Module 9 Lesson 1: The expanded attack surface of agents

A "Chatbot" is a text generator. An "Agent" is a decision-maker with Hands. When you give an AI the ability to execute actions, you are no longer just securing a "Conversation"—you are securing a "User."

1. What is an Agent?

An agent is an LLM that is connected to Tools (APIs, Shells, Databases).

• The Loop:
  1. User gives a goal ("Book a flight").
  2. AI Plans the steps.
  3. AI calls a Tool (e.g., lookup_flights).
  4. AI observes the result and loops back to Step 2.

2. The Multiplier Effect

The attack surface of an agent is the Sum of all its tools. If an agent has access to:

• read_email()
• write_to_database()
• search_web()

The attacker doesn't just have a prompt injection risk. They have an Email Leakage risk, a Database Corruption risk, and an SSRF risk all rolled into one.

---

3. The "Permissions" Gap

The biggest problem with agents is Identity Confusion.

• The System's View: The code running the agent has "Admin" permissions to the database.
• The Reality: The user talking to the agent might be a guest.
• If the user can trick the agent into running a command, the agent will use its "Admin" permissions to do it. This is a Confused Deputy attack at scale.

---

4. Visualizing the Surface

Traditional App: User -> Input Validation -> Database

Agentic App: User -> LLM -> Planner -> [Tool 1, Tool 2, Tool 3, ...] -> Infrastructure

Every arrow is a point where a prompt injection can "Jump" from natural language into executable code.

---

Exercise: The Surface Map

1. List 3 tools you would give to a "Personal Finance AI."
2. For each tool, describe one way an attacker could exploit it via a "Hidden Instruction" in a bank statement.
3. Why is an "Autonomous" agent (one that doesn't ask for permission) much more dangerous than a "Co-pilot" agent?
4. Research: What is "AutoGPT" and why did early security researchers warn against running it on your primary computer?

---

Summary

Agents turn "Text Risks" into "System Risks." To secure an agent, you must stop thinking about "Banning words" and start thinking about Network Segmentation and Least Privilege.

Next Lesson: Precision Exploits: Tool injection and parameter manipulation.