Agentpedia: the AI agent security wiki
Agentpedia is a Wikipedia for AI agent security, kept small on purpose: one page per term, written to be read in five minutes, with the numbers cited. It is an agent wiki for the people who have to answer what an agent did, which tools it called, and what stopped it.
Alyria (alyria.ai) publishes it from the work of governing agents on real endpoints. Every entry follows the same shape: a definition, why the term matters, how it works, how to implement or defend against it, how Alyria handles it, and the standards it maps to. If you are looking for an agent security wikipedia that names its sources, start here.
The A to Z of AI agent security
14 entries, alphabetically. Each definition is the first sentence of the entry, so the list and the page can never disagree.
- Agentic AI governanceGovernance
Agentic AI governance is the set of decisions, written policies, controls and evidence that determine what AI agents may do in an organization, who is accountable for those actions, and how the organization proves it to an auditor or a regulator.
Read the entry- Agentic AI securityControls
Agentic AI security is the practice of controlling what autonomous AI agents can reach, what they can do and what can be proved about both afterwards.
Read the entry- AI agent detection and response (AI ADR)Operations
AI agent detection and response is the practice of recording what AI agents do, deciding which of those actions are attacks or policy violations, and stopping the next action instead of filing a report about the last one.
Read the entry- AI coding agent securitySDLC
AI coding agent security is the practice of controlling what an agent that edits code, runs commands and reads a repository can reach on a developer machine and in a pipeline.
Read the entry- AI TRiSMGovernance
AI TRiSM, short for AI Trust, Risk and Security Management, is an operating model that treats trust, risk and security as one control system across the AI lifecycle rather than three programmes with separate owners.
Read the entry- Human in the loopControls
Human in the loop approval is a control where a named person authorises a specific high-impact action by an agent before it executes, with the request and the decision recorded.
Read the entry- Least privilege for AI agentsControls
Least privilege for AI agents is the practice of giving each agent only the access it needs for the task in front of it, for only as long as it needs it, with the decision recorded.
Read the entry- MCP securityControls
MCP security is the practice of controlling which Model Context Protocol servers an AI agent can reach, what those servers can ask of it, and what data passes through them.
Read the entry- MCP server sprawlGovernance
MCP server sprawl is the unmanaged growth of Model Context Protocol servers across an organisation, where every team, project and laptop configures its own connections and nobody holds a complete list.
Read the entry- Model Context ProtocolControls
The Model Context Protocol is an open standard that lets an AI application discover and call external tools, data sources and prompt templates through a single JSON-RPC interface instead of a custom integration per service.
Read the entry- Non-human identity and agent identityGovernance
Agent identity is the credential-backed representation of who an AI agent is when it calls a system, what it is allowed to do and on whose behalf it acts.
Read the entry- Prompt injection in AI agentsThreats
Prompt injection in AI agents is an attack in which instructions hidden in content an agent reads are followed as if the user had typed them, so the agent takes actions the operator never authorized.
Read the entry- The lethal trifectaThreats
The lethal trifecta is the combination of three capabilities in one agent: access to private data, exposure to untrusted content and the ability to communicate externally.
Read the entry- Tool poisoningThreats
Tool poisoning is an attack where instructions are hidden inside a tool's metadata, such as its name, description or parameter text, so the model treats them as trusted guidance and follows them.
Read the entry
By category
Five groups, in the order a program usually works through them.
Governance
- Agentic AI governance
Agentic AI governance is the set of decisions, written policies, controls and evidence that determine what AI agents may do in an organization, who is accountable for those actions, and how the organization proves it to an auditor or a regulator.
- AI TRiSM
AI TRiSM, short for AI Trust, Risk and Security Management, is an operating model that treats trust, risk and security as one control system across the AI lifecycle rather than three programmes with separate owners.
- MCP server sprawl
MCP server sprawl is the unmanaged growth of Model Context Protocol servers across an organisation, where every team, project and laptop configures its own connections and nobody holds a complete list.
- Non-human identity and agent identity
Agent identity is the credential-backed representation of who an AI agent is when it calls a system, what it is allowed to do and on whose behalf it acts.
Threats
- Prompt injection in AI agents
Prompt injection in AI agents is an attack in which instructions hidden in content an agent reads are followed as if the user had typed them, so the agent takes actions the operator never authorized.
- The lethal trifecta
The lethal trifecta is the combination of three capabilities in one agent: access to private data, exposure to untrusted content and the ability to communicate externally.
- Tool poisoning
Tool poisoning is an attack where instructions are hidden inside a tool's metadata, such as its name, description or parameter text, so the model treats them as trusted guidance and follows them.
Controls
- Agentic AI security
Agentic AI security is the practice of controlling what autonomous AI agents can reach, what they can do and what can be proved about both afterwards.
- Human in the loop
Human in the loop approval is a control where a named person authorises a specific high-impact action by an agent before it executes, with the request and the decision recorded.
- Least privilege for AI agents
Least privilege for AI agents is the practice of giving each agent only the access it needs for the task in front of it, for only as long as it needs it, with the decision recorded.
- MCP security
MCP security is the practice of controlling which Model Context Protocol servers an AI agent can reach, what those servers can ask of it, and what data passes through them.
- Model Context Protocol
The Model Context Protocol is an open standard that lets an AI application discover and call external tools, data sources and prompt templates through a single JSON-RPC interface instead of a custom integration per service.
SDLC
- AI coding agent security
AI coding agent security is the practice of controlling what an agent that edits code, runs commands and reads a repository can reach on a developer machine and in a pipeline.
Operations
- AI agent detection and response (AI ADR)
AI agent detection and response is the practice of recording what AI agents do, deciding which of those actions are attacks or policy violations, and stopping the next action instead of filing a report about the last one.
Questions about Agentpedia
- What is Agentpedia?
- Agentpedia is a working glossary of AI agent security terms from Alyria. Each entry gives a one-sentence definition, why the term matters with sourced numbers, how the thing works, how to implement or defend against it, and where Alyria handles it in the platform.
- Is this a Wikipedia for AI agent security?
- It is the same idea at a smaller scale: one page per term, written to be read on its own, with links between related entries. Where Wikipedia aims at every subject, Agentpedia aims at the vocabulary a security team needs when it governs agents on real endpoints, so an agent wiki page here answers what the term means for your rollout.
- How is this different from an agent security wikipedia article written by a community?
- Every entry is written and maintained by Alyria, with a named update date, and the statistics are cited to their primary sources so you can check them. When a number changes, the entry changes.
- Which AI agent security terms should we start with?
- For a program that is starting: AI agent detection and response, agentic AI governance, MCP security and prompt injection. Those four cover the control, the accountability model, the protocol layer and the attack that keeps working.
- Can we suggest a term?
- Yes. Send the term, and where you saw it used, through the contact page. Entries are added a few at a time, in the order readers ask for them.
Missing a term? Send it to us and we will add it to the list.
Reading about agents is the easy part.
The free Agent Exposure Report inventories every AI agent, tool and MCP server on your endpoints, which is where most programs start.