AI agent security risks: seven ways an agent on your machine gets abused
Whoever controls what an agent reads can often control what it does. These are the seven ways that shows up in practice, each with the check that reduces it.
1. Prompt injection
An agent reads text: web pages, issues, README files, mails, tool output. If that text contains instructions, the model may follow them as if you had typed them. The OWASP list of risks for LLM applications ranks prompt injection as risk number one. You cannot fully filter it out, so the practical defence is to limit what a hijacked agent can reach (points 2 and 4).
2. Excessive agency
An agent that may run any shell command, read any file and call any tool has the rights of a full user session. The fewer rights it holds, the less a hijack is worth. Check: which folders and tools the agent configuration allows.
3. Poisoned or over-trusted tool servers (MCP)
MCP servers extend an agent with tools. Each entry in an mcp.json is a program the agent will trust and may start with your rights, often with tokens in its environment. A tool description can itself contain instructions. Check: list every configured server, what it can do, and whether a token sits in plain text in the file. Dante reports the entry and what stands out - never the token.
4. Secrets in readable files
A .env in a project, a key in a config, a cloud credentials file: any process of your user can read them, including every agent and every dependency. This is the most common and the most fixable item. See how to find leaked API keys on your own machine.
5. Supply-chain malware that uses your assistants
The s1ngularity attack (August 2025) is the clearest case: malware inside a compromised package checked for installed AI CLIs and prompted them to hunt for credentials. The Shai-Hulud worm followed and spread by stealing npm publishing tokens. Check: no long-lived publishing tokens in plain files; rotate anything that was exposed.
6. Servers reachable with weak settings
Agents are often given SSH access to a server "to fix something". Password login left on, root login allowed, or world-writable web folders turn that single path into a way in. See checking your own server.
7. Silent use of stolen credentials
Even with good habits a secret leaks, and you usually learn it from the bill. A fake credential that nobody legitimate would ever use is a tripwire: the first use tells you, with the time and a hint of what used it. See bait files.
A short routine that covers most of it
- Find and move secrets out of files other tools can read; rotate what leaked.
- Reduce agent permissions to the folders and tools the task needs.
- Set SSH to key-only login, no root login, on every server an agent touches.
- Put bait where a thief looks first, so a leak is not silent.
- Re-check regularly - settings drift. Dante does steps 1, 3 and 4 and reads the facts for step 2.
The honest version
You will not out-think every bad text an agent reads. Nobody can. What you can do on a quiet afternoon is make sure that when one gets through, there is nothing worth taking: no loose keys, no open doors, and a tripwire where a thief looks first.
npx dante-watchnpx dante-watch. Step-by-step for Mac, Windows and Linux.~/.dante and it is gone.Questions people ask
What is the biggest security risk of AI coding agents?
Secrets in readable files combined with an agent that can be instructed by untrusted text. Remove the secrets and limit the agent's permissions and a hijack is worth much less.
Can prompt injection be fully prevented?
Not reliably with filtering alone. That is why the practical defence is limiting what the agent can reach and being told quickly when a credential is used.
Are MCP servers safe?
Each one is a program your agent trusts. Review the list, prefer ones you can read, keep tokens out of plain-text config where possible, and remove what you do not use.
More
- How to find leaked API keys and secrets on your own machineWhere keys hide (code, .env, Git history, shell history, cloud files), how to tell a normal private .env from a real leak, and how to check without ever printing the secret..
- Is my server hacked? How to check your own server for warning signsA practical checklist for a server you own: SSH settings, world-writable files, web shells, outdated PHP, unknown cron jobs and keys - and what a read-only check can and cannot prove..
- Bait files that warn you when someone uses your secretsA fake .env, mcp.json, .npmrc or AWS credential that nobody legitimate would ever use.
- Install Dante in three minutes - and what the packs costStep-by-step install for Mac, Windows and Linux with one command, how to talk to Dante, the free and paid parts, and how updates and knowledge packs work.
- After the Hugging Face incidents: check your tokens and the models you downloadedWhat was reported about Hugging Face Spaces secrets and malicious models, what to rotate, why pickle files are risky, and how to check your own cache and agent config without sending anything anywhere..