A recent post by Simon Willison sparked fresh debate on how easily LLM-powered automations can leak sensitive data. Here’s a fast, practical checklist to cut risk without slowing your team down.
The core failure modes
- Prompt injection: Untrusted content convinces the model to ignore rules and exfiltrate secrets.
- Overbroad permissions: Agents get powerful tools (or wide OAuth scopes) they rarely need.
- No isolation or review: The same context browses the web and executes actions, with risky steps auto-approved.
7 fast checks to harden LLM agents
- Minimize tool scope and keys: Use least-privilege, per-tool, short-lived tokens. Split read vs. write access.
- Domain allowlists + sanitization: Restrict browsing to trusted domains. Strip scripts, block data: URIs, and reject unexpected file types.
- Safe tool wrappers: Validate inputs/outputs. Require explicit confirmation for file writes, external posts, or code execution.
- Secrets hygiene: Keep credentials out of prompts. Fetch from a vault at call time, never echo back. Tokenize or hash where possible.
- Human-in-the-loop for high impact: Route deletions, payouts, mass emails, or privilege changes to approval queues.
- Telemetry + red teaming: Log traces and tool calls. Simulate attacks using the OWASP Top 10 for LLM Applications.
- Kill-switches and limits: Session-level tool toggles, rate limits, and outbound data caps with anomaly alerts.
For broader governance, map controls to the NIST AI Risk Management Framework and align incident response with your existing security playbooks.
Design patterns that help
- Two-agent isolation: A read-only browsing agent extracts facts; a separate actions agent has narrow tools. Only pass sanitized, structured data between them.
- Staging before prod: Agents propose a plan and produce a diff in a sandbox. A separate process (or human) applies approved changes.
- Consent-based UI: Show the “why” and the exact command before execution. Use step-by-step approvals for anything that writes or moves data.
Key takeaway
Treat LLM agents like junior contractors on the public internet: give them the least possible power, isolate risky steps, log everything, and require review for writes and transfers.
Get weekly, no-fluff AI tactics in your inbox. Subscribe to The AI Nuggets newsletter.
