AI Agent Security Glossary

Agentic AI refers to AI systems that pursue goals by taking actions, not just generating text: they plan multi-step tasks, call tools and APIs, read and write real systems, and adjust based on results.

AI agent security is the practice of protecting AI agents from being subverted and protecting everything else from the agents: screening the inputs that steer them, governing the actions they take, containing the blast radius when one is compromised, and keeping evidence of what every agent did.

A delegation chain is the tree of agents created when an AI agent spawns sub-agents for sub-tasks, which may spawn their own.

Shadow AI is the use of AI tools, models, or agents inside an organization without the knowledge or approval of IT and security teams.

The Model Context Protocol (MCP) is an open standard that lets AI applications connect to external tools and data sources in a uniform way.

An MCP server is a program that exposes tools, resources, and prompts to AI agents over the Model Context Protocol.

An MCP gateway is a security proxy between AI agents and the MCP servers they use.

Tool poisoning hides instructions inside a tool’s description or schema, text an AI agent reads as trusted metadata.

A tool rug pull is an attack where a tool’s definition changes after it was reviewed and trusted.

Prompt injection is an attack that embeds adversarial instructions in text an AI system processes, causing it to follow the attacker’s intent instead of the operator’s.

Indirect prompt injection plants adversarial instructions in content an AI agent will retrieve later: a web page, an email, a support ticket, a document, a tool result.

A jailbreak is a prompt technique that pushes an AI model past its safety guidelines and operating constraints, through role-play framing, encoding tricks, hypothetical scenarios, or gradual pressure across turns.

Excessive agency is the risk condition where an AI system holds more capability, permission, or autonomy than its task requires, so a failure or subversion does maximum damage.

Privilege escalation in AI agent systems is any path by which an agent gains capability beyond what its operator intended: assuming elevated roles, borrowing credentials from its environment, chaining tools to reach systems it cannot touch directly, or inheriting broad permissions through delegation.

Denial of wallet is an attack on metered systems that aims to exhaust budget rather than capacity: forcing an AI application into expensive model calls, tool invocations, or loops until the bill, not the server, becomes the casualty.

Insecure plugin design is the risk class where extensions an AI system can call (plugins, tools, skills, connectors) accept unvalidated input, hold excessive permissions, or trust the model’s output blindly, letting a manipulated model turn a helpful extension into an attack path.

Action governance is the security discipline of evaluating what an AI agent is about to do, before it does it: every command, query, file operation, message, and tool call checked against organizational policy, with graduated verdicts and a recorded decision.

An agent scope is an operator’s declaration of what an AI agent is for: its purpose, the tools it may use, and the limits it runs under.

Session correlation is the analysis of an AI agent’s behavior across an entire session rather than one message at a time, detecting patterns no single message reveals: gradual boundary-pushing, intent that assembles across turns, retry storms after refusals, and drift from the agent’s original task.

Blast radius is the extent of damage a compromised or malfunctioning AI agent can cause before being contained: the systems it can reach, the data it can move, the actions it can complete, and the sub-agents it has spawned.

Fail closed means a security control that cannot complete its check refuses the action; fail open means it lets the action proceed.