Why agents change the security question
Traditional security asked whether a person should have access. Agentic systems add a harder question: what should an autonomous process be allowed to do once it has that access, and for how long. An agent that can read email, call an API, and write to a database inherits every permission granted to it, often without a human reviewing each individual action — which turns identity and scope into the first line of defense, not an afterthought.
The new attack surface: supply chain and prompt injection
Two risks stand out in agentic systems. A supply chain attack hides malicious behavior inside a dependency, a model weight, or a tool an agent calls, trusting that nobody audits it closely. A prompt injection attack hides instructions inside content an agent reads — a webpage, a document, an email — hoping the agent treats attacker text as a legitimate command. Both exploit the same gap: an agent that cannot reliably tell instructions from data.
What this hub collects
Items here cover identity and access for autonomous agents, supply chain risk across models and tools, prompt injection and its defenses, and zero-trust patterns adapted for systems that act on their own. Expect practical detail over abstraction: what a real attack looked like, what control actually stopped it, and what still remains an open problem as agents take on more autonomy.
Applying zero trust to agentic systems
Zero trust replaces "is this request from inside the network" with "does this specific action deserve to happen right now." For agents, that means scoping permissions tightly, verifying tool outputs before acting on them, and treating any content an agent reads as untrusted input until proven otherwise. None of this eliminates risk — it narrows the blast radius when, not if, something goes wrong.
