When thinking about the security of AI agents, one should ignore the agent entirely. Consider only the tools that the agent has access to. Assume that, if the attacker can interact with this agent, they have full and unfettered access to these tools. If those tools are secure, the agent is secure.
This framing doesn't consider context poisoning attacks, on which much has been written already and which merit their own defenses.
This framing doesn't consider context poisoning attacks, on which much has been written already and which merit their own defenses.