AI agent security for businesses: risks, frameworks and controls

This guide is for businesses deploying an agent on their own data: CRM, email, client files, line-of-business software. Each recommendation points to the source that makes it, so you can reuse it in a specification or a risk assessment.

A traditional chatbot produces text that a person reads. An agent chains tool calls: it reads an email, queries a database, updates a record, sends a message. It acts with the permissions it was given, and it decides what to do based on what it reads.

That is where the main risk sits. Anthropic sums it up in its deployment documentation: an agent can be steered by the content it processes, whether files, web pages or user messages. If that content contains instructions, the model may follow them.

NIST calls this scenario agent hijacking: indirect prompt injection hidden in data the agent reads. In a technical blog post dated 17 January 2025, its CAISI centre reported that attack success rose from 11% with baseline attacks to 81% with new attacks designed by its red team. When an attack was repeated 25 times, success reached 80%. Because models are probabilistic, a single test proves nothing.

Model vendors are making progress without removing the problem. In November 2025, Anthropic measured a 1% attack success rate against Claude Opus 4.5 in browser use, for an adaptive attacker with 100 attempts per environment, and said the remaining risk "remains meaningful". For an agent handling thousands of emails, 1% is not enough as the only safeguard.

OWASP Top 10 for Agentic Applications 2026

Published on 9 December 2025 by the OWASP GenAI Security Project, it is now the reference list of risks specific to agents. Most entries are illustrated with a real incident.

The OWASP Top 10 for LLM Applications 2025 still covers the model layer: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, LLM10 Unbounded Consumption. LLM06 is the bridge to the agentic list: too many functions, too many permissions, too much autonomy.

ANSSI: the 2024 guide and the 2026 threat synthesis

France's national cybersecurity agency published its security recommendations for a generative AI system (ANSSI-PA-102, version 1.0, 29 April 2024; English version 27 September 2024). It has 35 recommendations. It does not target agents specifically, but several apply directly:

The same guide also recommends a risk analysis (R2), need-to-know from the design stage (R8), control of privileged access (R10), a fallback mode without AI (R15), and security audits plus business tests before production (R23 and R24).

On 4 February 2026, ANSSI published through CERT-FR a threat synthesis on generative AI and cyberattacks covering 2025. ANSSI states it knows of no cyberattack against French organisations carried out with AI, and of no AI system able to run a full attack on its own. It does stress that poorly secured MCP servers widen the attack surface, and that without strict isolation a compromised AI system can harm the confidentiality of its data and the integrity of connected systems. Citing the UK AI Security Institute, the Alan Turing Institute and Anthropic, it also notes that around 250 malicious documents can be enough to poison a model, whatever its size.

CNIL: the note on agentic AI

On 20 July 2026, CNIL, the French data protection authority, and CIANum published an exploratory note on agentic AI and data protection. It identifies four risks: large and opaque data flows, persistent memory that makes very detailed user profiles possible, unclear responsibility between the parties involved, and a wider cybersecurity risk. Its position: the GDPR and the AI Act already apply, but how they are applied needs to be adapted to these systems.

NIST

Beyond the agent hijacking post above, the NIST AI 600-1 Generative AI Profile (26 July 2024) lists 12 risks. Two bear directly on agents: Information Security, and Human-AI Configuration, which covers automation bias and over-reliance on system outputs.

The four cases share a pattern: the agent had permissions or access broader than the task required, and nothing between the model and the action blocked the misuse. The GitHub MCP problem comes from combining untrusted public content with a token that reaches private repositories. Our guide to MCP for Claude in the enterprise explains how to choose and restrict servers.

The credential proxy deserves a word of explanation. In its documentation, Anthropic recommends keeping credentials outside the agent's boundary and routing its network traffic through a proxy that adds the keys and logs every request. Even if a prompt injection hijacks the agent, it can then neither read the secrets nor send data to an arbitrary server. The same documentation advises against mounting files such as .env, ~/.ssh or ~/.aws in the agent's environment.

These controls apply whatever the underlying technology. For an agent built on Claude, our pages on Claude integration and Claude and CRM show where permissions and approvals sit in a concrete CRM connection.

EU AI Act. For high-risk systems, Article 14 requires effective human oversight. The people in charge must be able to understand the system's capabilities and limits, recognise automation bias, interpret outputs, disregard or override them, and stop the system. Article 15 requires appropriate accuracy and cybersecurity throughout the lifecycle, with measures against data and model poisoning, adversarial examples, confidentiality attacks and model flaws.

Since the Digital Omnibus entered into force on 27 July 2026, these obligations apply from 2 December 2027 to Annex III systems (recruitment and credit, among others) and from 2 August 2028 to systems embedded in regulated products (Annex I). Some articles written in 2025 still give 2 August 2026, a date that no longer holds for high-risk rules. An agent that screens job applications falls under Annex III; a customer support agent usually only carries the transparency obligation. Details are in our guides on the EU AI Act for businesses and the transparency obligation for AI agents.

GDPR. As soon as an agent processes personal data, the GDPR applies, and security is part of it. The CNIL and CIANum note of July 2026 highlights agents' persistent memory and how responsibility is split between vendor, integrator and the business using the agent: settle that in writing before deployment. Sectors handling sensitive data, such as healthcare providers and law firms, are the first concerned.

The 2026 edition also reports that three quarters of organisations are rethinking how they deploy agents because of frontier AI threats, and that using AI and automation in security operations saved almost $2M. The 2025 finding on access controls matches the incidents above: most of the damage comes from permissions that are too broad.

1. A written risk analysis exists, listing the data and tools the agent can reach (ANSSI R2).
2. Every permission maps to a specific task; no admin access and no global token.
3. Credentials stay outside the agent's environment, behind a proxy.
4. Outbound network access is limited to the domains required.
5. Irreversible actions (deletion, payment, external send, permission change) require human approval.
6. External content (emails, web pages, attachments) cannot trigger an action on its own.
7. MCP servers and third-party tools are identified, and either under your control or from trusted providers.
8. Every request, decision and tool call is logged, and someone knows where to read those logs.
9. Prompt injection scenarios have been replayed several times each, on top of business tests.
10. The process works in fallback mode if the agent is switched off, and the shutdown procedure is written down.
11. A date for the permission review is set.
12. The AI Act classification is done (transparency or high-risk) and GDPR responsibilities are written down.

If you are having a custom AI agent built, ask the provider how each of these twelve points is handled, and put the answers in the contract.