Kenyan firms that connect AI agents to email, internal documents or business software face a growing security risk, as the agents can not only retrieve information but also act on it.

The danger stems from the agent’s ability to interpret instructions and then decide which tool to use, a process that can be hijacked by malicious or misleading content.

Prompt injection – where an attacker embeds hidden commands in emails, documents or web pages – can cause the model to disclose data or perform unauthorized actions, especially when the agent has write or send permissions.

OWASP flags both prompt injection and excessive agency as key risks for large‑language‑model applications, urging organisations to avoid granting broad functionality without strict limits.

A first defence is to map each agent’s access – what systems it can read, write or communicate with – and restrict those permissions to the minimum required for the specific task.

Separate preparation from execution: agents may draft emails or prepare transaction data, but a human or a dedicated approval workflow must authorise any final action such as sending messages, changing records or moving funds.

Logging all tool calls, access attempts and approvals enables forensic review if an agent is manipulated, helping investigators reconstruct the incident.

Regular testing against malicious inputs – such as crafted emails or altered documents – should be part of the security programme, using OWASP guidance to probe for prompt‑injection and over‑privileged actions.

For Kenyan organisations, these measures extend existing cybersecurity practices of identity management, permission restriction, data protection and incident response, adding a layer of oversight for the AI’s decision‑making process.