Agents hold credentials, call tools and act without a person in the loop. Most were set up to work, not to be safe.
How agent setups drift
An agent starts with one tool and a service account. Six months later it has twelve tools, a shared API key three other systems use, and write access nobody remembers granting. MCP servers get added with default trust. Nobody can say what the agent may do, let alone who approved it.
Where attacks come in
Not through the chat box. Through the documents the agent retrieves, the tickets it reads, the tool outputs it trusts. An instruction hidden in a PDF is still an instruction. Indirect prompt injection turns every data source into an attack surface, and an over-permissioned agent turns that into real actions.
An instruction hidden in a PDF is still an instruction.
What we do
We inventory every agent, its identities and tools, and build a threat model. Then least privilege: scoped identities per agent, per-tool permissions, spend and rate limits, isolated MCP servers. We harden against injection, add approval gates for consequential actions, and make every tool call traceable. Your team implements the findings, or we build the guardrails with you.