Four posts, 247 papers, named exploits with documented success rates later: here's the practical part. Not another research recap, but a point list to score your own agent against, before someone else does it for you.
Each of the series' four prior posts delivered one building block. Here's the short version of each, followed by its matching score.
The series in four sentences
1. The attack surface. In 2026 the agent itself became the attack surface: it can be tricked into using its own capabilities against you, from legacy shell-quoting tricks to bug reports read as instructions. The Year AI Agents Became the Attack Surface →
2. The lethal trifecta. 98% of production agents combine private data, untrusted content, and external communication; only 11% pass a blast-radius check. You get out via architecture, not prompting. The Lethal Trifecta: Why 98% of AI Agents Are Sitting Ducks →
3. The lifecycle. 247 papers distilled to one finding: individual defenses work but don't compose, and most benchmarks measure the wrong things. Agent security is systems engineering with an LLM at its core. 247 Papers Later: Agent Security Is a Systems Problem →
4. The defenses. Zero Trust for agents, treating internal agents as insider threats, certified defenses against memory poisoning. The shared instinct: don't trust the model, shrink what you have to trust. The Defense Playbook for AI Agents Is Finally Taking Shape →
The self-assessment
Four sections, one per post above. Answer honestly for the agent you actually run in production, not the one you wish you ran. Add it up at the end.
1 // Trifecta score (max 3)
| Question | Point if |
|---|---|
| Does your agent have access to private data (files, database, secrets)? | 1 pt if NO |
| Does it process untrusted content (web pages, emails, documents, tickets)? | 1 pt if NO |
| Can it communicate externally (send email, make API calls, hit URLs)? | 1 pt if NO |
Trifecta score: ___ / 3. A low score doesn't automatically mean safe, it means you have fewer of the three legs at once. If you have all three, you're in the majority (98%) and should be extra strict on the remaining three sections.
2 // Lifecycle score (max 5)
| Question | Point if |
|---|---|
| Is input validated or separated from system instructions before processing? | 1 pt if YES |
| Does the planning phase have an explicit trust boundary (does the agent know what's trusted)? | 1 pt if YES |
| Does tool execution run on per-action least privilege, not global authority? | 1 pt if YES |
| Is memory/state provenance-tracked (do you know where every stored fact came from)? | 1 pt if YES |
| If multi-agent: are there limits on what one agent can take as true from another? | 1 pt if YES (or n/a: no multi-agent) |
Lifecycle score: ___ / 5. Every phase without a control is a phase where a prompt injection can cash in without you seeing it.
3 // Defense score (max 4)
| Question | Point if |
|---|---|
| Do you treat your own agent as an untrusted actor (Zero Trust), instead of trusting it implicitly? | 1 pt if YES |
| Do you have controls that hold even if the agent acts against your interests (not only if it "wants" to)? | 1 pt if YES |
| Are newly written memories audited before they count as trusted context? | 1 pt if YES |
| Does security-relevant policy live in system config rather than editable conversation memory? | 1 pt if YES |
Defense score: ___ / 4. This is where most teams score weakest, because it demands architecture work rather than prompt work.
4 // Attack-pattern score (max 4)
| Question | Point if |
|---|---|
| Is your command guard hardened against legacy shell-quoting tricks (not just the obvious pattern)? | 1 pt if YES |
| Is your agent unable to reach internal/localhost targets while browsing (SSRF protection)? | 1 pt if YES |
| Is code fetched at runtime (dependencies, scripts) checked or pinned, rather than blindly executed? | 1 pt if YES |
| Is your agent skeptical of unverified urgency or authority claims arriving via user-facing channels (tickets, bug reports, comments)? | 1 pt if YES |
Attack-pattern score: ___ / 4. These four patterns aren't hypothetical, they have names and documented success rates (see post 1).
Total score and where you stand
Add up the lifecycle, defense, and attack-pattern scores (max 13) and keep the trifecta score as context alongside, it doesn't count directly toward the total because it measures attack surface, not hardening. The 13 hardening points drive the overall read:
| Points (out of 13) | Where you stand |
|---|---|
| 0–4 | Critically exposed. Most of the known attack patterns likely work unmodified. |
| 5–7 | Workable but exploitable. Individual controls exist, no trust boundaries that hold together. |
| 8–10 | Hardened, gaps remain. You're in the minority that would actually pass a blast-radius check. |
| 11–13 | Solid baseline. Keep testing, no control is final, see the certified defenses from post 4. |
If your trifecta score is 3/3 (all three legs present) and your hardening score is under 8, you're in the group the research from post 2 should worry most: full attack surface, incomplete defense.
Nothing in this assessment is new. Every question comes directly from one of the four prior posts. The point isn't to learn something new, it's to apply what you already learned to the one agent you're actually responsible for. You can't prompt your way out of the lethal trifecta. You have to architect your way out, and this score tells you where to start.