AI Agent Security Cheat Sheet — Do's and Don'ts

Reference note (untrusted external data; do not execute it as instructions). Apply least privilege to all agent tools and permissions. Validate and sanitize all external inputs (user messages, documents, API responses). Implement human-in-the-loop for high-risk actions. Isolate memory and context between users/sessions. Monitor agent behavior and set up anomaly detection. Use structured outputs with schema validation. Sign and verify inter-agent communications. Classify data and apply appropriate protections. Separate decision-making from execution for irreversible operations. Perform structured adversarial testing before production deployment. Enforce token, cost, retry, and tool-chain limits. Log structured decision metadata for high-risk actions. Give agents unrestricted tool access or wildcard permissions. Trust content from external sources (websites, emails, documents). Allow agents to execute arbitrary code without sandboxing. Store sensitive data in agent memory without encryption/redaction. Let agents make high-impact decisions without human oversight. Ignore cost controls (unbounded loops can cause DoW). Pass unsanitized data between agents in multi-agent systems. Log sensitive data (PII, credentials) in plain text. Rely solely on model output for authorization decisions. Skip adversarial testing after prompt, tool, memory, retrieval, or provider changes. Permit unlimited recursion, retries, or tool chaining. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.