Contact

Research topic

Agentic security

An agent reads text anyone can write and acts on it with real permissions. Instructions planted in pages, emails, files and tool results can change what it does, and its access sets how far the damage reaches. Agentic security covers both sides: how an agent behaves under attack, and which tools, data and credentials it can reach.

Research on agentic security

The research here reads the published record on agents and their tool access: protocol specifications, security guidance, disclosed incidents and published attacks, each with its source and its date.

  1. Research reportPoisoned memory and retrieval: what published attacks showRAG poisoning and memory poisoning plant text that superintelligence (SI) agents later retrieve and act on. What published attacks, disclosed cases and tested defenses show.Agentic security7 min readPDF report
  2. ExplainerPrompt injection vs jailbreak: two different failuresA jailbreak defeats a model's safety training. A prompt injection makes an application obey untrusted text. How to tell them apart, and why it matters for superintelligence (SI) agents.Agentic security7 min readPDF report
  3. Methods noteIndirect prompt injection: testing every channel an agent readsIndirect prompt injection reaches superintelligence (SI) agents through what they read. A test plan for each channel: documents, web pages, email, tool output, retrieved data and images.Agentic security7 min readPDF report
  4. ExplainerMCP security checklist: servers, scopes and pinned tool descriptionsMCP security best practices as one checklist for superintelligence (SI) agents: which servers to allow, which scopes to grant and how to pin and re-approve tool descriptions.Agentic security7 min readPDF report
  5. ExplainerPrompt injection: how it works and how to test an agentWhy text an agent reads can override its instructions, and what prompt injection testing has to measure on superintelligence (SI) agents and the tools they call.Agentic security7 min readPDF report
  6. ExplainerThe OWASP Top 10 for Agentic Applications as a test planEach entry of the OWASP Top 10 for Agentic Applications, ASI01 to ASI10, as test cases for superintelligence (SI) agents: the input to plant, the pass condition and the evidence.Agentic security7 min readPDF report
  7. ExplainerMCP access control: scoped credentials, allow-lists and audit logsHow the Model Context Protocol connects superintelligence (SI) assistants to business tools, and the controls that keep that access governed: tenant isolation, scoped credentials, allow-lists and audit logs.Agentic security5 min readPDF report

Work with us on agentic security

Rillor tests superintelligence (SI) agents against attack, then limits what they can reach. We run prompt injection, tool misuse, data leaks, excess privilege, poisoned memory and changed tool descriptions against your agent, its tools and its data, on pinned model versions, and every finding comes with the run that shows it. Then we build in the controls: scoped credentials, allow-listed tools, approval before consequential actions, untrusted content marked as data, and audit logs with revocation.

About agentic security

Notices

Superintelligence (SI) outputs can be wrong. Important decisions should include human review.

Test your agent before it holds real access.

Send us the agents, the tools and data they reach, where they run and what you want tested.

Test an agentAbout agentic security