Agentic systems add a threat surface that conventional application security does not cover — because the component making decisions can be talked into things by the data it reads.
All Trust & Security →
Traditional application security assumes code does what it was written to do. An LLM does what its context suggests, and its context includes content from documents, emails, tickets and web pages that an attacker may control. That is the difference, and every control below follows from it.
The governing principle: never let the model's judgement be the only thing standing between an attacker and a capability. If an agent can delete records, the protection cannot be that it has been instructed not to. It must be that it lacks the permission, or that deletion requires a confirmation the model cannot forge.
When reviewing an existing AI system, these are the findings we would expect to see most often, in our experience:
A service account with far more access than any user. The agent connects with admin credentials because that was simplest during development, and per-user authorisation was never added.
Retrieved content treated as trusted. A document or ticket body concatenated into the prompt with no structural separation, so anyone who can create a document can issue instructions.
Tools with destructive capability and no confirmation. Usually added for a legitimate reason during a sprint and never revisited.
No logging of tool calls. Outputs are logged, the actions taken are not — so the interesting half of an incident is invisible.
Unbounded agent loops. No iteration cap, so a confused agent can burn a very large amount of money before anyone notices, which is a denial-of-wallet vector as much as a reliability problem.
No, and be sceptical of anyone claiming otherwise. It can be made largely inconsequential, which is the achievable goal: if a successful injection cannot reach a capability that matters, it is a curiosity rather than an incident. That is why the defence is authorisation rather than detection — you are designing so that being fooled does not cost anything.
Sometimes, with scoping. An agent that updates a ticket status is low risk; one that can delete records or move money should not have that capability at all, or should produce a proposed action that a human commits. The design question is what the worst outcome is if the model is fully compromised — then ensure that outcome is acceptable.
Minimise first: send only the fields the task needs, which is usually far fewer than the convenient full record. Redact where the task permits it. Where PII must be processed, use zero-retention endpoints or self-hosted models, and make sure logging does not create a second copy in a system with weaker controls — which is a surprisingly common accidental data flow.
Yes, as a standalone engagement. Typically one to two weeks producing a written findings document with severity ratings and concrete remediations, focused on the agentic layer specifically — the areas a conventional application penetration test is not scoped to cover.
A focused security review of the agentic layer is scoped at one to two weeks.
30-minute technical call · no deck
What we built, what stage it is at, and a link to the live thing wherever there is one.
yourOS is an operating system with an AI at its heart. You talk to it like a person, out loud or typed. It makes your calls, plans your days and works on your projects with a crew of agents, on your own private server. Our own product, built from the first commit; the waitlist is open.
Website, backend and app assets for Sonora, a free AI sound-therapy app on iOS and Android published by Cognitive AI.
Brand, website, prototype, apps on five platforms, the AI backend and the algorithm-intelligence pipeline for Podswap, a social growth engine that runs without a human in the loop.
In closed beta: Roxy, a private AI assistant with permanent memory running on infrastructure the user owns. Brand, site, product, backend and conversational design.
Live at coherence.com: brand identity generated with AI agents we directed, the motion system and website for the group behind Sonora, AboutAI, WakeUp and MudShadows. Agent work remains in build.
Live at domainbooth.com for DomainBooth, a premium domain brokerage: a new animated mark, every page redesigned and rebuilt with designed mobile layouts, and a custom CMS for its sales record, featured names, press and enquiries.
Apps, platforms and campaigns for these teams, long before the AI work. Every one is written up on the work page — what we did, and where our part ended.
