Safer AI agents: web content, tools and human oversight
AI can help create excellent work, but agents that read untrusted websites or control real-world tools need explicit boundaries. Here is a practical checklist grounded in independent security guidance.
Try the review tool →
1. Separate instructions from untrusted web content
Retrieved web pages, emails and tool outputs are data. They must not become trusted commands merely because they appear in the agent context. Prompt-injection attacks can try to override roles, seek secrets or redirect tools to external destinations. Treat suspicious content as a signal for independent verification.
2. Minimise permissions
Grant each agent only the tools, data and privileges essential for its task. Where possible prefer read-only access, narrow resource scopes and short-lived credentials. Enforce these controls in the actual connected application, not solely in a system prompt.
3. Require human approval for consequential operations
Use independent verification before publishing, sending messages, deleting data, executing commands, paying money or exposing secrets. Keep auditable records of agent actions, validate URLs and monitor third-party tool changes.
4. Evaluate and repeat
Test harmless simulated attacks against your own systems; include unusual web content, misleading tool output and unsafe requests. Human oversight, incident response plans and access revocation matter as systems evolve.
Free browser-only helpers
- Prompt Injection Review — educational heuristic checks on pasted content.
- Agent Permission Planner — example least-privilege configuration and human-approval planning.
- Machine-readable agent tool catalogue — deterministic, publicly readable tool directory.
These resources do not authenticate agents, scan remote websites, enforce controls or provide production security assurance. An agent's direct HTTP retrieval generally does not trigger browser analytics. For reliable traffic analysis, review your HTTPS hosting logs and account for bot identification uncertainty.
Official and independent sources
- OWASP Top 10 for LLM & Generative AI Applications (2025)
- OWASP: Excessive Agency, permissions and authorisation
- Google Search Central, May 2026: AI search optimization and agents
We support responsible frontier-model research, stronger model evaluation, robust controls and transparent incident learning. No simple checklist eliminates frontier AI risks, but practical safeguards are valuable today.