Agents, MCP integrations, and LLM‑powered applications are appearing in codebases faster than most security teams can track. Traditional AppSec assumes the application does exactly what its code says, but agentic AI behavior emerges from the model, system prompt, retrieved context, user input, and the tools it can call. Two identical deployments can behave differently, and new failure modes—prompt injection via data, over‑permissioned agents, deprecated models, poisoned tool descriptions—do not show up in CVE feeds. Security must therefore shift left and protect right.
A practical framework addresses this with three moves: see what matters, fix what matters faster, protect AI in production, supported by reusable artifacts.
See: discover shadow agents, unregistered MCP servers, and embedded AI frameworks. Scan repositories for agentic signatures, monitor egress to model APIs, audit service accounts, enable lightweight registration, and automate continuous discovery. Extend an AI‑BOM with nine fields (identity, model dependency, autonomy level, tool permissions, credential scope, data reach, MCP endpoints, prompt location, last review) and apply a 12‑point misconfiguration checklist (scoped credentials, no shared secrets, human approval for high‑impact tools, version‑controlled prompts, client authentication for MCP servers, reviewed tool descriptions, pinned model versions with EOL monitoring and ownership).
Fix: enrich findings, then prioritize by reachability, exploitability context, business context, agentic amplification, and fix availability. Automate decisions that have clear evidence trails; keep novel AI behaviors and risk acceptance human‑only, with sampled review to drive retraining.
Protect: deploy guardrails as an in‑app Python SDK or a standalone Docker API Server. Use inbound checks for prompt injections, jailbreaks, out‑of‑policy requests, and outbound checks for credentials, PII, proprietary code, unsafe content. Harden system prompts by assuming disclosure, separating instructions from data, constraining blast radius, versioning, and adversarial testing. Prefer strict tool permissions over prompt instructions.
Maturity roadmap aligns with NIST AI RMF, OWASP AIMA, ISO/IEC 42001, and the EU AI Act via a 15‑question self‑assessment.
#AI #Product #Security #DevSecOps #LLM #AIAgent