Understanding the Agent Threat Landscape
Agents face unique risks beyond traditional software. Functional risks such as goal hijacking, untrustworthy inputs, and unsafe tool access can cause serious problems if not addressed early in the design.
This is becoming essential for secure agent development.
As a dev, I now map the threat landscape before building any production agent.
Agent Threat Landscape Cheatsheet:
- Identify risks from untrusted inputs
- Protect against goal hijacking and prompt injection
- Control access to sensitive tools and data
- Monitor for unexpected agent behavior
- Design clear boundaries for what the agent can and cannot do
Pro tip: Understanding the threat landscape early prevents many costly security issues later
How are you assessing risks in your agent systems? Reply below ๐
Follow @AiCamila_ for daily production AI + DevOps tips.
#ThreatLandscape #AgentSecurity #ProductionAI #AgenticAI #RiskManagement
5 places agent memory can live. four of them you have to turn on.
(sorted by how much of the run survives)
the window is finite, the run is not.
every setup answers the same question: when the turn ends, where does the information go, and how do you get it back.
that is the axis. each of these answers it at a different point.
1. truncation
โ the oldest turns fall out of the window and are gone
โ you get them back by asking again, and paying again
2. compaction
โ forty turns get rewritten as prose and put back in the window
โ you get them back by trusting a paragraph you never read
3. retrieval
โ it lives outside, in an index, found by resemblance
โ you get it back if the query happens to look like the text you need
4. files on disk
โ it lives outside, addressed by path
โ you get it back exactly, because a path is not a guess
5. a graph
โ it lives outside, addressed by relationship
โ you get it back with the connections attached, which is the part every other option drops
notice the thread. each step pushes the memory further out of the window and makes retrieval more explicit. truncation is implicit and free. a graph is explicit and expensive. everything between them is you deciding how much of the run you are willing to lose.
the first two are the defaults. they run unless you turn them off, and they are the two that lose the most.
save this, then read the full breakdown below
this is worth more than most five figure courses
16 claude agents audit an entire repo at once, a second fleet re-checks every finding on fresh context, and the whole thing runs off one diagram instead of a prompt
i ran it against my own code and got back 11 endpoints where i never checked who was logged in, 3 of which the verifier threw out before they ever reached me
this is Graph Engineering, the layer above prompting, and it runs on the agent you already pay for:
- write your plan out, then ask one question at every "and then": does the next step actually read what the previous one produced
- the seams that fail that question were never dependencies, so those jobs run at the same time
- the arrows that survive are your real edges, and the longest chain of them is your floor that no number of agents shortens
- want it faster, cut a false edge instead of adding a worker
- fan the independent work out, one agent per item, no shared state between them
- send every finding to a separate agent on fresh context, because a model recognises its own writing 73.5% of the time and grades it kinder once it does
- make that verifier check a real signal like a passing test, never the worker's own word that it finished
- shard the fleet across worktrees so parallel workers stop overwriting each other, one rule frozen into every worker: never git stash, never git reset
- merge only what came back verified, into one report instead of twenty open chats
the catch is the ceiling. at 95% independent work 16 agents return 9.14x rather than the 16 you would guess, and even 256 only reach 18.6x, because the merge and the verify stay serial however wide you fan
coordination itself is free plain code and every agent underneath it is billed, so start at twenty files and widen once it works
bookmark this, the whole method with all six ready-to-run graphs is written out in the article โ
UN INGENIERO DE ANTHROPIC CREร ESTE SISTEMA DE GRAPHS Y ACABA DE REVELAR CรMO FUNCIONA
La mayorรญa de la gente que debate sobre graphs en internet nunca ha visto uno ejecutarse de verdad.
Tarea โ Investigador โ Planificador โ Redactor + Agente de Cรณdigo โ Revisor โ Despliegue
Seis nodos, un estado compartido y paquetes de informaciรณn viajando de un extremo a otro en tiempo real mientras el graph completa el trabajo por sรญ solo.
El modo de bucle deja de tener sentido en cuanto la tarea se divide en especialidades reales. Un solo agente deja de intentar hacerlo todo.
Si el revisor detecta un fallo, lo envรญa directamente al nodo que lo provocรณ.
No hace falta reiniciar todo el flujo ni se pierde el contexto.
Un graph no es un bucle mรกs sofisticado.
Es el organigrama que les faltaba a tus agentes.
Guรกrdalo, mira cรณmo funciona y luego lee el artรญculo de abajo๐
Your agent keeps redoing its own work because you handed it a loop for a job that needed 5 fixed nodes.
A support ticket as a loop: goal in, the agent drafts, checks against policy, fixes, repeats until it resolves. You own the frame, it owns the path.
The same ticket as a graph: read, triage, draft, QA, send, with a checkpoint at each one. You own the map, it fills the boxes.
Loops handle the work you haven't mapped yet. Graphs handle the work you have.
Read the walkthrough on building your first agent graph below.
from prompt โ context โ harness โ loop โ graph engineering.
the list keeps growing, and every new term gets treated as a replacement for the last one. each layer wraps the one before it, and the cleanest way to tell them apart is to ask what a single unit of work looks like.
๐ฝ๐ฟ๐ผ๐บ๐ฝ๐ ๐ฒ๐ป๐ด๐ถ๐ป๐ฒ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ถ๐ ๐๐ต๐ฒ ๐บ๐ฒ๐๐๐ฎ๐ด๐ฒ.
the model remembers nothing before this call, so the prompt has to carry the full universe of what it needs. a role, the background, the instructions, a few examples, a format.
when the output falls short, the skill is working out which ingredient let you down, not rewriting the instructions every time.
the unit of work is one input.
๐ฐ๐ผ๐ป๐๐ฒ๐ ๐ ๐ฒ๐ป๐ด๐ถ๐ป๐ฒ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ถ๐ ๐๐ต๐ฒ ๐บ๐ฒ๐บ๐ผ๐ฟ๐.
across many steps the window is finite and the available information is not, which forces a curation step. a curator keeps what matters, compresses what is useful but bulky, and drops the rest.
good curation is mostly about knowing what to throw away, not packing more in.
the unit of work is what stays in the window.
๐ต๐ฎ๐ฟ๐ป๐ฒ๐๐ ๐ฒ๐ป๐ด๐ถ๐ป๐ฒ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ถ๐ ๐๐ต๐ฒ ๐บ๐ฎ๐ฐ๐ต๐ถ๐ป๐ฒ.
on its own a model just generates text. the harness gathers what it needs, runs it, calls tools or sub-agents, and verifies the result with tests or a judge.
that verify step is the entire difference between calling an api and running an agent.
the unit of work is one pass through the machine.
๐น๐ผ๐ผ๐ฝ ๐ฒ๐ป๐ด๐ถ๐ป๐ฒ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ถ๐ ๐๐ต๐ฒ ๐ฟ๐๐ป.
one pass rarely finishes the job, so something has to decide whether to run the machine again. that decision needs a goal defined upfront, brakes like max iterations and budget caps, and a completion check that is automated rather than felt.
an agent that stops asking for tools has ended its turn, which is not the same as finishing the task.
the unit of work is the whole run.
the diagram covers those four. here is the fifth.
๐ด๐ฟ๐ฎ๐ฝ๐ต ๐ฒ๐ป๐ด๐ถ๐ป๐ฒ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ถ๐ ๐๐ต๐ฒ ๐ฐ๐ผ๐ผ๐ฟ๐ฑ๐ถ๐ป๐ฎ๐๐ถ๐ผ๐ป.
once several loops have to work together, you need to say what runs when, what runs in parallel, and who checks whom. nodes do the work, edges decide what runs next, and shared state flows between them.
a single loop is just a one-node graph with an edge pointing back at itself, which is why graphs govern loops instead of replacing them.
the unit of work is the whole job.
here is the part that ties it together.
prompt and context both live inside the harness gather step. the harness is one pass, the loop decides whether to run that pass again, and the graph decides which loops run at all.
zoom out and the unit of work gets bigger. zoom in and you are back at the prompt.
that also tells you where to debug. find the layer whose unit of work broke, then fix that layer.
the prompt is the easiest layer to edit, which is why it keeps taking the blame for failures that live three layers up.
i also published this deep dive on graph engineering, covering the core idea, how to get started, shared state, routing you can trust, and when a graph is genuinely overkill.
the article is quoted below.
6 agent patterns for AI engineers
most production agents are simple workflows with good error handling
1) prompt chaining
split the task into fixed steps and check every handoff
use it when the path is known and accuracy matters more than latency
โ https://t.co/yL2QeN0kF0
2) routing
classify the input first and send it to the right model or tool
use it when requests fall into clear categories
โ https://t.co/CWPdPUj1ho
3) parallelization
run independent calls together and merge or vote once
use it when the work can happen at the same time
โ https://t.co/cZHUsoL30H
4) orchestrator workers
let one model create the subtasks and delegate them at runtime
use it when you cannot list the steps before the run starts
โ https://t.co/vlQuTZg0EL
5) evaluator optimizer
one model writes and another grades until the result passes
use it when the rubric is clear and iteration measurably helps
โ https://t.co/dr1GZlC75R
6) autonomous agent
the model plans acts reads the environment and chooses the next step
use it when the path is unknowable and the blast radius is controlled
โ https://t.co/ACgBjw6XK4
the first five are workflows
you wrote the path
only the last one writes its own
Anthropic mapped this taxonomy in Building effective agents
โ https://t.co/t56QyasyMP
start with the simplest pattern that can do the job
bookmark this for future
then read the article below
RAG vs. Graph RAG, explained visually!
RAG has many issues.
For instance, imagine you want to summarize a biography, and each chapter of the document covers a specific accomplishment of a person (P).
This is difficult with naive RAG since it only retrieves the top-k relevant chunks, but this task needs the full context.
Graph RAG solves this.
The following visual depicts how it differs from naive RAG.
The core idea is to:
- Create a graph (entities & relationships) from documents.
- Traverse the graph during retrieval to fetch context.
- Pass the context to the LLM to get a response.
Let's see how Graph RAG solves the above problem.
First, a system (typically an LLM) will create a graph from documents.
This graph will have a subgraph for the person (P) where each accomplishment is one hop away from the entity node of P.
During summarization, the system can do a graph traversal to fetch all the relevant context related to P's accomplishments.
The entire context will help the LLM produce a complete answer, while naive RAG won't.
Graph RAG systems are also better than naive RAG systems because LLMs are inherently adept at reasoning with structured data.
Once the right architecture is in place, the next leverage point is efficiency.
Most RAG architectures rely heavily on vector search, and that layer can be made 32x more memory efficient using binary quantization.
I covered the full implementation in the article below.
๐ Over to you: Which RAG architecture are you running in production?
@zyloo_io Is this truly unlimited? I'm concerned that your policies could change unilaterally at any time without prior notice. Also, are there still any usage restrictions, such as rate limits per 5 hours, weekly limits, or any other limitations that I should be aware of?
Someone just dropped a 9-layer production AI architecture and it's the most honest breakdown I've seen.
services/ - RAG pipeline, semantic cache, memory, query rewriter, router. Not one file. Five.
agents/ - document grader, decomposer, adaptive router. Self-correcting by design.
prompts/ - versioned, typed, registered. Never hardcoded.
security/ - input, content, output. Three guards not one.
evaluation/ - golden dataset, offline eval, online monitor. Most people skip this entire layer and ship blind.
observability/ - per-stage tracing, feedback linked to traces, cost per query.
.claude/ - agent context so your AI coding assistant knows the codebase before it touches a file.
The demo is one file. Production is this.
Check: academy[.]neosage[.]io