To protect an AI agent (an AI model that uses tools to act), put controls between the agent and your systems, not inside the model. Check every call for prompt injection, and strip secrets and personal data. Limit what the agent can send or do, and cap its budget. Record every action in a log that nobody can quietly edit. Below are the eight attacks that matter most for apps built on large language models (LLMs), and the fix for each one.
Why do AI agents need their own security?
Modern agents need deep access to be useful: your data, your internal APIs and the ability to act on their own. Traditional security covers people and fixed software. It does not cover a system that reads untrusted text and then decides what to do. Pavii, our security gateway for AI agents, closes that gap. The diagram above shows its six gates.
1. Prompt injection
An analyst asks an agent to summarise a vendor PDF. The PDF hides instructions that tell the agent to send data elsewhere. Fix: treat untrusted text as data, never as instructions. Pavii flags the injection, and a smart contract (a program on a blockchain) hard-stops it.
2. Sensitive data leaks
Agents copy customer data or API keys into prompts and outputs. Fix: a privacy gate that redacts personal data and secrets (replaces them with placeholders) before any model sees them.
3. Supply-chain attacks
An agent installs a package or connects a new MCP server (a service that gives an agent tools). The package or server turns out to be malicious. Fix: allow-lists, pinned hashes (fixed fingerprints of each version), a sandbox (an isolated place to run code), or human approval for anything new.
4. Unsafe output
Agent output contains scripts or secrets that end up in a web page or email. Fix: remove them before delivery.
5. Excessive agency
An agent can do far more than its task needs. Fix: an egress policy (rules for outgoing actions) that decides what the agent can send or do. In Pavii, that policy is a smart contract on the Hyper 0X blockchain, so nobody can quietly change it.
6. Runaway cost
A loop or an oversized context (the text that the model reads) burns through tokens (the units of text that you pay for). Fix: budgets and context compaction (a smaller context for each call). On a measured Claude Code task, Pavii used 30 to 60 percent fewer tokens.
7. Rogue agents
An agent continues to misbehave after warnings. Fix: graduated trust (limits that grow step by step). The controls first watch the agent, then restrict it, then halt it. A human always has a kill switch.
8. Log tampering
A coding agent runs rm -rf logs/. Fix: hash-chained logs anchored on a blockchain. In a hash chain, each entry holds a fingerprint of the entry before it. The fingerprint on the blockchain shows exactly what is missing. Proof of execution explains this idea: a receipt for every action.
Where should you start?
- List every agent and every system it can reach.
- Route all agent traffic through one gateway (a single checkpoint for all agent calls).
- Turn on injection detection and data redaction first. They stop the most damage.
- Add egress rules and budgets for each agent.
- Make logs tamper-evident (so that any change shows). Then audits and disputes have one record.
Pavii is under development. It is designed to do all five, with receipts on Hyper 0X. Book a call to learn more.
Architecture in detail
Frequently asked questions
What is the biggest security risk for AI agents?
Prompt injection. An attacker hides instructions in a web page, a file or tool output. The instructions trick an agent into a data leak or into actions that it must not take. Treat all untrusted text as data, never as instructions.
How do you audit what an AI agent did?
Record every agent action as a signed, hash-chained log entry. Then anchor the chain on a blockchain. If someone edits or deletes any entry, the gap is visible.
Which agents can be secured this way?
Any agent: Claude, Claude Code, Codex, ChatGPT, Grok, OpenCode or custom agents. The controls sit between the agent and your systems, not inside the model.
