AI Agents
The challenge
Autonomous AI agents are among the highest-risk LLM applications because they combine natural language understanding with the ability to take real-world actions. When an agent has access to tools, such as sending emails, querying databases, executing code, or interacting with APIs, a successful prompt injection attack is no longer limited to information disclosure. It can result in the agent performing unauthorised actions with real consequences.
The attack surface for AI agents is substantially larger than for simple chatbots or RAG systems. Every tool the agent can access becomes a potential target for manipulation. An attacker who compromises the agent's reasoning can direct it to read confidential files, send emails to arbitrary recipients, modify database records, or execute malicious code.
Permission escalation is a critical concern. Agents are often granted broad tool access to be effective, but this creates opportunities for attackers to chain multiple tool calls together in ways that developers did not anticipate. An agent with calendar access, email access, and document access might be manipulated into reading a confidential document, summarising it, and emailing the summary to an external address, all in a single attack sequence.
Multi-turn attacks are particularly effective against agents because the agent's tool-use capabilities provide feedback loops. An attacker can observe the agent's actions (through its conversational responses) and adjust their strategy in real time, probing different tools until they find one that can be exploited.
What Secuvon tests
Tool Use Security
Attempts to misuse the tools an agent may call.
61 tests in the corpus
Permission & Agency
Pressure to act beyond what the agent is allowed to do.
64 tests in the corpus
Agent Memory Poisoning
Planted memories that change later behaviour.
61 tests in the corpus
Agentic Reasoning
Attacks on how an agent plans its next step.
80 tests in the corpus
Multi-Agent Security
Manipulation that passes between cooperating agents.
81 tests in the corpus
MCP Security
Attacks through Model Context Protocol tools and servers.
50 tests in the corpus
An assessment sends its tests to the agent you register, through a hosted provider or your own HTTP endpoint. Choose a versioned profile, from Smoke 25 through the full 4,075-test corpus, within your contract capacity. A profile draws a fixed set of tests from these modules, so a module's whole count runs only with the full corpus. Every answer is graded by the published rule for its test, and the report keeps the transcript as evidence.
Illustrative scenarios
Hypothetical examples of the attack classes above, written for this page. They are not incidents Secuvon investigated or customer cases.
Coding agent executes unauthorised system commands
An attacker interacts with an AI coding assistant that has access to a sandboxed code execution environment. Through a series of conversational turns framed as a debugging exercise, the attacker manipulates the agent into generating and executing code that escapes the sandbox, reads environment variables containing API keys, and exfiltrates them through a DNS-based side channel.
Email agent forwards confidential data externally
A productivity agent with access to email, calendar, and documents is targeted through a multi-turn manipulation. The attacker first asks the agent to summarise a recent meeting. Then, framing it as a follow-up task, they instruct the agent to email the summary to an external address, exfiltrating confidential business information through the agent's legitimate email-sending capability.
Customer service agent escalates its own permissions
An AI agent with tiered access to customer data is manipulated through a series of support requests that gradually convince it to access higher-tier data. The agent, following its helpful training, treats the escalating requests as a natural progression of the support interaction rather than recognising the permission boundary violation.