+49 155 609 62044contact@vamisec.comCyber incident?24/7csirt@vamisec.com
Book an Appointment

Research area · Securing AI agents Agentic

Agentic AI Security: When AI agents act, every action needs control

AI agents act: they call tools via MCP, load Agent Skills, use delegated permissions, and write to their memory. Vami Research examines how this shifts the attack surface — from prompt injection and Agent Goal Hijack to data leakage to AI assistants — and how agents can be controlled, assessed, secured, and monitored at runtime.

  • Prompt injection
  • Agent Goal Hijack
  • MCP & Agent Skills
  • Agent identities
  • Agent Control Standard
  • ISO/IEC 27090
  • Detection & Response
Schedule an initial consultation (opens external website)View publications
Deep Dives
16
Whitepapers
4
Solutions
2
Context

From assistant to actor: where control has to start

With AI agents, the attack surface shifts from the model to the action. Agents plan across multiple steps, choose tools themselves, and access repositories, mailboxes, and databases via the Model Context Protocol, often with delegated user permissions. A manipulated agent does not break in; it uses its legitimate permissions. Instructions in web pages, documents, tool descriptions, or skill files thus become a control channel that EDR and SIEM alone do not see.

The standards landscape grew denser in 2025 and 2026, but it is young. Since December 2025, the OWASP Top 10 for Agentic Applications has named ten risks, from Agent Goal Hijack to Rogue Agents; the OWASP MCP Top 10 is available as v0.1 (Beta); and the NSA and OWASP published hardening guidance for MCP in 2026. ISO/IEC 27090 was published on October 14, 2026, but addresses agents only in passing. The OWASP Agent Control Standard describes runtime control in version 0.1.0; conformance there is self-declaration without a test suite or assessment body.

Vami Research turns these sources into testing and operational practice: MCP assessments, skill reviews, detection & response for agents, and ISO/IEC 27090 in the ISMS. Two solutions complement this. VamiGuard, a free browser extension for Chrome and Edge, checks prompts locally and detects, by pattern and without a guarantee of completeness, data such as email addresses, API keys, and tokens; it replaces them only after confirmation. VamiRedteam tests AI applications following the OWASP AI Testing Guide, for example for prompt injection and system prompt leakage.

Research questions

Open questions in practice

  1. 01

    How can an AI agent's action be checked before it is executed?

    Our approach

    Not via the system prompt, but at control points outside the model. For this, the OWASP Agent Control Standard (ACS) describes a Guardian that, based on policy, allows, blocks, modifies, submits for approval, or defers actions at hooks. Because a Guardian that does not respond results in “proceed” by default, we define the failure posture first. ACS is an architectural goal, not a certificate.

  2. 02

    What risks do MCP servers and Agent Skills from third-party sources bring?

    Our approach

    Both bring third-party instructions into the agent's context: tool descriptions that the model reads but humans never get to see, and skills that inherit the permissions of the executing agent. We treat them like privileged software: inventory, provenance checks, review of all files, signed manifests with version pinning, sandboxing, and a formal approval process before production use.

  3. 03

    How do AI agents get a verifiable identity with minimal permissions?

    Our approach

    Agents are non-human identities that user- and perimeter-centric IAM models do not capture. Our approach is Zero Trust per action: a cryptographically anchored identifier per agent, short-lived, tightly scoped tokens instead of static API keys, just-in-time permissions, and Least Agency. For MCP, we check the OAuth 2.1 chain for audience binding and the absence of token passthrough.

  4. 04

    How does a SOC detect that an agent is being misused within its legitimate permissions?

    Our approach

    With telemetry where agents make decisions: prompts, tool calls, execution paths, and memory operations in a unified event schema. On this basis, our Agentic AI Detection & Response service builds detections along the OWASP Top 10 for Agentic Applications, anchors write-protected audit trails outside the agent, and rehearses graduated responses up to a kill switch at the infrastructure level.

Findings

Key takeaways

  1. 01

    ISO/IEC 27090 covers generative AI, agents only in passing

    The standard describes prompt injection, including its indirect variant, and outputs that attack downstream systems. On agents, it provides only one principle: verify and authorize every action individually. Tool poisoning, memory poisoning, delegation, and MCP are missing as types in their own right; we recommend supplementing this layer with OWASP, MITRE ATLAS, and NIST, with the additions labeled as such.

    Source: ISO/IEC 27090

  2. 02

    System prompts do not control agent actions

    Because agents execute commands and modify their memory, control has to sit outside the model's output path. For this, the OWASP Agent Control Standard defines hooks, dispositions, and an audit trail. Version 0.1.0 is early: if the Guardian stays silent, “proceed” applies by default, i.e., fail-open; conformance is self-declaration without a test suite or assessment body.

    Source: Agent Control Standard (ACS)

  3. 03

    MCP authorization is specified, but practice lags behind

    Since June 2025, a protected MCP server has been an OAuth 2.1 resource server according to the specification, with mandatory metadata discovery, PKCE, and audience binding; token passthrough is prohibited. An audit of 5,200 MCP servers in October 2025 found only 8.5 percent OAuth usage. This raises two audit questions: Is there token passthrough, and how long does an agent token live?

    Source: MCP & OAuth 2.1

  4. 04

    Classic monitoring does not see what triggers agentic actions

    EDR monitors processes, file access, and network traffic; the decisive telemetry of agents lies in prompts, decision paths, tool calls, and memory operations. Agents also act with valid credentials over legitimate API and MCP connections. Detection therefore needs dedicated sensors and audit trails that the agent cannot overwrite.

    Source: ADR — Agentic AI Detection & Response

Methodology

How we work

We read formal standards, industry standards, and specifications in the original, label what is binding and what we recommend, and translate the result into inventories, test catalogs, policies, and telemetry.

Agent inventory

Capture models, MCP servers, tools, skills, knowledge sources, and memory per agent — modeled on the AgBOM of the Agent Control Standard.

Threat mapping

Map risks to the OWASP Top 10 for Agentic Applications, the OWASP MCP Top 10 (v0.1, Beta), and the nine types of compromise in ISO/IEC 27090.

MCP and skill review

Check tool descriptions against actual runtime behavior and minimize token scopes; read skills in full and run bundled scripts in an isolated sandbox.

Policy and failure posture

Guardian policies as code, approvals for consequential actions, and a deliberately chosen failure posture instead of the default.

Agent telemetry and ADR

Capture prompts, tool calls, execution paths, and memory operations in one event schema and integrate detections into the SIEM and SOC.

GenAI DLP at the source

Check prompts locally before sending, for example with VamiGuard, and combine this with classic DLP such as Microsoft Purview: the two approaches complement each other.

How to get started

  1. 1Understand and inventoryCapture agents, tools, identities, and data flows; mark trust boundaries and the combination of data access, external communication, and third-party content.
  2. 2Assess and testClassify risks against OWASP catalogs and ISO/IEC 27090, conduct MCP and skill assessments, and test AI applications specifically for prompt injection.
  3. 3Control and monitorIntroduce runtime controls, Zero Trust identities, and agent telemetry, and track remaining risks in the ISMS risk register.
Publications

Deep dives, whitepapers, and analyses

Deep Dives 16

ISO/IEC 27090ISO/IEC 27090:2026 is the guidance standard from ISO/IEC JTC 1/SC 27 on security threats and compromises to AI systems, published on 14/10/2026 as a first edition of 56 pages. The standard describes nine AI-specific attack types with their consequences, detection and mitigation across the entire AI life cycle and is not certifiable. This page puts the standard in context, shows threats by life-cycle phase, maps them to ISO/IEC 27001, 42001, the AI Act, NIST and OWASP, offers a Gap Check for self-assessment and the whitepaper "ISO/IEC 27090 for CISOs".October 22, 2026Agent Control Standard (ACS)The OWASP Agent Control Standard (ACS) is an open specification under which a Guardian Agent checks an AI agent’s actions at defined hooks and, based on policy, allows, blocks, modifies, submits them for approval or defers them. This deep dive shows what version 0.1.0 delivers today — and where its limits lie.October 4, 2026OWASP Agentic Top 10The ten key security risks of autonomous AI agents – from Agent Goal Hijack to Rogue Agents – based on the official OWASP publication (version 2026, December 2025).July 30, 2026MCP SecurityThe Model Context Protocol connects AI applications with tools, data, and systems – creating a new attack surface in the process. We put the current guidance from the NSA, OWASP, and Wiz into context and show how you can secure MCP servers and clients.July 30, 2026OWASP LLM Top 10The ten most critical security risks for applications built on Large Language Models – and the mitigations that have proven effective in practice for each risk class.July 31, 2026Zero Trust for AI AgentsAutonomous AI agents act with legitimately granted privileges at machine speed. Zero Trust transfers proven principles — verify instead of trust, Least Privilege, assume breach — to agentic systems.July 30, 2026Agent Skills SecurityHow to vet, harden and govern packaged capabilities for AI agents – instructions plus executable code in the SKILL.md format – before deployment and across their lifecycle.July 31, 2026AI Security FrameworksOWASP, MITRE ATLAS, and NIST AI RMF look at AI security from three different perspectives. An overview of what each framework stands for — and how, in combination, they form a viable protection concept.July 30, 2026Data Loss PreventionHow to systematically prevent the uncontrolled outflow of sensitive data — from data classification through policy design in Microsoft Purview to well-governed operations.July 30, 2026Privileged Access ManagementPrivileged accounts are the shortest path to compromising entire environments. PAM governs their provisioning, use and monitoring across governance, architecture and operations - VamiSec supports design, rollout and ongoing operation.July 30, 2026MCP FundamentalsThe Model Context Protocol (MCP) is an open standard that connects AI models to Tools, data sources, and APIs through a single, unified interface. This overview explains its structure, building blocks, and communication paths — and identifies where security questions arise along the way.July 30, 2026Threat landscapeThe Model Context Protocol connects AI agents to arbitrary tools and data sources at runtime — and thereby turns every reachable MCP-Server into a trust boundary of its own. This page contextualizes the documented attack paths and substantiated incidents and shows what detection, gateway control, and operations must watch for.July 30, 2026OWASP MCP Top 10The Model Context Protocol has become the integration layer between language models and enterprise systems — and thus a new, often unexamined trust boundary. The OWASP MCP Top 10 name the ten risks of this layer.July 30, 2026MCP & OAuth 2.1Since the June 2025 specification revision, a protected MCP server is an OAuth 2.1 resource server with clearly separated roles. This deep dive explains the discovery chain, client registration, token rules and audience binding – and shows where implementations fail in practice.August 2, 2026Best PracticesThe Security Best Practices of the official MCP specification are not a menu of options but concrete requirements. We translate them into a verifiable security architecture for your MCP-Servers and -Clients.July 30, 2026Secure Server DevelopmentMCP-Servers connect AI assistants to tools and data sources and thereby become an attack target themselves. We support architecture, Tool design, authentication, and deployment along established security guidelines.July 30, 2026

Whitepapers 4

ISO/IEC 27090 for CISOs — securing AI systems against attacksAgent Control for CISOs — OWASP Agent Control Standard (ACS)LLM Pentesting & Prompt Injection: How to Truly Protect AI Systems from ManipulationAI OWASP LLM PenTesting: How to Truly Secure Your AI Systems
Solutions & services

From research area to implementation

VamiGuardData Protection for AI Prompts in the Browser
VamiRedteamMulti-Agent Penetration Testing

Services

Agentic AI Security – Overview MCP Security Agent Skills Security ADR — Agentic AI Detection & Response AI security per ISO 27090
Keep exploring

Related research areas

AI Threat ModelingThreat models for AI agents and MCP landscapes: MAESTRO and STRIDE — from the data flow diagram to a verifiable security test.Agentic Offensive SecurityAgentic pentests with technically enforced scope and verifiable evidence, combined with pentesting, red teaming, and AI red teaming.Agentic GRC EngineeringGRC as an engineering discipline: frameworks as code, one GRC graph for five management systems, and AI agents that work according to approval rules.
Back to Vami Research

How well do you control your AI agents today?

In an initial consultation, we assess your agent landscape — from MCP servers and skills to identities and telemetry — and show which step will have an impact first.

Schedule an initial consultation (opens external website)Back to Vami Research