The event: Agent security moves to the front of deployment

A recent InfoQ “Geek Talk” and AICon livestream focused on a question many enterprises now face: how to make AI agents safe enough for production use. The session was hosted by Zhang Dong, Tencent expert engineer and AI Agent security lead, with Lin Daozheng, security architect at Baidu AI Cloud, and Liu Xu, senior solutions engineer at Cloudflare.

The central message was clear: enterprise agents are no longer simple chat interfaces. They can plan tasks, call tools, access data and perform actions. That shift changes the security problem from “will the model generate the wrong text?” to “will the system take the wrong action?”

Why the risk is different now

Compared with traditional AI applications, agents introduce identity, reasoning and execution. Lin noted that older AI systems were often just one step inside a business process, while an agent may control the whole flow. Liu added that modern agents can draft plans, write code, request permissions, deploy changes and test features, which makes them powerful but also broadens the attack surface.

Key risks discussed in the session included:

• Prompt injection: malicious instructions hidden in emails, webpages or documents can redirect an agent from its original task.
• Tool misuse and over-permissioning: each new tool or skill expands what an agent—and a potential attacker—can do.
• Context compression failures: if constraints disappear after context is compressed, an example address or command may become an unintended target.
• Token and identity design: enterprises must decide how long login tokens last, whether agents inherit tokens from one another, and how MCP authentication should work.

The speakers referenced OWASP’s AI risk list, where Prompt Injection remains the LLM 01 category. In a chat-only setting, injection may lead to a bad answer. In an agent setting, the same technique can trigger email forwarding, document modification, internal access or other real-world actions.

A practical baseline: visibility, control and traceability

The recommended first step is not to block every agent, but to establish a baseline. Lin summarized it as visibility, manageability and traceability. Enterprises should map what identities an agent uses, which tools it can call, what data it can touch and which external channels it can access.

For control, Liu suggested minimum safeguards around login, authentication and authorization, as well as review of user behavior and traffic patterns. Inputs to agents should be logged and, where possible, filtered through AI security firewalls or similar controls. Tool calls should be isolated through sandboxes, least-privilege APIs, temporary tokens and gateways. DLP, or data loss prevention, can be added to reduce the chance of sensitive information leaving the organization.

Traceability is the fallback when prevention fails. Full-chain logs covering prompts, tool calls and outputs help teams reconstruct what happened and who was responsible. This matters for both external attacks and internal misuse.

Shared responsibility, not endless pop-ups

Agent security is not something a single team can handle alone. Lin said that, in Baidu’s practice, the business team is the primary owner, while the security team shares the overall consequences with the business. In practical terms, business teams define what an agent should do and where the data boundaries are, while security teams provide policies, red lines and baseline controls.

The speakers were skeptical of treating “human in the loop” as a universal cure. If an agent repeatedly asks for confirmation, people may simply click approve without understanding the consequences. A better approach is risk-based control: low-risk tasks such as search and summarization can be more open, while actions that modify data, send information externally or spend money require stronger review and rollback options.

Outlook: guardrails will determine scale

The discussion points to a broader industry shift. Agent adoption will not be limited by model capability alone; it will depend on whether enterprises can govern tools, identities, permissions and audits in one framework. Security should act as a guardrail rather than a brake: with clear boundaries, companies can move faster with less uncertainty.

AICon Global AI Development and Application Conference 2026 Shenzhen, scheduled for August 21-22 in Shenzhen, will include a dedicated track on “Agent Security: From Risk to Control.” As agents enter more core workflows, the next phase of competition will be less about whether agents can work, and more about whether they can be used safely at scale.