AI agents now read documents, call APIs, and change records on behalf of users. OWASP advises that the permission checks behind those actions belong in downstream systems, outside the model. AI agent penetration testing checks whether an attacker can steer an agent into actions its user is not allowed to take. The security risk depends on whether the agent and its connected tools enforce the intended access restrictions when processing untrusted instructions.
In this article, the analysis covers how agents fail under adversarial input and which controls decide the outcome. It also explains how testers validate those controls. Each section describes the mechanism first and the test second, so readers can scope an assessment of their own agent deployments.
1. How prompt injection turns into unauthorized action
The OWASP AI Agent Security Cheat Sheet lists direct and indirect prompt injection as the first key risk for agents. It describes malicious instructions that arrive through user input or through external content such as websites, documents, and emails, and that hijack the agent's behavior. The indirect route matters because the attacker never needs to talk to the agent. The planted text only has to reach content the agent later reads. The impact then depends on which tools the agent can call.
2. Why excessive agency sets the level of impact
The OWASP entry on excessive agency traces damaging agent actions to three root causes, which are excessive functionality, excessive permissions, and excessive autonomy. Its example describes a personal assistant app that summarizes a user's email through an extension that can also send messages. A maliciously crafted incoming email uses indirect prompt injection to make the agent scan the inbox for sensitive information and forward it to the attacker. OWASP notes that a read-only mail extension, a read-only OAuth scope, or a manual send step would each have prevented this. The same entry warns against open-ended extensions such as running shell commands. A recent workflow platform case shows what such an execution context can reach, where a pre-run script field ran user commands as root and exposed runtime credentials and cloud metadata. Although the case did not involve an AI agent, it illustrates the potential impact of granting an agent access to an unrestricted shell. The resulting risk would depend on the execution environment and the permissions available to it.
3. How memory and retrieval can expose data
The OWASP cheat sheet also names memory poisoning and data exfiltration as separate agent risks. Memory poisoning applies where an agent persists memory between sessions. Malicious content saved there could influence later sessions, and it could reach other users where memory is shared or not isolated.Data exfiltration can occur when an agent exposes sensitive information through tool calls, API requests, or its output. . OWASP recommends validating content before it is stored, isolating memory between users and sessions, and running extensions in the requesting user's context.
4. What an AI agent security assessment validates
Testing starts by mapping every tool, data source, and identity the agent can reach. Testers then try to push the agent beyond the requesting user's permissions through direct prompts and planted content. OWASP recommends enforcing authorization in the execution component, outside the agent's context, and its test matrix expects unauthorized tools to be denied even when the model requests them confidently. Core checks include:
- Tool calls that exceed the user's role are denied on the server side.
- Retrieved content cannot silently replace system or developer instructions.
- Memory and context stay isolated between users and sessions.
- High-impact actions require a valid approval bound to the exact parameters.
OWASP also advises repeating these tests after changes to prompts, tools, memory, retrieval, or model providers. Confirmed findings then move into remediation and retesting, the same cycle used in API penetration testing and in broader vulnerability assessment and penetration testing engagements.
Agent security depends on the controls around the model. Testing those controls under adversarial input shows whether a manipulated agent can still act only within its user's permissions. That evidence gives remediation a clear order of priority.
If you're looking to assess your organization's exposure to similar risks, Scan your organization's exposure, explore Laburity, or book a consultation.
