Prompt injection, leaked data and agents with too much access are how companies get hurt by AI now. We threat model, build and run AI agents and apps that contain those risks by design, and we run our own company on the same practices.
Last reviewed Reviewed every week against official sources
An AI agent reads email, web pages, files and chat, and it can act on what it reads. Anyone who can put text in front of it can try to steer it. Here is where the risks sit, numbered the way the OWASP Top 10 for LLM Applications numbers them.
Email, web pages, files, chat
The instructions and what it decides
Send, pay, update, delete
Customer records, files, keys
How we defend. Text from email, web pages and files is fenced and handled as data, never as instructions, and the agent cannot act on it without a check in code.
Closed in the buildHow we defend. Agents see only the records their job needs, and answers are screened for secrets and personal data before anyone sees them.
Closed in the buildHow we defend. Models, libraries and plugins come from known sources, pinned to versions we tested, and reviewed before each upgrade.
Shared with the model providerHow we defend. Knowledge an agent learns from is curated and recorded with where it came from, so a planted document can be found and pulled.
Shared with the model providerHow we defend. Whatever a model writes is checked like any untrusted input before it reaches a database, a browser or another system.
Closed in the buildHow we defend. Each agent gets the fewest tools it needs. Anything that sends, pays, signs or deletes waits for a person or a written rule.
Closed in the buildHow we defend. No secret or access rule lives in a prompt. Keys stay in a vault, and permissions are enforced by code.
Closed in the buildHow we defend. Search over your documents respects who may read them, so one customer's files never answer another customer's question.
Closed in the buildHow we defend. Facts an agent states are checked against your records and sources, and it says so when it does not know.
Shared with the model providerHow we defend. Spend limits, rate limits and loop guards on every agent, so a bad prompt cannot run up a bill or drain a service.
Closed in the buildRisk names from the OWASP Top 10 for LLM Applications, 2025 edition; the 2026 edition reranks them, and the threat watch below follows it. No defense makes an AI system unbreakable: these contain the damage when one layer is fooled. The defenses are ours.
Start with a review of what you already run, or have us build the agent with the defenses in from day one.
A review of the AI tools and agents you already run: what they can read, what they can do, where your data goes and who can change them. You get a ranked list of fixes.
Every input an attacker can touch, every action the system can take and every record it can read, mapped and ranked before a line of code is written.
Agents and apps built with the defenses designed in: the fewest tools, a person's approval on anything that cannot be undone, and guardrails tested before launch.
Untrusted text fenced, tool calls checked by code instead of the model's good intentions, and answers screened for secrets and personal data.
Secrets in a vault, never in code or a prompt. A separate, scoped key for every agent. Two-step sign-in for admins. Access you can take back in one step.
Every agent action logged with what and why, alerts on anything unusual, one switch that stops every agent, and a written plan for the day something goes wrong.
Six steps on every AI build, each tied to a function of the NIST AI Risk Management Framework. Govern, the fourth function, is the policy that sits over all of them.
Every input, action and record the system touches, and who could reach each one.
NIST: MapThe fewest tools and the narrowest access each agent's job allows.
NIST: ManageOutside text marked untrusted, and approvals on anything that cannot be undone.
NIST: ManageInjection, leak and misuse attempts run against it before launch, and again after every change.
NIST: MeasureLogs, alerts, spend limits and a drill that proves the alarms still ring.
NIST: MeasureA stop switch, a lockdown, a written runbook and a review after every incident.
NIST: ManageNIST: GovernOur AI policy: who is accountable, how data is handled, and how we prove the system works.
We run HQ Labz on AI agents of our own, so every practice on this page is one we live with every day. It is written as practice, not as a badge.
Where a client needs an outside audit, we prepare the evidence and work alongside their auditor.
Found a security issue in something we built? Tell us.
These are the checklists behind our reviews and builds. We name what we follow, never a seal we have not earned.
The risk list above. Every build is checked against all ten.
Read itThe risks that come with agents that plan and act: goal hijacking, tool misuse, identity abuse.
Read itGovern, Map, Measure, Manage: the four functions our build steps follow.
Read itSecure foundations, detection, automated defenses and fast feedback loops, applied to AI systems.
Read itA catalog of real attacks on AI systems, used to build our threat models and our tests.
Read itThe structure we use for policy, roles, risk and review. It can be audited by an outside body; we follow its structure and have not been through that audit.
Read itNew attacks, guidance and research that change how AI should be built, each with its source and the day we checked it.
Last reviewed Reviewed every week against official sources
Reported by Wiz ResearchWorldwide
A widely used open source gateway for AI models shipped a version that stole browser, cloud and AI keys, downloaded about 49,000 times before it was pulled. Pin every AI library to a version you tested, and keep keys out of reach of your build tools.
Wiz: LiteLLM Compromised, Steals Credentials (opens wiz.io)Checked
Trail of BitsWorldwide
When an AI agent fixes a bug, it can change more than the bug. Review an agent's code changes like a new hire's, with tests that look for what else broke.
Reported by WizWorldwide
Attackers stole cloud logins through a search ad and ran AI models on the victim's bill, into hundreds of thousands of dollars. Spend limits, billing alerts and two-step sign-in on every cloud and AI account cut it off.
NISTUnited States
Security controls from NIST SP 800-53, tailored to AI systems and AI agents. Federal buyers will expect them once they are final.
NIST SP 800-53 Control Overlays for Super Intelligence Systems (opens csrc.nist.gov)Checked
Department of Homeland SecurityUnited States
Federal civilian agencies must remove DeepSeek products and leave them out of purchases. Vendors to those agencies should know which AI models sit inside their products.
Federal Register: Exclusion and Removal of DeepSeek Products (opens federalregister.gov)Checked
MITREWorldwide
The catalog of real attacks on AI systems now covers more ways to attack AI agents, such as discovering what an agent can do at runtime. Useful for threat models and tests.
MITRE ATLAS data, release v2026.09 (opens github.com)Checked
OWASP GenAI Security ProjectWorldwide
The risk list security reviewers use for AI apps, reranked with real incident data. Excessive agency, an agent with more tools and permissions than its job needs, is now number three.
OWASP: 2026 Top 10 for LLM Applications announced (opens genai.owasp.org)Checked
OWASP GenAI Security ProjectWorldwide
An early standard for enforcing rules on AI agents while they run. Worth piloting against; too new for anyone to claim they meet it.
OWASP: Agent Control Standard announced (opens genai.owasp.org)Checked
Trail of BitsWorldwide
A sandbox alone is no longer a safe box for a capable AI agent. Limit what the agent can reach in the first place: its keys, its network and its tools.
Trail of Bits: VMs won't contain cyber-capable agents (opens blog.trailofbits.com)Checked
The White HouseUnited States
Federal prosecutors must prioritize cases against anyone who uses AI, AI agents included, to break into computers or data. Keep records of what your agents accessed and on whose authority.
NISTUnited States
How to fold AI risks into the NIST Cybersecurity Framework most security programs already use. A public draft is the next step.
OWASP GenAI Security ProjectWorldwide
The ten biggest risks of AI agents that plan and act on their own, with mitigations. Use it as the checklist for any agent that can take actions.
OWASP Top 10 for Agentic Applications for 2026 (opens genai.owasp.org)Checked
NISTUnited States
The standard names for attacks on AI, prompt injection and data poisoning among them, and the mitigations for each. It gives teams one vocabulary.
NIST AI 100-2 E2025, Adversarial Machine Learning (opens csrc.nist.gov)Checked
Answer for the AI tools and agents your business runs today. Your answers stay in this browser; nothing is sent.
Answer the questions to see where you stand.
Start with an AI security review or a threat model, or have us build the agent with the defenses designed in. Billed at $100 an hour, with a written quote after a free discovery call.
