AI Agent Security: The Production Checklist for 2026

Why AI agent security is different

A classic web app has a finite attack surface: known endpoints, fixed inputs, deterministic logic. An AI agent has the opposite. It accepts free-form text, calls tools dynamically, and reasons over data it was not supposed to see. Every new tool you give it widens the blast radius.

Standard application security playbooks (OWASP Top 10, SOC 2 controls) cover the perimeter but miss the agent-specific risks: prompt injection, tool misuse, data exfiltration through the model, and runaway cost. A real AI agent build addresses all four.

The 10-point production checklist

Print this. Hand it to the agency. If they cannot tick every box, walk.

• Prompt injection defense — input sanitization, instruction hierarchy, and untrusted-content tagging on every tool output.
• Tool gating — agents can only call allow-listed tools, and destructive tools require explicit human approval.
• Data isolation — per-tenant scoping enforced at the data layer, not in the prompt.
• Secrets handling — no API keys in prompts; all credentials brokered server-side.
• Output validation — structured outputs validated against schema before any downstream action.
• Audit log — every prompt, tool call, and tool response logged with user, tenant, and trace ID.
• Cost ceiling — per-user and per-tenant token caps that hard-fail, not soft-warn.
• Rate limiting — at the agent level, the tool level, and the downstream API level.
• Eval harness — adversarial red-team prompts running in CI on every prompt change.
• Incident playbook — kill switch, rollback path, and notification chain for security events.

Prompt injection: the threat most agencies ignore

Prompt injection is to AI agents what SQL injection was to web apps in 2005. Any data your agent reads — emails, web pages, PDFs, support tickets — can contain instructions that hijack the agent. The fix is not "better prompts". It is architectural.

The defense-in-depth pattern: tag every piece of untrusted content explicitly, never concatenate untrusted text into system prompts, validate every tool call against an allow-list, and require human approval for any irreversible action.

Compliance: SOC 2, HIPAA, GDPR for agents

Existing compliance frameworks apply to agents — they were just written before agents existed. SOC 2 cares about access controls; for agents that means tool gating and audit logs. HIPAA cares about PHI; for agents that means data isolation and no PHI in third-party model prompts unless you have a BAA.

GDPR adds two agent-specific concerns: the right to know what data was processed by an automated system, and the right to a human review of consequential decisions. Both are enforceable with the audit log and human-in-the-loop controls from the checklist above.

What to ask on the procurement call

Five questions that separate real agent shops from prompt-shops:

• "Show me the audit log schema for an agent run in production."
• "Walk me through your prompt injection defense for tool outputs."
• "How do you enforce per-tenant data isolation — at the prompt or in the database?"
• "What is your adversarial eval harness, and how often does it run?"
• "Show me an incident playbook from a past project."

Frequently asked questions

Are AI agents secure enough for production?

Properly built agents are. The risk is in the build. Agents with tool gating, data isolation, audit logging, and an eval harness pass enterprise security review. Agents without those controls do not.

What is the biggest AI agent security risk?

Prompt injection through untrusted content. Any data the agent reads can contain instructions that hijack it. Architectural defenses (content tagging, allow-listed tools, human approval for destructive actions) matter more than prompt wording.

Can AI agents be SOC 2 or HIPAA compliant?

Yes — the same controls apply. Tool gating and audit logs cover the SOC 2 access requirements; data isolation and a BAA with the model provider cover the HIPAA requirements. The agent architecture has to support both from day one.

Who builds secure AI agents?

Hardvain does — every agent build ships with the 10-point production checklist baked in. Scope-based pricing, real production agents, security review included.