AI Agent Security Checklist For 2027

AI agents are no longer experiments. They read company email, write and run code, query databases and call business tools through MCP. Each of those abilities is useful, and each is a way for a mistake or an attacker to cause real damage. This checklist brings together the controls security and platform teams should have in place before agents get access to anything that matters, organized so you can work through it in order.

Use it as a starting point and adapt it to your risk. A team running one internal research agent needs less than a bank letting agents act on customer accounts.

1. Inventory Every Agent

• List every agent in use: coding agents on laptops, assistants in Microsoft 365 or Google Workspace, agents built in low-code platforms and agents your developers have built.
• Record what each agent can reach: data sources, tools, MCP servers and outside services.
• Repeat discovery regularly. Agents appear faster than anyone files a request.

Discovery tools from our lists of AI agent identity and access management platforms and security tools for AI coding agents make this practical at scale.

2. Give Every Agent An Identity And An Owner

• Each production agent gets its own non-human identity rather than borrowing a person’s session or a shared service account.
• Each agent has a named human owner accountable for its behavior and access.
• Agents are included in access reviews and offboarded when their purpose ends.

3. Apply Least Privilege

• Grant only the tools and data each task needs, and prefer read-only access.
• Use short-lived, task-scoped credentials instead of long-lived API keys.
• Separate agents that read untrusted content from agents that act on sensitive systems.
• Remove any write permission without a documented use case.

4. Require Approval For High-Impact Actions

• Define which actions need a human: sending external messages, moving money, deleting data, changing permissions, deploying code.
• Enforce approval in the tool or gateway, not just in the prompt.
• Log who approved what and when.

5. Vet Tools, Plugins And MCP Servers

• Approve MCP servers, plugins and skills through an allow-list with pinned versions.
• Prefer official servers from the vendor that owns the system.
• Audit each one before approval using our guide on how to audit an MCP server.
• Route tool traffic through one of the MCP gateways we compare.

6. Defend Against Prompt Injection

• Treat all external content, including web pages, emails, documents, issues and tool outputs, as untrusted.
• Screen inputs and outputs with guardrails or an AI firewall.
• Avoid combining private data access, untrusted content and outbound communication in one agent without strong controls.

Our guide on what prompt injection is explains the threat, and our comparison of AI guardrails vs AI firewalls vs AI gateways shows where each control fits.

7. Control Data Flows

• Strip or mask personal and sensitive data before it reaches a model where it is not needed.
• Restrict which external domains agents can contact.
• Check outputs for secrets, credentials and sensitive records before they leave.
• Confirm model providers’ data retention and training terms meet your obligations.

8. Isolate Execution

• Run agent-generated code in sandboxes with restricted file and network access, not on shared machines.
• Keep production credentials out of the environments where agents experiment.
• Use deny-by-default networking for agents that execute untrusted code.

Our list of AI sandboxes for coding agents compares options.

9. Secure Coding Agents On Developer Machines

• Inventory coding agents and the MCP servers and plugins they load.
• Use agent-aware endpoint controls that can block risky commands before they run.
• Review agent-written code with the same rigor as human code, including automated security scanning.
• Prevent agents from disabling their own guardrails.

10. Log, Monitor And Alert

• Record prompts, tool calls, results and approvals with enough detail to reconstruct an incident.
• Alert on unusual behavior: large data reads, new destinations, repeated denied actions or sudden cost spikes.
• Feed agent logs into your existing SIEM and incident process.

11. Test Continuously

• Red-team agents before launch and whenever prompts, models or tools change.
• Include indirect injection, data exfiltration and tool misuse scenarios.
• Use open-source tools from our list of open-source AI guardrails and red teaming tools, or specialists from our list of AI red teaming companies.

12. Prepare For Incidents

• Know how to revoke an agent’s credentials and stop it immediately.
• Keep a runbook for agent incidents: containment, investigation, notification and recovery.
• Rehearse it at least once before you need it.

13. Govern And Document

• Publish an acceptable use policy for AI and agents, and keep it current.
• Map agent use to frameworks such as the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework, and to regulations that apply to you.
• Review the program at least twice a year as tools and threats change.

AI Agent Security Checklist Summary

Conclusion

Securing AI agents is mostly about applying familiar principles, identity, least privilege, isolation, monitoring and testing, to a new kind of actor that can be talked into things. Start with inventory and identity, add approval for the actions that could hurt you most, then layer in tool vetting, injection defenses and monitoring. Revisit the checklist as your agents gain new abilities. For a deeper look at MCP specifically, read our guide on how to secure AI agents and MCP integrations.