Four Ways to Deploy More Secure AI Agents

As enterprises increasingly deploy AI agents to boost productivity, a new report from NVIDIA's AI Red Team reveals a consistent pattern of exploitable security flaws that undermine these systems. The six-month investigation found that most AI agents, regardless of their framework, suffer from critical vulnerabilities including poor access controls and the exposure of secrets in plaintext. This research highlights a significant and often overlooked attack surface, cautioning that connecting large language models to live corporate data and tools without proper architectural safeguards can turn a helpful digital assistant into a privileged security risk.

Systemic Flaws and Unreliable Defenses

The NVIDIA team identified four recurring failure modes: a lack of agent-specific access control, tools that permit arbitrary code execution, no network egress restrictions, and the exposure of plaintext secrets within the agent's environment. The report shows that common mitigations, such as using a system prompt to forbid malicious behavior or employing a second LLM as a 'judge' to vet commands, are consistently defeated. Adversaries can bypass these probabilistic defenses using straightforward techniques like social engineering, 'frog-boiling' attacks that slowly nudge the agent's behavior, and misdirection through seemingly legitimate workflows like installing a malicious software package.

Architectural Controls for Agent Security

A key finding is that reliable security cannot be managed within the same control plane as the LLM. Instead, defenses must be deterministic and enforced by the underlying infrastructure. The team recommends a layered security approach focused on architectural controls:

• Use strong access controls to restrict agent interaction to specific, authenticated users.
• Execute any required command-line tools in a hardened, isolated sandbox environment like Docker or NVIDIA OpenShell.
• Apply a default-deny network egress policy, using a least-privilege allowlist for any required external connections.
• Keep persistent secrets out of the agent's reach by using a dedicated secrets manager and issuing short-lived, narrowly scoped tokens on demand.

These findings signal a necessary shift in the AI security landscape, moving the focus from prompt engineering and model alignment to robust, infrastructure-level enforcement. For organizations leveraging agentic AI, this means security and DevOps teams must collaborate to build zero-trust environments that contain and control agent actions, treating them as privileged software processes rather than just conversational interfaces.

The core finding from NVIDIA's research is that AI agent security cannot be delegated to the LLM itself; robust, enterprise-grade safety depends on deterministic architectural controls like sandboxing and network policies that operate entirely outside the model's probabilistic decision-making process.