Adding a large language model to a business system does not just add a new feature. It adds a new kind of attack surface, one that traditional application security reviews are not fully designed to catch. Treating an LLM integration like a normal API call misses the parts that actually go wrong.
The new attack surface an LLM introduces
Unlike a typical API, an LLM's behavior can be influenced by the content it processes, not just the code that calls it. A document, an email or a support ticket can contain instructions aimed at the model itself, not at the human reading it. Any system where an LLM reads untrusted content and can also take action needs to account for this from the start.
Data access and least privilege
An AI agent should have exactly the access it needs for its task, and no more. This means scoped API keys, read-only access by default, and explicit approval for anything that writes to production systems or exposes data across customer or department boundaries. The convenient shortcut of giving the model broad access "to see what it can do" is the single most common security mistake in early AI pilots.
Prompt injection and why it matters for agents
Prompt injection becomes a real risk the moment a model can both read external content and take an action. A support inbox, a scraped web page or an uploaded document can contain text designed to redirect the model's behavior. The mitigation is architectural, not just a better prompt: separate the content the model reads from the instructions it is allowed to act on, and require explicit confirmation before any consequential action.
Logging, monitoring and human review
Every prompt, tool call and output that leads to a business action should be logged in a way that can be audited later. This is not just for security incidents. It is what makes it possible to explain why the system did what it did, which matters as much for debugging as it does for compliance.
A short checklist before you ship
- Does the model have the minimum access it needs, and nothing more?
- Is there a clear boundary between content the model reads and instructions it can act on?
- Does every consequential action require explicit confirmation or human review?
- Is there an audit log that would let you reconstruct exactly what happened, and why?
- Is there a way to disable the system quickly without disrupting the systems around it?
You bring the problem.We figure out the technology.
No sales pressure. We will first understand what you are trying to fix, then tell you honestly how we would approach it, including when the answer is simpler than you think.