AI Agent Security: The Threat Model Nobody Talks About

An AI agent with tool access is not just software. It is an actor. It reads files, sends HTTP requests, writes to databases, calls third-party APIs, executes commands, and takes actions with real consequences. In 2025, documented incidents included an agent that exfiltrated customer PII through a prompt injection attack embedded in a user-uploaded document, an autonomous coding agent that overwrote production configuration files after misinterpreting a development instruction, and a customer service agent that was manipulated into issuing refunds it was never authorized to approve. These are not edge cases. They are the predictable consequence of deploying agents without a security model. This post gives you that security model. The Threat Model Before building defenses, understand what you are defending against. The threat model for AI agents has five distinct attack categories. 1. Prompt Injection The most prevalent and most dangerous threat. It occurs when malicious instructions are