Full Report
Defend the entire AI agentic stack across endpoints, identities, cloud, and apps with SentinelOne's unified platform.
Analysis Summary
# Best Practices: Securing the AI Agentic Stack
## Overview
These practices address the emerging security risks associated with "Agentic AI"—autonomous AI systems that can execute code, call APIs, and manage credentials. Because AI attacks transition from a prompt (input) to a system action (impact), security must cover the entire chain: endpoints, identities, cloud workloads, and applications.
## Key Recommendations
### Immediate Actions
1. **Discover Shadow AI:** Audit browser extensions, IDE plugins, and API-connected apps to identify unsanctioned AI tools currently in use by employees.
2. **Inventory AI Agents:** Document all autonomous agents and Model Context Protocol (MCP) servers operating within the network.
3. **Implement Prompt Filtering:** Deploy controls to block known prompt injection patterns and "jailbreak" attempts at the application layer.
### Short-term Improvements (1-3 months)
1. **Apply Least Privilege to Agents:** Treat AI agents as "non-human identities." Audit their standing access and restrict permissions to the minimum required for their specific tasks.
2. **Contextual DLP:** Transition from pattern-based Data Loss Prevention (DLP) to context-aware monitoring to prevent PII, secrets, and proprietary data from being sent to untrusted LLMs.
3. **Monitor Tool Calls:** Implement inspection of the specific commands/calls an agent makes to external tools to block malicious instructions at the moment of execution.
### Long-term Strategy (3+ months)
1. **Behavioral Endpoint Defense:** Move beyond signature-based detection to behavioral engines capable of identifying "YOLO mode" AI agents or malicious processes spawned by hijacked LLMs.
2. **Unified Identity & Cloud Governance:** Integrate AI agent identities into a centralized governance framework to prevent lateral movement if an agent's session token is compromised.
3. **Supply Chain Integrity:** Establish a vetting process for AI libraries (e.g., LiteLLM, Claude CLI) to protect against zero-day supply chain attacks hidden in AI installers.
## Implementation Guidance
### For Small Organizations
- Focus on browser-level governance and policy. Use endpoint protection that includes "Shadow AI" discovery to see what free AI tools staff are using.
- Establish a "clear use" policy for PII and company secrets in public LLMs.
### For Medium Organizations
- Implement an inventory of all AI "connectors" and API keys.
- Focus on securing the "Agent-to-Data" path by ensuring AI agents do not have broad read/write access to company file shares or databases.
### For Large Enterprises
- Deploy a unified security platform that treats the AI stack as a single chain (Endpoint -> Identity -> Cloud).
- Automate the "Kill Switch" capability: ensure that if an agent exhibits anomalous behavior (e.g., spawning a shell), its access can be revoked programmatically across the entire environment.
## Configuration Examples
- **Agent Governance:** Configure MCP (Model Context Protocol) server permissions to restrict AI agents from accessing local system shells unless explicitly required.
- **Identity Protection:** Set short TTL (Time-to-Live) for session tokens used by AI coding assistants to mitigate the impact of token theft.
- **Behavioral Blocking:** Enable "Detect & Kill" policies for processes that attempt DLL side-loading during the installation of AI software.
## Compliance Alignment
- **NIST AI Risk Management Framework (AI RMF):** Aligning with governance and mapping functions for AI actors.
- **ISO/IEC 42001:** Supporting the management of risks related to AI system impact.
- **CIS Benchmarks:** Applying hardened configurations to the endpoints and cloud instances where AI models reside.
## Common Pitfalls to Avoid
- **Treating AI as a Silo:** Failing to realize that an AI breach quickly becomes a traditional endpoint or identity breach.
- **Over-reliance on Pattern Matching:** Expecting traditional DLP to catch AI leaks; AI is non-deterministic and requires contextual analysis.
- **Granting "God Mode" to Agents:** Allowing AI agents to run with administrative privileges or unrestricted outbound network access.
## Resources
- **SentinelOne Labs:** Research on AI-driven malware (QUIETVAULT) - [https://www.sentinelone.com/labs/]
- **Threat Intelligence:** Insights on AI supply chain attacks (LiteLLM/Claude CLI) - [defanged link: sentinelone[.]com/blog/how-sentinelones-ai-edr-autonomously-discovered-and-stopped-anthropics-claude/]
- **Platform Demo:** Unified security for the agentic stack - [https://www.sentinelone.com/request-demo/]