The Agent Attack Surface
Made by AI agents — script drafted from the book, AI narration, animation written as code — and steered by the author, Rasmus Bornhøft Schlünsen.
What the film says
Picture an agent asked to look through the open issues on a public repo. One issue was written by a stranger, and buried in it is a paragraph addressed not to the maintainer, but to the agent. The agent reads it, and helpfully does what it says. Private data ends up in public. Nothing was broken. Every part worked as designed.
Application security rests on one idea: data should never run as instructions. Language models don't have that separation. Your request, a file, a web page, a tool result. To the model, it's all just tokens. That's prompt injection. Someone puts text where your agent will read it, and the text says: do this instead.
The model is not a security boundary. A defence that works nearly every time is a good spam filter, and a terrible lock. Prompt injection is unsolved. So plan as if it will happen, and ask a better question: when the agent is tricked, what's the worst it can do?
The most useful model here is the lethal trifecta. Access to private data. Exposure to untrusted content. And a way to send data out. Any two are manageable. All three in one session, and anyone who can get text in front of your agent can get your data out. So remove at least one leg, for every session.
Untrusted text gets in through more doors than you'd think. Issues and comments. Web pages. Log lines, where a username can carry a payload. Tool descriptions from other people's servers. Even the instruction files in a repo you just cloned. Pointing an agent at someone else's repo means running someone else's prompt.
And data leaves through more than email. An image link with a secret in its address. A public comment. A web request. Even a name lookup. If the agent can write anywhere an outsider can read, that's an exit.
Skills, plugins and servers are dependencies, too. Read them, pin them, and review changes, because a tool's description can quietly change after you approved it.
The defences come in layers. Scoped, short-lived tokens. A reader agent that sees untrusted text but holds no privileges, passing only checked, structured data to an actor that does. A closed network. A human approving anything outbound. And a log the agent can't edit.
Think of a harbour pilot. They take the helm through unfamiliar waters, but they don't get the keys to the hold. Let your agents steer. Keep the keys. Next up: articulating intent.