AI agent security, for a team that wants automation, is a set of limits you can enforce this week. Prompt injection is untrusted text trying to override instructions. The text might be a web page, an email, a ticket, or a file the agent was told to read. The controls are least privilege, no secrets in prompts, a split between instructions and untrusted content, human approval before email, payments, or merges, plus logging and a kill switch.
Key takeaway: The agent may draft. A person sends mail, pays, and merges. Secrets stay out of the prompt. Someone on the team can turn the agent off the same day.
Research reviewed: October 30, 2026. This is desk research by the AI Savr editorial team. We did not run a private lab test, and we did not invent scores, traffic numbers, or hands-on results. Confirm live prices on the vendor page before you buy.
What is prompt injection, without the theatrics?
Prompt injection is untrusted text trying to override instructions. The agent cannot tell a customer's email from a rule you wrote if you paste them into one blob. Separate the instruction from the content. Do not give the agent a tool it does not need. This page does not include attack strings or steps for breaking a system. The defensive framing used by practitioners is collected by the OWASP top 10 for large language model applications.
| Control | Rule | Before this happens |
|---|---|---|
| Least privilege | One system the job needs, nothing else | Any new connection |
| No secrets in prompts | Keys stay in a vault, not in the text | Every run |
| Separate untrusted text | Instructions are not inside the pasted page | Inbox, web, and ticket tasks |
| Human approval | A person sends mail, pays, or merges | Those three actions |
| Logging and a kill switch | You can see the run and stop it today | The first real workflow |
Where the controls sit on tools people already use
ChatGPT as a seat that must not send mail
ChatGPT is a drafting seat people will try to connect to mail and files. Treat every page, email, and ticket you paste as untrusted text. It must not override your instructions, and it must not contain secrets. The seat can draft a reply. It does not get a send button.
Choose it when: a person wants a draft and will review it before anything leaves the building.
Leave it when: you plan to let the account email customers or spend money. Add a human approval step first, or do not connect it.
Price and access: Public checkpoints in late October 2026: Go about $8, Plus $20, Pro from about $100. Confirm on the OpenAI page. Price is not a security control.
A real use: A support teammate pastes a ticket into a draft prompt that contains no keys. They edit the reply and send it from the help desk. The model never holds the mailbox password.
Claude as a coding seat that does not merge
Claude is useful for a patch or a terminal task inside a repository you already limited. The untrusted part may be a file, an issue, or a web page the task was told to read. Keep your instructions in the task, not mixed into that text. A person approves the merge. The agent does not merge because the diff looks tidy.
Choose it when: an engineer wants a draft change and a human will review the diff.
Leave it when: the agent has production credentials or a merge right. Remove those before you admire the demo.
Price and access: Pro is $20 a month, or about $17 on the annual plan, on Anthropic's pricing page as of late October 2026. Max starts from $100. Confirm before you buy.
A real use: Give the coding seat a branch and a test command, not a cloud key. It opens a pull request. A named engineer reads the diff and merges, or closes it.
Notion AI for the runbook, not the vault
Notion AI is a reasonable place to store the runbook: which system the agent may touch, who approves mail, payments, and merges, and who holds the kill switch. Do not store secrets on that page. A wiki the model can read is a bad vault. If the runbook is vague, the agent will be given whatever access is convenient.
Choose it when: the team already keeps process notes in Notion.
Leave it when: you are about to paste API keys into the same page as the policy.
Price and access: Confirm how Notion AI is included on your plan at notion.so. Buying the seat does not implement least privilege.
A real use: Write five lines: systems allowed, actions that need a person, where logs go, who can turn it off, and a ban on secrets in prompts. Review it when you add a tool.
Perplexity when the input is the web
Perplexity fetches pages that you did not write. Those pages are untrusted content. Use the tool to collect links a person will open. Do not pipe a raw page into an agent that can email or pay, with your instructions sitting in the same field as the page text. Separate the research note from the action.
Choose it when: research is the task and a person will decide what to do with it.
Leave it when: an agent is allowed to act on whatever the page says. That is the failure mode, described here without a recipe.
Price and access: A free tier exists. Read Perplexity's pricing page for paid plans. A paid plan is not a control.
A real use: Save two URLs and a sentence you checked. A person decides whether that sentence belongs in a customer email. The research tool does not send the email.
Put the controls in before the first real run
Do these five things before an agent touches a real mailbox, a payment, or a repository. They are setup, not a test that tries to break the system.
- List the systems, then delete. Least privilege means the agent gets one system it needs. Remove every other token.
- Keep secrets out of prompts. Keys live in a vault. If a prompt needs a secret to 'work,' the design is wrong.
- Split instructions from untrusted content. The task text is yours. The page, email, or ticket is data. They do not share one undifferentiated box.
- Require a person for email, payments, and merges. The agent may draft. It may not complete those three actions.
- Turn on a log and a kill switch. You should see what ran, and a named person should be able to stop it the same day.
What this page will not teach
This page does not include exploit payloads, attack strings, or steps for making an injection succeed. Knowing the definition is enough to place the controls. Controls reduce risk. They do not make an agent safe against every future trick, and they do not replace a security review for a product you ship. The NIST AI Risk Management Framework is a broader map if you need one. It is not a product setting.
A small automation that stays inside the fence
An agent reads a shared inbox and drafts replies in a folder. It cannot send. It has no payment key and no merge right. The runbook in Notion names the person who approves the folder twice a day and the person who can disable the agent. Logs keep the draft and the time. If someone later wants the agent to send, that is a new design, not a checkbox. The same fence applies if the model is local. Local does not fix an agent that holds a mailbox password.
Questions worth asking before you buy
Ask which actions the product can take without a person, whether you can remove tools one by one, and whether logs export to a place you control. Ask how you disable the agent on a weekend. If the vendor cannot show a kill switch, do not connect it to mail or payments.
For companies that need more than a subscription
If the workflow needs your data rules, your approval chain, or an audit log the product does not have, that is a custom build with the same controls. The controls do not get looser because the agent is yours.
If an off-the-shelf tool cannot meet your data, approval, or security rules, talk to AI Savr about a custom AI agent. Use the directory to compare live tools first, and vendors can submit a product.
Frequently asked questions
What is prompt injection?
Untrusted text trying to override instructions. The text can be a page, an email, a ticket, or a file the agent was asked to read.
What is least privilege for an agent?
Give it only the system the job needs. If it drafts email, it does not also get payments or the production repo.
Why keep secrets out of prompts?
A prompt is a poor vault. It can be logged, pasted, or mixed with untrusted text. Keep keys in a vault.
Which actions need a person?
Email, payments, and merges. The agent may prepare them. A person completes them.
What is a kill switch?
A way for a named person to stop the agent the same day, without hunting through a cloud console they have never opened.
Does this page show how to attack an agent?
No. It defines the problem and the controls. It does not include attack strings or procedures.
Read next
- Local models and the privacy check
- Approval-gated agents as a 2027 signal
- Choosing a model by its card