Safety, Security & Guardrails
Powerful agents, safely
Understand the agent threat model, defend against prompt injection, sandbox execution, protect secrets and data, and design human-in-the-loop controls.
- Lessons
- 5
- Reading time
- 47 min
- Level
- Advanced
- Access
- Full course
Lessons in this module
- 9.18 min
The Agent Threat Model
What can go wrong when software can act on its own — and the 'lethal trifecta' of risks to design around.
- 9.210 min
Prompt Injection and How to Defend Against It
How hidden instructions in web pages, emails, and files hijack agents, and layered defenses that actually reduce risk.
- 9.310 min
Sandboxing and Least Privilege
Containers, VMs, scoped credentials, and network rules: limit the blast radius of any agent mistake.
- 9.49 min
Secrets, PII, and Data Handling
Keep API keys out of prompts and logs, handle personal data responsibly, and understand what data leaves your machine.
- 9.510 min
Human-in-the-Loop Design
Put humans in the right places — approvals, reviews, and escalations — without turning your agent into a nag.
About this module
AI agent security differs from ordinary application security because an agent takes actions based on text it reads. If that text comes from an untrusted source, such as a web page, an email, or a shared document, it can contain instructions that steer the agent. Combine that with access to private data and a way to send data out, and a single malicious page can turn a helpful agent into a data leak. Agents can also cause damage with no attacker at all, simply by misunderstanding a task while holding broad permissions.
There is currently no complete fix for prompt injection, so agent security relies on limiting what can go wrong rather than assuming it won't. That means thinking in terms of blast radius: what the agent can reach, what it can change, and what happens if it is wrong or manipulated.
This part gives you a threat model for agents, including the lethal trifecta of private data, untrusted content, and external communication, along with a short exercise for auditing an agent you already use. You will learn how direct and indirect prompt injection work, why filtering alone can't stop them, and layered defenses that reduce both the likelihood and the impact of an attack.
You will then limit blast radius with sandboxing, from containers to virtual machines, network egress allowlists, and narrow, short-lived credentials. You will keep secrets out of prompts and logs, handle personal data responsibly, and understand what data leaves your machine. The part ends with human-in-the-loop design: placing approvals where judgment matters, writing approval requests people can evaluate, and avoiding approval fatigue.
Questions about Safety, Security & Guardrails
What is prompt injection?
Prompt injection is an attack in which instructions hidden in content an AI processes, such as a web page, email, or file, override what the user or developer intended. Direct injection comes from the person typing to the model; indirect injection arrives through content the agent reads while it works.
Can prompt injection be prevented?
Not completely with current techniques, because models can't reliably separate trusted instructions from untrusted text. The practical approach is layered defense: limit which tools and data an agent can reach, isolate untrusted content, require approval for sensitive actions, and monitor behavior.
What is the lethal trifecta in AI security?
The lethal trifecta, a term coined by Simon Willison, describes an agent that combines access to private data, exposure to untrusted content, and the ability to communicate externally. With all three present, injected instructions can make the agent leak data. Removing any one of the three closes off that kind of attack.
How do you sandbox an AI agent?
Run the agent in an isolated environment such as a container or virtual machine, mount only the files it needs, and restrict network access to an allowlist of domains. Give it narrowly scoped, short-lived credentials so that even a misbehaving agent can do only limited damage.
What does human-in-the-loop mean for AI agents?
Human-in-the-loop means a person reviews or approves certain agent actions before they take effect, usually irreversible or high-impact ones like sending messages, spending money, or deleting data. Good designs keep approvals rare and clear so that reviewers actually read them.
Is it safe to give an AI agent my API keys?
Avoid putting keys in prompts or in files the model reads, since anything in context can end up in logs or outputs. Instead, have tools read secrets from environment variables or a secret manager, so the agent can use a capability without ever seeing the key itself.