AI agent security dictionary

A document stating what employees may and may not do with company systems, including AI tools.

Stopping an agent from doing more harm: ending its run and processes, revoking its credentials, blocking connections and disabling tools.

The program around a model that gives it tools, runs its tool calls, manages context and enforces permissions.

Taking over what an AI agent is doing so it works for an attacker, usually through injected content in something it reads.

A script an agent runs at a defined moment, such as before a tool call, so something outside the model can inspect, change or block what is about to happen.

A distinct identity for an AI agent, separate from the user who sponsors it, so its actions can be attributed, scoped and revoked.

The repeating cycle in which a harness shows context to a model, receives a tool call, runs it and feeds the result back.

An agent event that could plausibly have become an incident but was caught or harmless this time.

An installable bundle that can add skills, hooks and MCP or language-server configuration to a coding agent.

A short blameless write-up after an incident: timeline, cause, what worked, what did not and what changes.

A packaged set of instructions, and sometimes scripts, that an agent loads to learn how to do a specific task.

A short written map of what an agent deployment protects, what can influence the agent, what it can do and how you would notice trouble.

A line where text or authority passes between zones that deserve different levels of trust, such as from a web page into an agent or from an agent into a shell.

Hijacking a coding agent by planting instructions in data it reads through a trusted integration, such as a public error-reporting key.

Recording and analyzing what AI agents actually do (commands, files, network calls, tool use) to spot risky or unexpected behavior.

The policies, roles and controls an organization uses to manage how AI is adopted and used.

The practice of making AI systems behave as intended and avoid causing harm, including by their own mistakes.

An inventory of the AI parts of a system: models, datasets, agents, tools, MCP servers and their versions.

When too many low-value alerts train people to stop paying attention to them.

Two ways to filter actions: an allowlist permits only what is named, a denylist blocks only what is named.

A secret string that identifies and authorizes a program calling a service.

What an approval is attached to: a name or path that can change under it, or a fingerprint of the exact content that was reviewed.

The decline in scrutiny a person gives to approval prompts as their number grows.

The point in an agent loop where a proposed tool call is allowed, denied or sent to a human before it runs.

Address space layout randomisation: the operating system places a program's regions at different addresses on each run.

Anything of value that security work exists to protect, such as data, accounts, money or uptime.

Everything an attacker could try to reach or influence: open ports, web pages, accounts, and installed software.

A tamper-resistant record of who did what, when and where in a system.

Proving who you are to a system, usually with a password, a code or a key.

A flaw that lets someone be treated as logged in without proving who they are.

Deciding what an identified user or program is allowed to do.

The goal that systems and data work when someone needs them.

A credential accepted from whoever presents it, usually in an Authorization header.

How much can be affected if one component fails or is compromised.

A model or rule engine that reviews each agent action before it runs and can deny it.

A large group of compromised devices controlled together by an attacker.

Writing more data into a fixed-size block of memory than it can hold, so the extra lands in neighbouring memory.

A signed record of where and how an artifact was built, so you can verify it came from the expected source and pipeline.

A fake secret or marker planted on purpose, so that any appearance of it reveals unwanted reading or leaking.

Turning a name or path into its single, fully resolved form before checking it.

An organisation trusted to vouch that a public key belongs to a given website, by signing a certificate for it.

The sequence of certificates from a website's own certificate, through intermediate CAs, up to a root your device already trusts.

Telling clients to stop trusting a certificate before its expiry date, because its key was exposed or it was issued wrongly.

Public, append-only logs where certificate authorities must record the certificates they issue so that misissued ones can be spotted.

A short fingerprint computed from a file that changes if the file changes.

A process started by another process, which inherits its owner and environment.

Automated machinery that builds, tests and often publishes software every time code changes.

The temporary machine on which a CI pipeline's jobs execute, with whatever secrets the job is given.

A credential made available to a build job, such as a package-publishing token, a cloud key or a deploy key.

The model that says security protects three goals: confidentiality, integrity and availability.

The habit of recording separately what an attacker or rumour says happened and what the affected company or independent researchers have confirmed.

Instructions placed where a model reads them but a person does not, such as white-on-white text, HTML comments, zero-width characters or metadata.

A special internal address inside cloud servers that hands out details about the machine, sometimes including temporary credentials.

An AI tool that reads a codebase, edits files and runs commands to complete programming tasks with limited supervision.

A text interface where you type commands for the computer to run and read its replies.

A safeguard that lowers the chance of harm when you cannot fix the underlying flaw.

The goal that only the people and programs that should see information can see it.

A program with real authority gets tricked into using that authority for someone who should not have it.

A group of ordinary processes given a private view of files, processes and network by the host kernel.

Actions that stop an incident from growing while keeping the evidence needed to understand it.

A response header that tells the browser which sources of script, images and frames a page may use.

Summarizing an agent's long working context so it can keep going; the summary becomes what the agent believes about the task.

The limited amount of text a language model can see at once when it decides its next output.

A benchmark task where an action that looks dangerous is explicitly authorized, so a good agent must do it.

An action or stretch of activity that a monitor never sees, so it cannot be caught however good the monitor is.

Keeping secrets outside the environment an agent runs in and attaching them to approved requests at an outside gateway.

Replacing a credential with a new one and revoking the old, either on a schedule or after exposure.

Trying email and password pairs leaked from one site against many other sites.

A flaw where a web page includes untrusted input in a way that lets a visitor's browser run it as script.

A unique public identifier, like CVE-2026-12345, assigned to a specific known security vulnerability.

A standard 0 to 10 score of a vulnerability's technical severity.

A catalog of types of software weakness, like SQL injection or path traversal, that vulnerabilities fall into.

A pointer that still holds the address of memory that has been freed.

A framework feature that copies request fields automatically into the properties of an object.

Moving data out of a protected environment to somewhere an attacker controls.

Collecting and keeping only the data you need for a stated purpose.

A contract in which a vendor agrees how it will handle personal data on your behalf.

Requirements about the country or region where data is stored and processed.

Malware logic that does something destructive if the attacker loses access, for example if a stolen token is revoked.

A policy where everything is blocked unless a rule explicitly allows it.

An attack that makes a service unavailable by exhausting a resource it needs.

An attack that drives up the target's usage bill, such as tokens or API calls, until it hurts, rather than taking the service offline.

A piece of code written by someone else that your project needs in order to run or build.

Tricking a build into fetching a public package with the same name as an internal one, usually by publishing it with a higher version number.

Rebuilding a program's objects from stored or transmitted bytes; unsafe when the bytes come from an untrusted source.

A shell or database command that deletes, overwrites or exposes data in a way that is hard to undo, such as rm -rf, a forced git push or DROP TABLE.

A defined pattern that flags a risky action, such as reading an SSH key or running a recursive delete.

Tools and policies that detect sensitive data and stop it from leaving where it belongs.

The internet's phone book: it turns a name like agentbeam.com into the IP address to connect to.

One fact stored about a name, such as its IP address, an alias, or its mail server.

The server that looks up a name on your behalf and remembers the answer for a while.

Running a command in a mode that reports what it would change without changing anything.

A router, firewall, VPN gateway, switch or similar device that sits at a network boundary or faces the internet.

Software on laptops and servers that watches for malicious behavior and can isolate a machine.

Restricting which outside hosts and ports a machine, container or agent may connect to.

The point at which maintainers stop releasing fixes, including security fixes, for a version.

Software its vendor no longer updates, so new flaws in it will never be fixed.

The written list of systems, accounts, data and time window a security test may touch; everything else is out of bounds.

A plain text file of environment variables, often holding API keys and database passwords for local development.

A named setting a process receives when it starts, passed on to every child it starts.

A score from FIRST estimating the probability that a CVE will be exploited in the wild in the next 30 days.

The EU regulation that sets obligations for AI systems based on their level of risk.

When an AI agent has more tools, permissions or autonomy than its task needs, so any mistake or attack can do outsized damage.

A technique or program that takes advantage of a vulnerability.

The time from when a flaw is known to when a system is actually fixed.

A design in which a control that cannot work, because policy is missing, expired or unreachable, lets the action proceed.

What a control does when it cannot work: fail-open lets the action through, fail-closed blocks it.

An alert or block triggered by harmless activity.

Rules saying who may read, write or run a file: its owner, its group, or everyone else.

A set of rules that allows or drops network traffic based on details such as address and port.

The European Union's data protection law, governing personal data of people in the EU.

An advisory id from GitHub, like GHSA-xxxx-xxxx-xxxx, covering vulnerabilities in open-source packages.

A secret that was committed once and stays retrievable from older commits after being deleted.

A CI flaw where attacker-controlled text, like an issue or branch name, is placed straight into a workflow's shell command and runs as code.

A password, key or token written directly into source code or a config file that is committed.

Locking a dependency, plugin or container image to a cryptographic hash so only the exact reviewed content is accepted.

The region of memory for data that must outlive a single function, which the program requests and releases itself.

The nickname for CVE-2014-0160, an OpenSSL bug that let a remote client read chunks of a server's memory.

Evaluation tasks kept private until testing, so a model cannot have learned them from public data.

A fake system or credential placed to attract attackers and alert defenders when touched.

The request-and-reply language of the web: a client asks for something, a server answers with a status and content.

A Name: value line in a request or reply that describes it, such as who is asking or what type of content follows.

The first word of an HTTP request, saying what the client wants to do: fetch, send, replace or remove.

A design where a person confirms certain agent actions before they run.

Returning an object because a request named it, without checking the requester may see it.

Copying the logs, files and configuration of an incident to a store the affected system cannot change, before cleanup or rebuilding.

The process of detecting, containing, investigating and recovering from a security incident.

A clue that a system was breached, such as a malicious file hash, domain or IP address.

Prompt injection where the malicious instructions are hidden in content the agent fetches, such as a web page, email, issue or tool result, rather than typed by the user.

A bug where untrusted data is mixed into a command or document and gets interpreted as instructions instead of plain data.

Checking that incoming data matches what the program expects (type, length, range, allowed values) before using it.

Code a package manager runs automatically when a package is installed, such as npm's postinstall.

The goal that information and systems are correct and have not been changed by anyone who should not change them.

The number that identifies a device on a network, so data knows where to go.

An international standard for running an information security management system, certified by an external auditor.

Recording which authorization server issued a credential and refusing to send it to any other.

A prompt crafted to get a model to ignore its safety training and produce output it was built to refuse.

A signed token with a header, a payload of claims and a signature, separated by dots.

The core of the operating system, which controls memory, processes, files and hardware for every program.

CISA's catalog of vulnerabilities with confirmed exploitation in the wild.

A control that immediately halts an agent or revokes its access.

An attacker moving from the first machine they reach to others on the same network.

Giving a person, program or agent only the access it needs for its task, and nothing more.

Using stolen cloud or AI API credentials to run large language models at the victim's expense.

A design where data is processed and kept on the user's own machine, and only what is necessary leaves it.

The address that always means this machine itself, so traffic to it never leaves the computer.

A file that records the exact version, and usually a hash, of every dependency so installs are repeatable.

Sending logs from many machines to one separate place as they are written.

A text record a program or operating system appends to, usually one line per event with a timestamp.

A tag on each log line showing how important it is, such as INFO, WARN or ERROR.

The December 2021 flaw in the Apache Log4j logging library, where logging a crafted message could make a server load and run remote code.

The first few bytes of a file that identify its real format, such as the PNG signature.

Taking over the registry or source-hosting account of someone allowed to publish a package, then publishing a malicious release as them.

A published library that contains code meant to steal data, install malware or damage the systems that use it.

An attacker who sits between two parties and can read or change what passes between them.

Slipping a malicious MCP server entry into a repository's config so opening the project makes the agent run attacker-chosen commands.

A tool server that behaves well when you approve it and later changes its tools or descriptions to something malicious.

A program that exposes tools and data to an AI agent over the Model Context Protocol.

Tools IT uses to configure, secure and monitor company laptops and phones from a central console.

Planting false or malicious content in an agent's long-term memory or instruction files so it keeps influencing later sessions.

A language that prevents out-of-bounds access and use of freed memory, by checks at run time or rules at compile time.

Requiring a second proof of identity, such as a hardware key or authenticator code, in addition to a password.

Spamming a user with approval prompts until they tap Approve to make them stop.

A very lightweight virtual machine with its own kernel that starts quickly, used to isolate untrusted or agent-run code.

An open protocol that lets AI applications connect to external tools and data sources through a standard interface.

Two ways to apply a security rule: monitor only records and alerts, block actually stops the action.

The share of an agent's actions that a monitor actually sees, as distinct from how accurately it judges the ones it sees.

Dividing a network into zones and allowing traffic between zones only where it is needed.

A voluntary US framework from NIST for managing AI risk, organized around govern, map, measure and manage.

A protection that marks data regions so the processor will not run their contents as instructions (DEP or NX).

Any identity used by software rather than a person: service accounts, API keys, tokens, certificates and AI agents.

A standard that lets an app act on a user's behalf with limited, revocable access, without handing over the user's password.

The software that shares a computer's processor, memory and files between programs and decides what each may touch.

A flaw where input reaches a shell command line and adds commands of its own.

Reading memory beyond the end of the block a program was meant to use, leaking whatever sits next to it.

Converting characters that have special meaning in a context (such as < in HTML) into harmless text before inserting data there.

A public or private service that stores published packages and hands them out by name and version, such as npm or PyPI.

Malicious package code that steals publishing credentials from each victim and uses them to infect more packages automatically.

A small labelled chunk of a message, sent across a network on its own and reassembled at the destination.

A database query whose structure is fixed up front, with user values supplied separately as data.

A login credential made of a key pair that lives on your device and signs in only for the real site address.

A one-way fingerprint of a password that a site stores instead of the password itself.

A tool that generates and stores a unique strong password for every account behind one strong passphrase.

A software update that fixes a vulnerability or bug.

Using sequences like ../ in a file path to reach files outside the folder an application meant to expose.

A harness setting that decides how much an agent may do before a human is asked.

Information that can identify a person, such as a name, email, phone number, ID number or location.

Checking, after fetching code, that what you actually received matches the identifier you pinned.

A variable whose value is a memory address, saying where some data lives instead of holding the data.

An organization-wide floor of rules, plus stricter additions for particular people or teams that can never loosen the floor.

An organisation-wide policy that sets a floor, plus per-person or per-team overrides that may only add restrictions.

A numbered door on a machine, where one specific service listens for connections.

A written review after an incident covering the timeline, root causes and concrete fixes, without assigning blame.

The slow build-up of access rights beyond what a person or program currently needs.

Gaining more access than was granted, for example from a normal user to admin, or from one service to another.

A program that is currently running, with its own memory and the permissions of whoever started it.

The number the operating system uses to refer to one running process.

Recording the prompts and responses of AI interactions for debugging, observability or audit.

An attack where text the model reads is written to override its instructions, so it does what the attacker wants instead of what the user or developer asked.

Code or steps that demonstrate a vulnerability can really be exploited.

A precomputed lookup of common passwords and their hashes, defeated by per-account salts.

Capping how many requests a client may make in a window of time.

Controlling access by assigning people to roles, where each role carries a defined set of permissions.

Deliberately attacking your own system, as an adversary would, to find weaknesses before real attackers do.

Removing or replacing sensitive values, like keys or personal data, before text is stored or sent.

A setting that stops a published release from being edited or having its files replaced after it goes out.

A flaw that lets an attacker run their own code on someone else's machine from a distance.

Reporting a vulnerability privately to the vendor and giving them time to fix it before going public.

The saved note on the stack that tells a function where to continue when it finishes.

How likely harm is and how bad it would be, given the threats, the weaknesses and the value at stake.

The all-powerful account on a machine that ignores almost every permission check.

The agreed ground rules for an authorized security test: allowed techniques, data limits, stop conditions and who to contact.

A written, step-by-step procedure for handling a specific situation.

The share of all scored trials in which the agent both stayed within its safety boundary and finished the task.

A random value stored beside each password hash and mixed into it so identical passwords give different hashes.

An isolated environment, such as a container or micro-VM, where an agent runs with limited access to files, network and credentials.

Breaking out of an isolated environment to reach the host system or other tenants.

A machine-readable list of the components and dependencies inside a piece of software.

A standard for automatically creating, updating and removing user accounts across services from a central directory.

A credential limited to specific resources and actions, such as read access to one repository.

Automatically searching code, logs and other text for credentials such as API keys and private keys.

Credentials scattered across code, config files, logs, tickets and chat tools, where they are hard to track and easy to steal.

An event where confidentiality, integrity or availability was actually harmed or credibly threatened.

A small text file at /.well-known/security.txt telling researchers how to report a vulnerability to you.

A convention that writes versions as major.minor.patch, where patch is for fixes, minor adds features and major may break compatibility.

Splitting a sensitive process across roles so no single person can both perform an action and approve or audit it.

A detection that fires when related events occur in a particular order in one session, such as a credential read followed by network use.

Turning a program's in-memory objects into bytes or text so they can be stored or sent.

A non-human account that software uses to authenticate to other systems.

A cookie holding the random ID that tells a site you are already logged in.

A permission that makes a program run with its owner's rights, usually root, no matter who starts it.

Employees using AI tools or agents that the company has not approved or does not know about.

The program that reads typed or scripted commands and runs them, such as Bash or zsh.

The file where a terminal records the commands you typed.

Characters the shell reads as instructions instead of text, such as ; | & $ and backticks.

The nickname for CVE-2014-6271, a Bash flaw where text after an exported function in an environment variable was run as commands.

Credentials that expire after minutes or hours, so a stolen one stops working quickly.

A platform that collects logs from across an organization, correlates them and raises security alerts.

A short message the operating system sends to a process, such as a request to stop.

Registering package names that AI models tend to hallucinate, so that a developer or agent who installs the made-up name gets malware.

The team, and often the room, that monitors an organization for threats and responds to them.

An audit report, from an independent CPA, on how a company controls security and related criteria.

Tooling that lists the dependencies in a project and checks each name and version against databases of known vulnerabilities and known malware.

An attack that compromises code, tools or services you depend on, so the malicious change reaches you through a trusted channel.

A 2022 flaw in the Spring Framework where request data binding could be abused for remote code execution in certain deployments.

A flaw where user input is pasted into a database query and changes what the query means.

Letting people sign in to many services with one company identity provider, using standards like SAML or OpenID Connect.

Making a server send requests to places the attacker chooses, often internal services or cloud metadata endpoints.

The region of a process's memory that holds each running function's local variables and return note, added and removed automatically.

A secret value the compiler places between a buffer and the return address and checks before a function returns.

A file the language runtime runs automatically every time it starts, before your own code, such as a Python .pth file or sitecustomize module.

The number in an HTTP reply that says whether the request succeeded, moved, was refused, or broke the server.

An MCP connection where the agent launches the server as a local subprocess and talks to it over standard input and output.

A command that runs one other command with root's rights after checking you are allowed to.

A log whose entries are linked by hashes so that editing an earlier entry is detectable.

The set of files, systems and effects an agent's task actually justifies, as opposed to everything its permissions let it reach.

The rules that make a stream of packets arrive complete and in order, by numbering pieces and resending lost ones.

Data a system emits about its own activity, such as events, metrics and traces.

A person or group that attacks systems, with a goal such as money, data, disruption or access.

A short written answer to: what are we protecting, who might attack it and why, how, and what will we do about it.

The encryption layer that makes HTTP into HTTPS, hiding traffic from machines along the way and checking the server's certificate.

A signed public document that binds a server's name to its public key.

A structured request from a model to run a specific tool with specific arguments, such as running a shell command or reading a file.

An attack that hides malicious instructions in a tool's name, description or schema, which the agent reads as trusted guidance.

A malicious MCP server redefining or steering another server's tools, exploiting the fact that all servers share one context window.

A six-digit code computed from a shared secret and the current 30-second time step.

A harmful sequence made of individually harmless tool calls, such as reading private data and then calling an outbound tool.

A dependency you never asked for by name, pulled in because one of your own dependencies needs it.

A line in a system diagram where the level of trust changes, such as between a user's browser and your server.

The dialog an agent shows when opening a project, asking whether to trust the folder's configuration before running anything it defines.

The list of root certificates a device, browser or program accepts as starting points for trusting a certificate.

A registry feature that accepts a release from a specific CI workflow, proven by a short-lived identity, instead of from a long-lived token.

How long, in seconds, a DNS answer may be cached before it must be looked up again.

Publishing a malicious package whose name is a small misspelling of a popular one, hoping someone installs it by mistake.

A flaw where a site accepts an uploaded file without limiting its type, name or destination, so the file is used in a harmful way.

Any data your program did not create itself: form fields, URLs, file names, uploads, API replies, and text an AI agent reads.

Using a block of memory after it has been released, by which time it may belong to something else.

An identity the operating system recognises, with a name, a numeric ID, a home folder and group memberships.

The set of versions an advisory says contain a flaw, such as at least 0.7.3 and less than 0.31.0.

A software-imitated computer, run by a hypervisor, with its own kernel separate from the host's.

The private view of memory each process gets, so one process cannot read another's by default.

A weakness in code, configuration or process that could be used to cause harm.

The folder a web server publishes: files inside it can be fetched, and sometimes run, by anyone who can request them.

Malware that copies itself to other machines automatically, without anyone running it.

An attack chain in which an agent is persuaded to write a configuration file that its own runtime then trusts and executes.

An arrangement where an AI provider does not store prompts or outputs after processing a request.

A vulnerability attackers use before the vendor has had a chance to ship a fix.