Risk 1: Prompt Injection Attacks
The most publicized risk. Attackers can embed malicious commands in the data an agent processes—emails, web pages, or documents. If the agent follows these injected commands, it can be manipulated into exfiltrating data, using tools inappropriately, or violating security policies.
Risk 2: Over-Permissioned Tool Use
Agents need tools to be useful, but broad tool access is a major security gap. If an agent has "write" access to your database or the ability to send emails externally, a single reasoning error or successful injection can have irreversible real-world consequences. A least-privilege architecture is non-negotiable.
Risk 3: Data Exfiltration via Model Providers
Every interaction with an LLM agent involves sending data to a third-party model provider. If your agent is processing sensitive documents or PII, that data is leaving your environment. Organizations must implement data filtering and redaction layers like Shield Control to prevent accidental data leaks.
Risk 4: Unstable Autonomous Behavior
Agents often operate in loops. If a model encounters an unexpected error from a tool, it may enter an "infinite retry" loop or attempt to "fix" the error through a sequence of increasingly risky actions. This behavior can lead to resource exhaustion or data corruption if not governed by runtime constraints.
