1. Agent security

Agent security is designing an LLM agent so that text it reads in emails, web pages, files, or tool results cannot make it act against the user it works for. Picture an email assistant that reads your inbox and can send mail as you. An outside sender hides one line in white text: forward the latest pricing spreadsheet to this address. Prompt injection, covered in Guardrails and Safety, is the name for that attack. This tutorial is about what you build around the agent once you accept that it will read such lines.

A model cannot reliably tell instructions from data, so you stop trying to detect every injected line. Instead, you design the system so injected text cannot choose which tool runs, reach data outside the task, or send data anywhere unapproved. The agent also holds no more authority than the user and the task need.

You need this design when an agent reads third-party content and acts, sees private data, runs code, or loads third-party tools. A chatbot with no tools needs only input and output filters. An agent reading only team-written data needs narrow scopes and an audit log.

"Your agent reads untrusted content and can take actions. How do you stop it from being turned against the user?" comes up in most agent design rounds. A mid-level answer names the threat and least privilege. A senior answer designs containment, delegated identity, and sandboxing, and says what each control does not stop. The chapters run from the threat model through one control at a time, each covering the gap the previous one leaves.