How to Stop AI Agents from Attacking You: A Practical Security Playbook

Why AI Agents Change the Security Game

A traditional attacker gets tired, makes typos and can only work on a handful of targets at once. An AI agent does not. Agents are programs that can plan a goal, browse the web, call tools, write code and keep trying until they succeed. That makes them brilliant assistants — and, in the wrong hands, tireless attackers.

In my earlier posts I looked at the AI-vs-AI arms race in the cloud and at how agents are used against government. This article is the practical follow-up: a defence playbook you can actually apply, whether you run a small business, build software or simply want to keep your own accounts safe.

> This guide is written for defenders. It explains attacks only at a high level and focuses on prevention.

---

The Four Ways AI Agents Attack

1. Speed-run reconnaissance

Agents can map a company in minutes: staff names from social media, email formats, exposed login pages, old subdomains, leaked passwords and outdated software versions.

2. Personalised phishing and voice fraud

Every message can be unique, written in the right tone and referencing real projects or colleagues. Voice cloning adds convincing "urgent call from the boss" scams.

3. Automated probing and credential stuffing

Agents hammer login forms with leaked passwords, test forms for weaknesses and adapt their behaviour when blocked — rotating addresses and slowing down to look human.

4. Hijacking your AI agents

This is the newest threat. If you use an AI assistant that reads emails, web pages or documents, an attacker can hide instructions inside that content — a technique called prompt injection. The assistant may then leak data, send messages or take actions you never asked for.

---

Layer 1: Lock the Front Door (Identity)

Most AI-driven attacks still end at a login screen. Make it the hardest part to beat.

• Use passkeys or phishing-resistant multi-factor authentication (security keys, authenticator apps). SMS codes are better than nothing but can be intercepted.
• Never reuse passwords. A password manager makes this painless and defeats credential stuffing.
• Limit login attempts and add increasing delays after failures.
• Alert on unusual sign-ins — new country, new device, impossible travel.
• Remove old accounts when staff or contractors leave.

---

Layer 2: Shrink What an Attacker Can See

Agents are only as good as the information they can gather.

• Audit your public footprint: forgotten test sites, old admin pages, public file links and exposed documents.
• Keep software updated. Agents scan for known weaknesses first because they are the cheapest win.
• Hide version numbers and detailed error messages from public pages.
• Review what staff share publicly about internal tools and processes.

---

Layer 3: Detect and Slow Down Automated Traffic

You cannot block every bot, but you can make attacks expensive.

• Rate-limit logins, sign-ups, contact forms, search and any costly feature.
• Use a web application firewall or bot-management service that scores behaviour, not just IP addresses.
• Watch for patterns humans do not make: hundreds of form attempts, perfectly regular timing, or crawling every page in order.
• Protect expensive actions (sending email, generating AI content, creating accounts) with extra checks so attackers cannot run up your bills.

---

Layer 4: Make Your Own AI Agents Safe

If your business uses AI assistants or builds them into products, treat them like a new employee who is helpful but very easy to trick.

• Least privilege. Give an agent only the access it truly needs. An assistant that summarises emails should not be able to send money or delete files.
• Treat everything the agent reads as untrusted. Web pages, emails, PDFs and user uploads can all carry hidden instructions.
• Human approval for high-impact actions. Payments, deleting data, sending external emails and changing permissions should require a person to click "approve".
• Enforce rules outside the AI. Never rely on a prompt saying "do not share customer data". Put the real limits in the system itself — permissions, database rules and allow-lists of websites the agent may contact.
• Keep secrets away from the model. API keys and passwords should live on the server, never in the conversation.
• Log every action the agent takes so you can review and roll back.
• Test it like an attacker would — try to trick it before someone else does.

---

Layer 5: Train People for AI-Era Scams

Technology helps, but people remain the final checkpoint.

• Verify urgent requests through a second channel. If "the CEO" calls asking for a transfer, hang up and call back on a known number.
• Agree on a family or team code word for emergencies to defeat voice clones.
• Slow down when a message creates pressure. Urgency is the attacker's favourite tool.
• Report, do not just delete. One reported phishing email can protect the whole team.

---

Layer 6: Plan for the Day Something Gets Through

Assume a breach will eventually happen and make it small.

• Back up important data and keep at least one copy offline. Test restoring it.
• Separate systems so one compromised account cannot reach everything.
• Write a simple incident plan: who to call, how to lock accounts, how to tell customers.
• Use AI for defence too. Modern security tools use AI to spot unusual behaviour faster than any human team.

---

A Quick Checklist

---

Final Thoughts

AI agents do not invent brand-new kinds of attack so much as run old ones faster, cheaper and at enormous scale. The good news is that the same fundamentals still win: strong identity, a small attack surface, sensible limits, careful permissions for your own AI, alert people and a tested recovery plan.

Build those layers now, and an attacking agent will find you a slow, expensive and unrewarding target — exactly what you want to be.