/ Books & reading
Agent security reading list. Ordered for someone shipping tool-using agents — threat first, then fixes, then the reason the fixes are shaped the way they are.
Start here
2025Simon WillisonThe lethal trifectaAn agent is exploitable when it has all three of: access to private data, exposure to untrusted content, and a way to send data out. Worth reading with your own config open.↗1988Norm HardyThe Confused DeputyThe one-page classic. Every indirect prompt injection is a confused deputy attack — and why ACLs cannot fix it while capabilities can.↗2025Beurer-Kellner et al.Design Patterns for Securing LLM Agents against Prompt InjectionsSix architectural patterns (dual LLM, plan-then-execute, code-then-execute, …), each with an honest account of what utility it costs.↗
Frameworks
Oct 2025Meta AIAgents Rule of TwoSame idea as a design rule: pick at most two of untrusted input, sensitive access, and state-changing or outbound actions per agent run — or add a human in the loop.↗1975Saltzer and SchroederThe Protection of Information in Computer SystemsLeast privilege, complete mediation, fail-safe defaults. Fifty years old and reads like it was written for tool-using agents.↗
Designs that hold up
2025Debenedetti et al. · Google DeepMindDefeating Prompt Injections by Design (CaMeL)A privileged model writes a program, a quarantined model reads untrusted data, and a capability system tracks taint. The most convincing “secure by construction” result so far.↗2025GoogleGoogle's Approach for Secure AI Agents: An IntroductionArgues neither classic policy enforcement nor model-based reasoning is enough alone, and lays out the hybrid.↗2006Mark MillerRobust CompositionObject-capability security. Why sandboxes like Deno’s permission model or a per-tool capability token are the right shape.↗
Attacks
2023Greshake et al.Not what you’ve signed up forThe paper that named indirect prompt injection. Still the best taxonomy of delivery channels.↗2025Trail of BitsJumping the lineTool descriptions attack you before a tool is ever called. Directly relevant to third-party MCP servers.↗2025Trail of BitsHow MCP servers can steal your conversation historyCompanion to jumping the line — trigger phrases in tool descriptions exfiltrate the whole chat.↗2025Invariant LabsMCP Security Notification: Tool Poisoning AttacksShort, with a working demo against a real client.↗blogJohann RehbergerEmbrace The RedPractical, reproduced exploits against Copilot, ChatGPT, Gemini, and Claude Code — usually with vendor fixes tracked. Read a few to calibrate how cheap these attacks are.↗Jun 2025AnthropicAgentic MisalignmentA different threat class: the model as insider under goal conflict, not the model as victim of injection.↗