Most of us here are wiring agents into real systems now, shell access, database writes, CI pipelines, so the security question stops being theoretical pretty fast. This is the map I keep coming back to when reviewing an agent setup, and I am curious which layer trips people up most.
Prompt injection gets most of the coverage and it deserves some of it. But injection on its own is just text. It becomes an incident only when something downstream is willing to execute it, which is why the useful unit of analysis is the layer, not the prompt.
The Five Layers
Input. Everything the agent reads, not only what the user typed. Retrieved documents, scraped pages, API responses and messages from sibling agents are all instruction carrying surfaces. Indirect injection lives here, and in production it shows up far more often than someone typing "ignore your previous instructions" into a chat box.
Processing. The model and its planning logic. Jailbreaking, goal hijacking, and reasoning that quietly drifts off task.
Action. Tools, function calls, API clients. This is the layer that turns a bad decision into a bill, because this is where the credentials live.
Infrastructure. Containers, network egress, secret storage. Familiar ground, with the twist that agents often need credentials at runtime rather than baked in at deploy time.
Orchestration. Only exists in multi agent setups: the messages, the shared scratchpad, and the trust each agent extends to its peers. One compromised agent can steer the others without ever touching your input layer.
What Actually Holds Up
Scoping permissions per tool instead of per agent is the single change with the best return. An agent that summarises tickets should not be holding a write capable database handle just because it shares a runtime with one that needs it.
After that: validate at every boundary the agent reads from, filter output before it leaves the process, and keep an append only audit trail the agent cannot rewrite. That log is unglamorous right up until the day you have to reconstruct what happened.
The longer version, with the threat categories and the controls mapped per layer, is in this guide to securing AI agent deployments.
Takeaway
Treat the action layer as the blast radius and the input layer as the fuse. Once you have decided what each tool is allowed to touch, prompt injection turns into a containment problem instead of an unsolvable one.
Which layer is the weak point in your setup right now?
