When AI can act: tools, agents, and how to defend, in short: once an AI can read files, send email or change records, a prompt injection stops being a strange reply and becomes a real action. Harmless tools can chain into a harmful path, so give agents the least access they need and a human checkpoint before anything risky.
Ask an agent to “email the client this week’s status report” and it will read the project folder, write the report and send it. Useful. But if the folder also holds internal profit notes, the agent may fold them into the report, and three individually allowed steps (read, write, send) add up to a leak nobody approved. A chat assistant that misunderstands you gives a bad answer; an agent that misunderstands you does something.
This is why the course ends at tools and agents. Prompt injection is not only about getting a model to say something surprising. It is about what the surrounding application allows that output to influence. Once a model can act, the consequences of a weak boundary become concrete.
What happens
An agent receives a goal, chooses tools, observes results, and plans the next step. Untrusted text can alter that plan or make a tool result look like a new instruction. A read operation can feed a formatter, which feeds a sender, which reaches an external destination. The model may not understand that the chain has crossed a security boundary.
The right question is not whether each tool description sounds safe. Ask what data can flow through the chain, who can approve the final action, and which service enforces that decision. A model can help plan, but it should not be the only component allowed to approve its own plan.
Animated walkthrough · Willow Operations AgentSafe tools compose into an unsafe path
Account managerneutral
Send the client this week's status report from the Halden project folder.
Operations agentneutral
Plan: read the project folder, write a one-page report, email it to the client contact.
File toolneutral
Read 3 files: status.md, timeline.md, internal-margin-notes.md. All are in a folder the agent is allowed to read.
Operations agentneutral
Report drafted: progress, next milestones, and a margins section summarizing the internal notes.
Email toolleaked
Sent to the client contact at halden-client.example. Attachment: weekly-status.pdf.
Client inboxleaked
The client now has your internal profit margins. Reading was allowed, writing was allowed, sending was allowed. Nothing checked what flowed from the first step to the last.
Takeaway
Tool permissions must be reviewed as a graph because individually legitimate actions can compose into a harmful data flow.
Defense replay
Restrict data destinations and require a policy or human approval before a read result can enter an outbound action.
Try it
Watch the agent-tool walkthrough and trace the data path from the user’s request to the final action. There is no live course challenge for this lesson yet. Instead, name the smallest permission you would remove, the step that needs approval, and the output you would validate before allowing the workflow to continue.
How to defend
Give each agent the least it needs: the fewest tools, the narrowest data, and a short list of places it may send things. Treat documents and tool results as material, not orders, and remember where each came from. Keep “read” and “write” as separate permissions, check every tool request against fixed rules before it runs, and put anything with real consequences (sending, paying, publishing, deleting) behind a human yes. Add limits on time, retries and spending so an agent cannot loop or quietly widen its job. Log the whole chain and look for unusual combinations, like a read of private files followed by an outbound email. The right mindset: assume the model can be talked into anything, and make sure talking is never enough to gain a new ability.
If you want your team to feel this rather than read about it, run a live session: one QR code, a fictional app to break, and a leaderboard on the big screen.
Check yourself
Three quick questions. Get all three right to finish the lesson.
1Why can individually permitted tools be dangerous together?
Their composition can move data into a sensitive destination
Using several tools makes the model slower and less accurate
Tools from different vendors cannot share data safely
Show answer
Answer: A. A reader, formatter, and sender may be acceptable alone but unsafe as a chain that crosses a data or action boundary.
2What does least privilege mean for an AI agent?
Give the agent every tool so it can be helpful
Give only the data, operations, and destinations needed for the current task
Let the model decide its own permissions
Give the agent the same permissions as the person who set it up
Show answer
Answer: B. Least privilege narrows capabilities and scope so a confused or manipulated plan has fewer ways to cause harm.
3Which control belongs in a strong agent design?
Human approval for risky actions and checks outside the model
A longer system message as the only barrier
Letting the agent retry a blocked action with a different tool
Show answer
Answer: A. External policy checks, approval, output validation, and monitoring provide defense in depth around model decisions.
Turn on JavaScript to check your answers and save your progress.