Five agents. Seven credentials. One that refunds without asking.
Your teams already run AI agents: coding assistants, a support chatbot, a release bot in CI. Agent Guard finds them, shows what each one can reach and how badly a hijacked one could hurt, tests them against prompt injection, and proposes the least privilege each one needs. Your teams decide what changes.
The real world
- Added
By whoever needs it
An engineer adds a coding assistant and three MCP servers. Support launches a chatbot. Platform puts an agent in the release pipeline. Each is a good idea on its own.
- Granted
Broad, "for now"
The quickest token that works gets pasted into a config file: full repository access, write on the orders database, a key that can also issue refunds. The plan is to narrow it later.
- Forgotten
The token outlives the reason
The engineer who created it moves teams. It never expires and still works.
- Exposed
To anyone who can write an email
The chatbot reads every inbound support email, and the coding assistant reads any web page. Either can carry instructions the agent may follow.
- Unowned
No one has the list
Ask which agents can move money or deploy to production, and the answer takes a week of asking around.
Watch it work
Loading…
What it’s worth
A hijacked agent does damage at machine speed with the access someone gave it months ago, and the first sign is usually the incident. On the fictional retailer above, the worst single agent puts about $540K at risk.
- $540K
- · At risk if the CI release agent is hijacked: a tampered deploy takes Checkout ($52K an hour) and Orders ($38K an hour) down for an assumed 6 hours. Exposure, not a saving.
- $166K
- · Incident cost avoided each year: Fix-now findings closed on the release agent and the support chatbot ($662K combined exposure), at an assumed 25% annual chance one is hijacked if left as is.
- $17K
- · Engineer hours saved each year: 110 hours of tracing five agents’ configs, tokens and scopes by hand, four times a year, replaced by checking the agent’s inventory.
Compared
Access reviews, API gateways and AI security filters each cover part of the problem. Here is what each does, and where an agent adds something new. In every column, people make the final call.
| What it does | By hand | Access reviews and gateways | AI security filters | Agent Guard |
|---|---|---|---|---|
| Lists every agent from its own config: coding assistants, MCP servers, chatbots, CI jobs | Partlyasking around | Nosees tokens, not agents | Partlyapps routed through it | Yes |
| Follows each tool to the credential and scope it holds | Yesslowly | Partlyscopes, not which agent uses them | No | Yes |
| Reads tool descriptions and flags private data plus untrusted input plus the power to act | Partly | No | Partly | Yesby name |
| Blocks prompt injection while it happens | No | No | Yesits core job | Notests it; filters enforce |
| Tests injection in a test environment and scores the result | Partly | No | Partlyred-team tools | Yes |
| Prices the blast radius in money | No | No | No | Yes |
| Proposes least privilege per finding | Yes | Partlyunused-permission reports | No | Yesthe owner approves |
| Approves scopes and revokes tokens | Yespeople | Yespeople | Yespeople | Yespeople |
● Yes◐ Partly— No
People’s hours a year, four reviews of five agents
85% fewer hours than by hand, and 78% fewer than with security tools and people: 179 hours, about $27K.
See the hours by activity, and how each is reached
| Activity | By hand | Security tools and people | Agent and people |
|---|---|---|---|
| Inventory agents, tokens and scopes5 agents, 4 times a year. By hand: 6 h each. Access reviews: about 4 h each, since tokens are listed but not tied to agents. Agent: 0.5 h each to check its inventory. | 120 h | 80 h | 10 h |
| Test prompt injectionAgent: runs the corpus in a test environment; a person reads the scored result. | 40 h | 24 h | 6 h |
| Propose least-privilege fixesAgent: one proposal per finding for the owner to accept. | 30 h | 20 h | 5 h |
| Write the briefAgent: it drafts the 30-day plan; a person checks it. | 12 h | 12 h | 2 h |
| Approve the changesThe same in every column. | 8 h | 8 h | 8 h |
| Total | 210 h | 144 h | 31 h |
Estimates for the fictional Northwind Outfitters at an assumed $150 an hour, on the same assumptions as the business case above. Categories, not products: individual tools vary. Verify against your own environment.
How it works
- Inventory
Every agent, from its own config
Coding-assistant settings, MCP server lists, agent-platform and CI manifests, and the identity provider’s export of tokens and scopes. Secrets in clear text are masked on the spot to their prefix and last four characters.
- Reach
What each one can really touch
Plain code follows each tool to the credential it holds, each scope to the system and data behind it, and notes whether a person approves. The agent reads tool descriptions and schemas, because a tool called "lookup" may also take a refund flag.
- Rank
Blast radius, the same way every time
Data sensitivity, times what the agent can do there, times two when no one approves, summed over every system it reaches. Agents that combine private data, untrusted input and the power to act are flagged by name.
- Test
Prompt injection, recorded
A corpus of injected emails, chat messages, web pages and READMEs, run in a test environment against planted records. Plain code counts disallowed tool calls and leaked records; the agent judges the responses in between, such as a customer’s own email versus someone else’s.
- Propose
Least privilege, per finding
A read-only tool split from a refund tool, short-lived tokens instead of permanent ones, an allow-list instead of any shell command, a pinned MCP server. Each one is a proposal for the owning team.
- Brief
What to fix first
The worst blast radius in money, the fixes in order, the guardrails already working, and a 30-day plan with owners.
Where it runs
- In your environment
- · Reads configs, manifests and the identity export with read-only access. Nothing leaves.
- Masked first
- · Secrets and personal data are masked before any model or person sees them.
- Your policy
- · Sensitivity levels, weights, trusted publishers and what counts as approval are yours, written down.
- People decide
- · Every scope change, revoked token and approval gate is a proposal until its owner accepts it.
On your data
The demonstration above runs on a fictional company. On yours, the agent runs inside your environment with read-only access. Design partners can pilot it on their own data.
The engagement
Agent GuardTested inventory in 1 week; fixes in 2–3; re-tested every quarter
- 1 · Days 1–2
Connect
- Agents
- Read agent configs, MCP server lists, CI manifests and the identity export.
- Our people
- Deploy, mask every secret, and agree which agents may be tested.
- Your people
- Grant read access and name an owner per agent.
- 2 · Week 1
Inventory and test
- Agents
- Inventory every agent, rank blast radius, run injection tests in a sandbox.
- Our people
- Judge real leaks from refusals and agree the fix list.
- Your people
- Confirm what each agent is for.
- 3 · Weeks 2–3
Fix
- Agents
- Draft least-privilege configs and re-test them.
- Our people
- Our program manager pushes fixes in blast-radius order.
- Your people
- Rotate tokens, narrow scopes, add approvals.
- 4 · Every quarter
Watch
- Agents
- Re-run the inventory and tests; flag new agents.
- Our people
- Train your platform team; quarterly report.
- Your people
- Own the agent register.
What agents don’t speed up: Replacing long-lived tokens in systems that cannot use short-lived credentials yet.
What you keep
- Agent register
- Every agent, its tools, credentials and owner.
- Least-privilege configs
- Reviewed and merged by your engineers.
- Injection test suite
- Re-run on every change.
- Agent runbook
- Who approves what an agent may do.
- Accuracy record
- Every verdict and every override, logged. Planted-answer scores on every run.
Questions
Which agents can it find?
· Anything with a config it can read: coding assistants and their MCP servers, agent platforms, chatbots, CI and scheduled jobs, plus the tokens in your identity provider. A new kind of agent is a reader, not a rebuild.
Does it attack our production systems?
· No. Injection tests run against a test environment with planted records, and the results are recorded and scored. The inventory itself only reads.
What is the "lethal trifecta"?
· An agent that reads private data, takes in content an outsider can write, and can act or send data out. Any two are manageable. All three mean one crafted email or web page can steer it, so we flag it by name and propose which leg to remove.
Will it change our permissions?
· It proposes; your teams change. Each finding comes with the narrower scope, the approval gate or the replacement credential, ready for the owner to accept or reject.