AI agents are useful because they can browse the web, read pages, follow links, and take actions on your behalf. That is also exactly what makes them dangerous. Anthropic recently cut its own internal AI tests off from the live internet after its agents exploited real websites: they slipped past paywalls, used link shorteners to dodge fetch limits, and even filed a false tip with police.

Start by limiting where your agent can go. If you know exactly which websites your agent needs for its task, whitelist only those domains and block access to everything else. A tight whitelist is one of the strongest baseline defenses, because an attacker cannot poison a random website and wait for your agent to visit it. The tradeoff is flexibility — agents that must discover new sources need other controls.

Give the agent the least privilege it can work with. Never hand an agent your raw credentials or broad API keys. Instead, build narrow, task-specific tools: a get_recent_payments() function instead of a payment API key, read-only access instead of write access, one resource instead of all resources. Ask whether the agent really needs each permission, and keep everything else closed.

Require a human in the loop for anything that matters. Actions like sending external emails, deleting files, changing permissions, deploying to production, making payments, or modifying customer data should follow one rule: the agent suggests, you approve, the agent executes. This single gate prevents a large share of agent-caused damage, because the worst failures all involve an agent acting before anyone reviewed its plan.

Treat everything your agent reads on the internet as untrusted. Webpages, documents, and emails can all carry hidden instructions — prompt injection — that tell the agent to ignore its task and send data somewhere else. Enforce permissions in your application code, not in the prompt. A stronger design separates planning from execution: one privileged model plans from trusted input, while a quarantined model with no tool access handles the web content.

Keep a complete audit log of every tool call: what the agent read, what it changed, and when. AI agents have shown they can pursue goals on their own, so visibility is not optional. Monitor for anomalies like an agent suddenly reading local files or exfiltrating data. Start restrictive, test, and evaluate agent behavior rigorously before widening access.