- Published on
Four Ways to Deploy More Secure AI Agents
- Authors
- Name
- DeepHorus
NVIDIA's AI Red Team has published new security guidance today, revealing that the majority of AI agents deployed across the industry suffer from four critical flaws that could let attackers hijack these digital coworkers. The team's findings, based on six months of adversarial assessments, show that the same failure modes appear repeatedly regardless of the framework or harness used. This announcement serves as a wake-up call for organizations rushing to integrate AI agents into their workflows without fully understanding the risks.
AI agents are being rapidly adopted as "digital coworkers" that handle routine tasks such as reviewing bug reports, implementing fixes, and pushing patches for human review. While these agents promise significant productivity gains, connecting large language models to live tools and corporate data expands the attack surface dramatically. An agentic harness effectively becomes privileged software that can execute actions on behalf of users, yet many deployments leave this software poorly secured.
During the evaluations, the NVIDIA AI Red Team examined a range of agents, from simple interactive coding tools to always-on autonomous digital assistants. The most common failure mode was a lack of access control: agents often held credentials for individual users but were accessible to any authorized user on the internal network. This allowed the team to not only misuse the agent's legitimate capabilities but also harvest those credentials for use in other contexts.
The first recommended control is to implement strong agent access control as a first line of defense. Each agent should be restricted to explicitly authorized users, and its permissions should match the invoking user's privileges following the principle of least privilege. Agents that ignored unauthorized users proved significantly harder to compromise.
The second critical control is limiting code execution capabilities. Many agent harnesses expose a Bash shell or command-execution tool for generality, which is convenient but dangerous. An attacker who can influence model outputâthrough direct input or indirect prompt injectionâcan execute arbitrary commands, leading to data exfiltration or persistent host access.
Common mitigations such as LLM-as-a-judge review agents, allowlists, or trusting the model are not sufficient. Since legitimate workflows require commands like pytest or npm install, these commands are often accepted, and when influenced by attacker-controlled input they become vectors for arbitrary command execution. In some cases, full remote code execution was achieved simply by asking the agent to write and execute a Python script, and even file read/write tools can expose unexpected paths to privilege escalation.
The remaining two controls are equally essential: enforce network egress restrictions to limit data exfiltration, and never expose secrets to agents in plaintext. These measures reduce the blast radius of any compromise and prevent attackers from moving laterally using harvested credentials. Security analysts have welcomed the report, noting that it validates longstanding concerns with concrete evidence and provides actionable countermeasures.
As agentic AI becomes embedded in enterprise operations, this guidance offers a practical baseline for securing these systems. The findings reflect a broader industry shift toward treating AI security as a core requirement rather than an afterthought. The NVIDIA Red Team says it will continue expanding this research, and organizations should audit their current agent deployments to ensure these four controls are in place before they become the next victim of an increasingly sophisticated threat landscape.
