Securing Agentic Systems: The Threat Model Beyond Prompt Injection

If you secure agentic systems, focusing on prompt injection alone leaves the broader attack surface exposed, because prompt injection is one threat among several, and the others, the manipulation of the agent’s capabilities, the exploitation of its access, the abuse of its actions, are unaddressed by an injection-focused approach. The full threat model covers the ways an agentic system can be attacked across its whole surface, and securing the system requires addressing them all, not just the injection that dominates the discussion. Understanding the threat model beyond prompt injection is what lets you secure the whole attack surface rather than the one threat that gets the attention.

Why prompt injection is one threat among several

Prompt injection, manipulating the agent through crafted content in its inputs to make it behave against its intent, is a real threat and a prominent one, and it is one part of a broader attack surface. An agentic system can be attacked in ways beyond injection, because the agent has capabilities, access, and actions that are all potential targets, and an attacker can aim at any of them. The agent’s excessive agency is an attack surface, because an over-permissioned agent that is manipulated can be directed across everything it can do, and the agent’s data access is an attack surface, because an agent that can access sensitive data can be exploited to reach it. The agent’s code execution, if it has it, is an attack surface, and its actions are an attack surface, because an agent that takes actions can be manipulated into taking harmful ones.

These are threats beyond prompt injection, and a security approach focused on injection alone does not address them, leaving the agent secured against one threat and exposed at the others. An agent that is well-defended against prompt injection but has excessive agency, broad data access, or uncontained code execution is an agent that an attacker can still exploit through those surfaces, because the injection defence does nothing about the agency, access, or execution that remain exposed. Prompt injection is one threat among several because the agentic system’s attack surface spans the agent’s inputs, capabilities, access, and actions, and injection is the input-manipulation threat, while the others target the capabilities, access, and actions, which an injection-focused approach leaves unaddressed. Securing the agentic system requires the full threat model that covers the whole surface, not just the injection that gets the attention.

The threat model beyond injection

The full threat model for an agentic system covers the ways it can be attacked across its whole attack surface, which spans the agent’s inputs, capabilities, access, and actions. The input surface includes prompt injection, the manipulation of the agent through its inputs, defended by the input controls that guard what enters the agent. The capability surface includes the manipulation of the agent’s capabilities, an attacker inducing the agent to misuse what it can do, defended by bounding the agent’s agency so its capabilities are limited and its misuse is contained. The access surface includes the exploitation of the agent’s access, an attacker reaching data or systems through the agent, defended by scoping the agent’s access so it can reach only what it needs.

The action surface includes the abuse of the agent’s actions, an attacker manipulating the agent into taking harmful actions, defended by the action controls and oversight that limit and check what the agent does. The code execution surface, if the agent generates and executes code, includes the exploitation of the execution, defended by sandboxing. The full threat model identifies the threats across all these surfaces, and securing the system means addressing each, the input threats with input controls, the capability threats with bounded agency, the access threats with scoped access, the action threats with action controls, and the execution threats with sandboxing. This connects to the risk framework, which enumerates the threats so the security addresses the actual attack surface, and to red-teaming, which tests the security across the surface. The threat model beyond injection covers the whole attack surface, and securing the agentic system means addressing the threats across all of it, not just the injection that gets the attention.

The trade-off, and securing the whole surface

Securing the whole attack surface costs more than defending against injection alone, and naming that trade-off keeps the security matched to the threats. Addressing the threats across the input, capability, access, action, and execution surfaces is more security engineering than defending against injection alone, and the security controls constrain the agent, so securing the whole surface trades the engineering and the constraint for the coverage of the whole attack surface. This cost is justified because the alternative, securing against injection alone, leaves the other surfaces exposed, which is where the unaddressed threats can attack, so the cost of securing the whole surface is the cost of not leaving surfaces exposed.

Matching the security to the threats across the surface is the judgment, because the surfaces do not carry equal threat for every agent, and the security at each should match the threat there. An agent with broad access needs strong access security, an agent that executes code needs sandboxing, an agent that takes consequential actions needs strong action controls, so the security investment across the surface should match the threat at each part rather than being uniform or focused on the one prominent threat. The threat model informs this, identifying the threats across the surface so the security addresses the actual threats, and the security is engineered across the surface to the strength each part’s threat warrants. The deeper point is that securing an agentic system requires covering the whole attack surface, and matching the security across the surface to the threats there is what secures the system efficiently, defending each surface to the degree its threat warrants rather than focusing on injection alone. Securing the whole surface, matched to the threats across it, is what secures the agentic system.

Where it almost broke

We reviewed an agentic system whose security focused on prompt injection, well-defended against the injection threat that had received the attention, and the system was exposed at the rest of its attack surface. The agent had excessive agency and broad access that the injection defence did nothing about, so an attacker who found another way to influence the agent, or exploited its access directly, could cause harm through the capability and access surfaces that the injection focus had left unaddressed. The system was secured against one threat and exposed at the others, because the security had focused on the prominent threat rather than the whole attack surface.

The correction secured the whole surface. We addressed the threats across the input, capability, access, and action surfaces, guarding the inputs, bounding the agent’s agency, scoping its access, and controlling its actions, so the whole attack surface was defended rather than just the input surface that injection targets. We matched the security across the surface to the threats there, strong access security for the broad access, strong action controls for the consequential actions. The system became secured across its whole attack surface, because the security now covered the capability, access, and action surfaces that the injection focus had left exposed. The lesson was that prompt injection is one threat among several, and securing an agentic system requires the full threat model that covers the whole attack surface, not just the injection that gets the attention.

Secure the whole surface

The reframe that secures agentic systems is covering the whole attack surface rather than defending against the prominent threat alone. Securing agentic systems requires the threat model beyond prompt injection, covering the input, capability, access, action, and execution surfaces, because prompt injection is one threat among several and an injection-focused approach leaves the rest exposed. An agent secured against injection alone is exposed at the capability, access, and action surfaces where the other threats attack.

The teams that secure agentic systems are the ones that used the full threat model, addressed the threats across the whole attack surface, and matched the security at each surface to the threat there. Prompt injection gets the attention, and it is one part of a broader surface that includes the agent’s agency, access, actions, and code execution, each a point an attacker can target. Securing the whole surface, matched to the threats across it rather than focused on the one prominent threat, is what secures the agentic system, because the attack surface spans more than injection and the security has to cover all of it, not just the threat that gets discussed most.