ai agent security in 2026: what's real and what's hype - By Sourav Mishra (@souravvmishra)
a simple fact-check of 2026 ai agent security issues, and what framework docs don't tell you.
i keep an eye on ai agent security issues. not every scary story is true. but the ones that are real change how i build things.
in this post, i, sourav mishra, will summarize the real security issues, what they have in common, and how i protect my own code from them.
the real issues i track
echoleak (cve-2025-32711) — this hit m365 copilot. it allowed data to leak through the chat. any agent with access to company data is a target. keep your agent's access tight.
drift — one integration got hacked, and it spread to hundreds of companies across slack, google workspace, and aws. agents with too many integrations cause massive damage. give them only the access they strictly need.
amazon kiro — an internal agent deleted over 800 servers and 23 databases. it caused a huge outage. autonomy without limits is super dangerous. always use human approvals for big, destructive actions.
crewai "uncrew" — an internal github token leaked, giving away high privileges. default setups for agent frameworks are risky. don't trust the defaults, and never share secrets in production.
what the research says
studies in 2026 show that agent frameworks aren't bad by themselves. the danger comes from how you use them.
for example, crewai was tricked into leaking data when its tools were too open. magentic-one ran bad code when given a malicious file.
multi-agent setups are even riskier. if agent a gets hacked, it passes bad info to agent b without checking. unit 42 noted that most frameworks don't force safe patterns. you have to build them yourself.
the main problem is always the same: too much access, no step limits, and trusting the agent too much.
how i protect my code
i give every single agent the minimum access it needs. no shared .env files in production.
if i have multiple agents, i check their handoffs. i use schema checks or a gatekeeper so one bad output doesn't ruin everything.
i also put hard limits on loops. in the vercel ai sdk, i use stopWhen: stepCountIs(N). you can see this setup in my agentic chatbot guide.
for multiple agents, read my multi-agent security post.
the frameworks won't do this for you. you have to add these rules yourself.
key takeaways
- verified incidents: echoleak, drift, kiro, crewai uncrew. they all happened because of too much access and missing limits.
- research: agents can be tricked if they have too much freedom. always check data when agents talk to each other.
- what to do: use strict limits, narrow tool access, and keep humans in the loop for big actions. see my agentic chatbot guide.
written by sourav mishra. full stack engineer, next.js and ai.
frequently asked questions
q: is crewai unsafe? no. the risk is in how you set it up. you still need to limit access and steps yourself.
q: what is echoleak? it was a data leak in m365 copilot. it shows why agents with enterprise data need strict boundaries.
q: why are multi-agent setups risky? if one agent gets hacked, it passes the hack down the line. always verify data between agents.
q: how do i build safe agents? use single agents first, cap their steps, and limit their tools. read my agentic chatbot guide for code examples.