Chapter 1 · Part 1

Why agents are a new risk

In Build an AI Agent you gave a model a loop and real tools — it could read files, run functions, act on its own. That's powerful. It's also the exact reason an agent is a new kind of security problem, unlike any ordinary program you've written.

The one property that changes everything

Normal software does what its code says. An agent does what the text in its context says — and that text isn't only your instructions. It's also whatever your tools drag in: the contents of a file, a web page, an email, another tool's output. The model can't reliably tell your instructions apart from data that happens to contain instructions. To it, it's all just text in the prompt.

So if any of that text is written by an attacker, the attacker gets a say in what your agent does. That's not a bug you can patch — it's the nature of a system that takes actions based on natural language.

The lethal trifecta

An agent becomes genuinely dangerous when three things are true at once:

⚠️The lethal trifecta
  1. Access to private data — files, a database, your emails, secrets.
  2. Exposure to untrusted content — it reads something an attacker could have written.
  3. A way to send data out — a tool that can make a request, send a message, write a file.

With all three, an attacker who controls the untrusted content can make your agent read your private data and ship it to them. Remove any one leg and the attack collapses.

Look back at the agent you built: it has read_file (private data), it reads whatever that file says (untrusted content), and get_weather makes an outbound call (a way out). All three. It's a demo, so nothing bad happened — but the shape of the vulnerability is already there.

The agent we'll harden

We'll keep using that same agent.py — the loop, and the calculate, read_file, and get_weather tools in TOOL_FUNCTIONS. Right now it trusts everything it reads. Over this course we'll attack it, then close every hole.

📌Same setup as the agent course

This builds on the agent from that course, so you need the same thing: pip install anthropic and your ANTHROPIC_API_KEY in the environment. Most defenses here are code you can read and reason about; the attack demo in the next chapter makes a real call, so it spends a few cents.

The best way to understand the danger is to feel it. Next chapter: we hijack the agent.