tech
Securing an Always-on AI Employee
A starter framework for evaluating security and assessing risks when your AI agent works where you work
TL;DR
- Every's consulting team built an AI agent named Claudie to automate operational tasks, growing into a chief of staff role.
- Security measures were implemented to protect Claudie after initial broad access was granted to understand her capabilities.
- The article presents a generalizable security framework for AI agents, adaptable to different harnesses.
- Key threat vectors identified include supply chain attacks (malicious code in dependencies), prompt injection (external content manipulation), and internal information leakage (accidental data sharing).
- Examples of supply chain attacks include compromised npm packages like Axios and TanStack, highlighting the risk to AI agents with package installation capabilities.