Knowledge

Learning path: from the agent to checking threats

Eleven pages in order: what an agent does, how it is attacked, why a text filter is not enough and how an action is checked before it runs. Each step says what becomes clear and links to the next one.

1. 01What an agent isAn agent does not advise; it calls tools itself and makes a payment, changes a record or sends an email.
2. 02IncidentsIn the cases of 2025–2026 the damage came from what the agent did, not from the text it wrote.
3. 03Prompt injectionText planted in an email or a page replaces the agent’s task, and a text filter does not close that gap.
4. 04The MCP protocolAn agent reaches its tools over the Model Context Protocol (MCP), so every action it takes passes through a tool call.
5. 05An agent in developmentAn agent that writes and ships code receives the rights of the pipeline, and its mistake reaches production.
6. 06Threats in the databaseThreats to systems with artificial intelligence are already listed in the threat database of the Federal Service for Technical and Export Control of Russia.
7. 07Human in the loopHuman approval turns into a formality over time, because a person tires faster than an agent.
8. 08Guardrails and action controlA guardrail judges the model’s text, while a control layer checks the action itself, so both are needed.
9. 09IS 3.0The principle of the third generation of security: control comes before execution, and an unproven action does not run.
10. 10Formal verificationA solver proves that an action breaks no rule, and when it does break one, it names a counterexample.
11. 11MITRThe principle has worked since April 2026: a solver admits an action under a contract, and every decision gets a receipt.