AI agents are moving beyond generating text. They can retrieve sensitive information, call APIs, execute tools and take actions on behalf of users. That changes the security model.

A prompt is no longer just a request for an answer. It can become an indirect path to a tool, a data source or an external system.

This session explores the security risks that appear when LLMs become agentic, focusing on prompt injection, indirect prompt injection, excessive tool permissions, untrusted context and unsafe tool use. Rather than treating these as isolated LLM problems, we will examine how they connect across the full agent architecture.

Through a controlled demonstration, we will start with an apparently harmless AI agent and progressively introduce malicious or untrusted inputs to show how an attacker can influence the agent's decisions. We will then apply practical defenses such as least-privilege tool access, input and output validation, trust boundaries, permission controls and human approval for high-impact actions.

The goal is not to show that AI agents are inherently unsafe. It is to understand the new attack surface they create and develop a security mindset for building agents that can act without giving them more authority than they should have.