AI agent security is the discipline of protecting autonomous LLM-based systems that plan, call tools, hold memory, and act across other systems with delegated authority — a much larger attack surface than a single-turn chatbot. It matters because an agent's blast radius equals every credential, tool, and API it can reach, and multi-step autonomy means one bad decision compounds across an entire plan rather than staying contained to one response. The key mental model to keep in mind while reading these tables: an LLM cannot reliably tell trusted instructions from untrusted data once both are glued into the same context window, so every piece of content an agent reads — an email, a document, a tool response, another agent's message, its own memory — must be treated as potentially adversarial.
What This Cheat Sheet Covers
This topic spans 15 focused tables and 122 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Agentic Security Risk Taxonomy
Before diving into individual attack classes, it helps to see how the field organizes them. The OWASP Top 10 for Agentic Applications 2026 (ASI01–ASI10) is the industry's reference taxonomy, built from real 2025-2026 incidents rather than projections, and every later table in this sheet maps back to one or more of these ten categories.
| Risk | Example | Description |
|---|---|---|
A hidden <IMPORTANT> instruction in a retrieved email redirects the agent's objective | An attacker redirects an agent's objective through content it reads rather than code it runs; the agent still believes it serves the user. | |
A coding agent's legitimate AWS CLI tool is instructed to "clean to factory state" | Legitimate tools get bent toward illegitimate outcomes through deceptive input, poisoned metadata, or unsafe tool chaining. | |
Agent borrows a developer's long-lived PAT instead of a scoped short-lived token | Shared or over-broad credentials mean a hijacked agent inherits everything it can touch. | |
A typosquatted MCP package on npm is auto-installed by a tool-discovery agent | Agents assemble frameworks, connectors, and tools at runtime, so the supply chain keeps changing after deployment. | |
A poisoned instruction causes an agent to generate and run a shell one-liner | Natural language becomes running code outside intended boundaries via a sandbox escape or eval-style sink. |