AI apps add a new attack surface on top of the old ones. This is the map: the threats unique to LLMs and agents, and the controls that actually contain them.
AI Security — Securing LLM and Agent Apps in 2026
Shipping an LLM or agent feature adds a new attack surface on top of every classic one. The model takes untrusted natural-language input, calls tools, reads private data, and generates code and actions, which means the old "don't trust input" rule now applies to prose, tool output, and retrieved documents, not just form fields. This guide is the map: the threats that are specific to AI apps, and the controls that actually contain them, so you can ship without opening a hole.
The mental model that keeps you sane: the model is a powerful, gullible intern. It will do what a cleverly worded input tells it to, so security lives in the boundaries around it (input handling, tool permissions, output validation), not in the model's good intentions.
- Prompt injection: untrusted text (a user message, a web page, a tool result, a retrieved doc) hijacks the model's instructions. This is the number-one LLM risk. Defenses are in prompt injection defense for LLM apps.
- Excessive agency: an agent with broad tools and no approval gates does damage when manipulated. Scope tools tightly and gate destructive actions, covered in AI agent security and tool design, boundaries, and confirmations.
- Sensitive data disclosure: the model leaks secrets, PII, or other users' data through its context or outputs. Minimize what enters context and filter what leaves it.
- Insecure output handling: treating model output as trusted, then rendering it as HTML or executing it as code or SQL. Validate and encode model output exactly like user input.
- The full list: the community-standard taxonomy is walked through in the OWASP Top 10 for LLM applications.
- Input and output guardrails: filter and classify what goes in and comes out (injection patterns, PII, policy violations), in guardrails for production LLMs. Constrain outputs to a schema so a hijacked model can't emit arbitrary actions, via schema-constrained output validation.
- Least privilege for tools and data: an agent should hold the minimum tools and the minimum data access, with human approval on anything destructive. Same principle as AWS security, applied to agents.
- Test it adversarially: you cannot assert security by reading the prompt. Attack your own app, covered in AI red teaming.
Two adjacent risks ride along with AI development: the model's code output is often insecure (a large share of AI-generated code carries flaws), covered in securing AI-generated code; and the dependencies your AI stack pulls in are a supply-chain target, covered in software supply chain attacks. AI security is not separate from application security; it's a new layer on it.
Treat every input crossing into the model as attacker-controlled, give agents the least agency that still does the job, validate and encode every output, and red-team the whole thing before users do. Add guardrails at the input and output boundaries, not deep in the model, and keep humans in the loop for high-stakes actions. The models will keep changing; these boundary controls won't. Each linked guide goes deep on one layer; start from prompt injection and tool scoping, then make it testable.
