Practical safeguards, threat modeling, and secure development guidance for agentic systems.
11 resources
Google's Secure AI Framework v2 extends SAIF's six security principles to agents, adding risk maps for autonomy, tool permissions, memory poisoning, and multi-agent interactions. Includes a self-assessment and a risk-control matrix for agent developers.
Kern and Olive (Google) outline Google's hybrid approach to agent security combining traditional AppSec controls with LLM-specific defences. Covers isolation, least-privilege tool access, prompt-injection mitigations, and runtime monitoring in Google's internal agent deployments.
Cyber Security Agency of Singapore addendum updating its AI systems guidelines for agentic use cases. Adds controls for autonomy boundaries, tool vetting, inter-agent communication, and incident response, aligned with the Companion Guide.
CSA Singapore and FAR.AI joint discussion paper classifying threats to agentic AI across adversarial, misuse, and systemic categories. Proposes layered controls covering model training, deployment guardrails, and runtime monitoring, with worked examples.
McKinsey playbook for technology leaders deploying agents safely, covering governance operating model, guardrail layers (input, model, tool, output), evaluation cadence, and incident response. Includes a maturity assessment and reference architecture.
Meta's heuristic constraining agents to at most two of: processing untrusted inputs, accessing sensitive systems, and taking unconfirmed actions. Frames the rule as a practical bound on blast radius until prompt-injection defences mature.
OWASP v1.0 threat modelling guide for multi-agent generative AI systems, covering trust boundaries between agents, memory-sharing risks, orchestration attacks, and collusion. Walks through STRIDE-style analysis applied to a reference multi-agent architecture.
OWASP catalogue of agentic AI threats paired with technical and procedural mitigations, organised by attack vector (planning, memory, tools, outputs, identity). Companion reference to the OWASP Top 10 for Agentic Applications with deeper control detail.
NIST announcement of a cross-industry initiative to develop standards for interoperable and secure AI agents, covering identity, capability declaration, audit logs, and evaluation. Coordinates with CAISI, industry partners, and international standards bodies.
Germany's Federal Office for Information Security overview of generative AI opportunities and risks, with security recommendations for procurement, development, and deployment. Covers data leakage, prompt injection, and supply-chain risks relevant to agent builders.
France's ANSSI cybersecurity agency hub for AI guidance, bringing together its recommendations on securing generative AI deployments, supply-chain risks, and state-actor threats, including emerging considerations for agentic workflows.