# Security for Agentic Web Applications

**Track:** Interoperability, Safety & Production — AI-Native Full-Stack Development — complete (30)
**Framework / surface:** web dev (web + agent security)
**Level:** Advanced
**Prerequisites:** Human Approval & Degrees of Autonomy, MCP: Make Your Application Usable by Agents

**In one line:** Treat model output, retrieved content, tool arguments, and agent instructions as untrusted input crossing privilege boundaries.

## Theory, aesthetics & inspiration

Everything classical still applies — validate input, protect sessions, isolate secrets, authorize every privileged operation — and then agentic systems add a genuinely new problem, the one Simon Willison named prompt injection in September 2022: natural-language content can steer the component that decides which tools to invoke, and the model cannot reliably distinguish data-to-summarize from instructions-to-obey. Injection arrives indirectly too — through a webpage, a document, a database record the agent retrieves — so security cannot rest on prompting. Willison's "lethal trifecta" (2025) states the design rule compactly: an agent combining access to private data, exposure to untrusted content, and the ability to communicate externally is exfiltration waiting to happen — break at least one leg. OWASP now maintains both a GenAI/LLM Top 10 and, for 2026, an Agentic Applications Top 10, institutionalizing the point that autonomous action creates system-level risk beyond output quality. Threat-model the whole graph — user, model, retrieved content, tools, external systems — and ask not "will the model behave?" but "what is the maximum damage if it does not?"

**Builder question:** If the agent followed a malicious instruction hidden inside otherwise legitimate data, what capabilities could that instruction reach?