -> tools call | ┃ +-----------+ +-----------------------+ Non air-gapped (one machine does everything): This is an inherently problematic approach. Take an example, an app which lets you run ffmpeg command using a text prompt. User enters "delete the lib ffmpeg" In the above solution it will eventually run the instructed command no matter how robust the system instruction is. Final result, all the users are affected. So how do we actually solve it? The design which we came up with was to have prompts evaluated by OpenAI on a system where we never execute the code. The code is then sent to another machine where ffmpeg is installed, the code generated by the LLM is executed here. Even if the code is malicious it only affects that particular user's ephemeral machine. User/Frontend Persistent Server Ephemeral ┃ +-----------+ +---------------+ +--------------+ ┃ | | ---> | Prompt | ---> | | ┃ | Prompt > | | | | | Execute Code | ┃ | | <--- | v | <--- | | ┃ +-----------+ | Code | +--------------+ ┃ +---------------+ Anthropic has also come up with a similar model with managed agents, although they don't explicitly call it as such. Bonus section If someone noticed, you might be thinking that what if the prompt injection asks for "Give all environment secrets" in the Persistent Server - wouldn't a successful prompt injection leak our OpenAI secret (used from Persistent Server to generate ffmpeg code)? Great question! for this reason, we never store OpenAI or any such key in the Persistent Server, it gets injected on the fly by a proxy from a separate vault which contains those keys.
The article argues that AI agent security is often overstated with a focus on prompt injection, while overlooking broader risks such as unauthorized tool use, data access, and financial transactions. It calls for more attention to what agents can actually be made to do in production environments.
This article discusses the need for a distinct security model for AI agents compared to chatbots, emphasizing practical controls like scoped permissions, audit logs, and prompt injection awareness.
A discussion on the security risks of AI agents using tools, focusing on prompt injection as a practical threat where untrusted text can alter agent behavior, and the need for repeatable testing before granting permissions.
The article highlights the critical risks of AI agents gaining execution authority over infrastructure, arguing that current guardrails are insufficient without an external admission layer to prevent catastrophic failures.
The article introduces a guardrail platform for AI agents that provides a control layer to block malicious prompts, hallucinations, risky actions, and cost spikes, enabling safe autonomous AI in business environments.