Glossary
AI Agent Security,
term by term.
Plain-English definitions of the vocabulary behind securing autonomous AI agents — the attacks, the defenses, and the standards. Written to be accurate first and quotable second.
Attacks
Prompt injection
An attack that embeds instructions in content an AI model processes, so the model treats attacker text as if it came from the user or developer. Direct prompt injection arrives in the user-facing input; the more dangerous agentic variant hides in data the agent fetches on its own.
Indirect prompt injection
Prompt injection delivered through a side channel the agent reads during its work — a web page, an API response, a README, a code comment, an email. The user never sees the malicious instruction; the agent encounters it mid-task and may act on it with the user's permissions.
Jailbreak
A prompt crafted to make a model ignore its safety rules or system instructions. Jailbreaks target the model's alignment; prompt injection targets the application's trust boundaries. In agent systems the two often combine: a jailbreak smuggled in via indirect injection.
Data exfiltration
Any technique that moves sensitive data (credentials, source code, private files) out of the agent's environment to an attacker. In agent attacks it is usually the second step: first hijack the agent, then have it transmit data through a channel it is allowed to use.
Covert channel
An exfiltration path disguised inside legitimate traffic — data encoded into DNS lookups, URL paths or query strings, or other allowed requests. Each request looks individually harmless, which is why covert channels defeat allowlists and require content-level inspection of outbound traffic.
Tool poisoning
Compromising an agent through the tools it trusts: a malicious or tampered MCP server, a tool description carrying hidden instructions, or a legitimate tool whose output has been seeded with injected content. The agent's trust in its own toolchain becomes the attack vector.
Approval bypass
A class of vulnerability where the agent's own permission or approval check is tricked into passing a dangerous action — typically via a parser differential, where the validator reads a command as benign while the shell executes something else. The largest single class in published agent-platform advisories.
Config-write escalation
Turning a file-write into code execution by targeting configuration the host trusts — settings files, startup hooks, shell rc files. The write looks low-severity in isolation; the host executes its contents later. Defenses must treat config-directory writes as their own escalation class.
Supply-chain attack (agentic)
Compromising an agent by compromising something it installs or loads: a dependency, a plugin, a skill, an MCP server package. Agent ecosystems multiply this surface because users routinely install community tooling with broad permissions.
Excessive agency
An OWASP-catalogued LLM risk: granting an agent more tools, permissions, or autonomy than its task requires, so that when it is manipulated (or simply wrong) the blast radius is far larger than it needed to be. The classic example is a summarization agent that can also send email and delete files.
System prompt leakage
Tricking a model into revealing its system prompt, hidden instructions, or embedded configuration. Beyond exposing intellectual property, leaked system prompts give attackers a map of the application's guardrails — the first reconnaissance step before a targeted injection.
Data poisoning
Corrupting the data an AI system learns from or retrieves — training sets, fine-tuning data, or the documents behind retrieval-augmented generation (RAG). For agents, poisoning the retrieval corpus is the practical variant: attacker-controlled content enters the context and steers behavior without ever touching the model.
Confused deputy problem
A classic security failure where a privileged program is tricked into misusing its authority on an attacker's behalf. An AI agent is the modern confused deputy: it holds the user's permissions (files, shell, APIs) and can be talked into wielding them for whoever controls its inputs.
Defenses
Runtime security
Security enforced while the agent is executing — inspecting live inputs, tool calls, tool results, and outputs, rather than scanning artifacts before deployment. For AI agents this is the indispensable layer, because the defining attacks (injection, exfiltration) only exist at execution time.
Guardrails
Controls that constrain what an AI system may do, independent of what the model decides: input/output filters, tool-call policies, blocked paths, escalation rules. "Guardrails" is also the plan name of Clawmont Security — the four-checkpoint runtime layer for OpenClaw agents.
Defense in depth
Layering independent controls so one failure is not a total failure: static scanning before launch, runtime detection at the boundaries, sandboxing underneath, audit trails throughout. The honest posture for agent security, since no single layer catches everything.
Sandboxing
OS-level containment restricting which files, directories, and network hosts a process can reach. Bounds the blast radius of a compromised agent but cannot judge intent — misuse of allowed permissions passes through. Complementary to runtime detection, not a substitute.
Human-in-the-loop (HITL)
Requiring human approval before an agent executes consequential actions. Valuable but fragile at scale: approval fatigue degrades review quality, and approval-bypass vulnerabilities can skip the prompt entirely — which is why approvals need an independent automated check underneath.
Zero false positives
A design goal where a security layer never blocks legitimate work. It matters because alert fatigue is how security tools die: a layer that cries wolf gets muted, and a muted layer catches nothing. Clawmont treats zero false positives on clean traffic as a hard requirement and publishes its measurements.
LLM-as-judge
Using a language model to evaluate content another model produced or consumed — e.g. reviewing an ambiguous input that fast deterministic checks flagged but could not classify. Adds semantic coverage on borderline cases at added cost and latency, so it is typically a second-line layer.
Canary token
A decoy credential or marker planted where no legitimate process should touch it. Any access is a high-confidence tripwire that something — an injected agent, a rogue tool — is reading where it shouldn't.
Tamper-evident audit trail
An append-only log of security decisions where each entry is cryptographically chained to the previous one (hash-chaining), so any edit breaks the chain and is detectable. Weaker than a cryptographically signed log, stronger than plain text — and essential for reconstructing what an agent actually did.
Least privilege (for AI agents)
Granting an agent only the tools, paths, and network access its task actually needs — the direct antidote to excessive agency. In practice: scoped tool allowlists, read-only modes where writing isn't required, and separate agents (or sessions) for separate trust levels instead of one agent that can do everything.
Concepts & standards
Agentic security
The security discipline for AI systems that act — plan, call tools, execute code, browse — rather than just generate text. It extends LLM security with tool-call risk, multi-step attack chains, and machine-speed blast radius, because an agent's mistake is an action, not a paragraph.
AI agent security
Protecting autonomous AI agents across their four trust boundaries: what enters the model, what the model asks tools to do, what tools return, and what the model outputs. Used interchangeably with agentic security; the practical work is securing those boundaries at runtime.
MCP (Model Context Protocol)
An open protocol that connects AI models and agents to tools and data sources. MCP is what gives modern agents their reach — filesystems, browsers, APIs, databases — which also makes MCP servers and their tool calls a primary security surface.
MCP security
Securing the tool layer of agent systems: vetting MCP servers before install, guarding tool calls at dispatch time, scanning tool results for injected instructions, and pinning tool integrity against tampering. The tool boundary is where agent attacks do their actual damage.
LLM security
The broader field covering risks of large language model applications: prompt injection, data leakage, insecure output handling, model supply chain, and more. The OWASP LLM Top 10 is its reference taxonomy; agentic security is its highest-stakes subset.
OWASP LLM Top 10
OWASP's ranked list of the most critical risks in LLM applications — prompt injection at #1 — with mitigations. The standard shared vocabulary for assessing LLM application security.
OWASP Agentic Top 10
OWASP's companion taxonomy for autonomous agent risks — tool misuse, intent manipulation, identity spoofing, inter-agent communication abuse, and others. Clawmont maps its detection coverage against this list and publishes the mapping, including the gaps.
Local-first security
An architecture where detection and secrets stay on the user's machine: keys in the OS keychain, scanning in-process, no prompts or code routed through a vendor cloud. The alternative — a hosted gateway — adds capability for teams at the cost of routing your traffic through someone else's infrastructure.
Source-available (BUSL-1.1)
A licensing model where source code is publicly readable but the license is not OSI-approved open source. Clawmont is licensed under the Business Source License 1.1, which converts to Apache 2.0 in 2028 — source-available, auditable, and honestly labeled as not open source.
OpenClaw
A local-first AI agent runtime: any model, any tool, running on the user's own machine. Clawmont is a security plugin that runs inside the OpenClaw gateway, adding runtime detection at the agent's four trust boundaries.
Shadow AI
AI tools adopted inside an organization without security review or approval — the AI-era version of shadow IT. Developer agents are its fastest-growing form: an engineer wires an agent into repos and credentials long before anyone with a security hat knows it exists, which is why agent security increasingly starts bottom-up with the developer rather than top-down with policy.
AI red teaming
Systematically attacking your own AI system — injection payloads, exfiltration chains, obfuscated commands — to measure what the defenses actually catch before real attackers do. The output that matters is honest numbers: detection rates on known and novel attacks, false-positive counts, and the misses. Clawmont publishes its own red-team results, including what gets through.
See these terms in action
The playground runs real attack payloads against Clawmont's live detection layer.