원본 영상을 바탕으로 AI의 도움을 받아 작성했습니다. 원본 영상이 기준입니다.
Log in to leave a comment
아직 작성된 글이 없습니다
When building autonomous agents with LangChain or LlamaIndex, you eventually hit the moment where you need to connect them to databases and external APIs. This is usually where disaster strikes. A single prompt injection attack can compromise the OpenAI master key or database admin password stored in .env. No matter how tightly you craft your prompt guardrails, it won't help. As long as the LLM's reasoning domain and execution domain are tightly coupled, your security can easily be breached with a single sentence.
According to Google's 2025 SAIF (Secure AI Framework) report, 88% of companies adopting AI agents experienced prompt injection attempts. Traditional text pattern detection techniques yielded a blocking rate of just 23%. You're better off simply not trusting the agent process at all. Instead of granting permissions directly to the agent, you should shift to an architecture where dynamic 60-second temporary tokens are injected at the middleware layer.
By leveraging HashiCorp Vault's AppRole authentication, you can issue 60-second tokens precisely at the moment a tool is called. When the agent makes a request to an external API, an interceptor steps in to inject a short-lived token into the headers.
`typescript
import { Request, Response, NextFunction } from 'express';
import vault from 'node-vault';
interface VaultAppRoleAuth {
roleId: string;
secretId: string;
}
export class EphemeralTokenInjector {
private vaultClient: any;
private roleId: string;
private secretId: string;
constructor(endpoint: string, auth: VaultAppRoleAuth) {
this.vaultClient = vault({ endpoint });
this.roleId = auth.roleId;
this.secretId = auth.secretId;
}
private async getAppRoleToken(): Promise {
const result = await this.vaultClient.approleLogin({
role_id: this.roleId,
secret_id: this.secretId,
});
return result.auth.client_token;
}
public createToolInterceptor(targetServiceRole: string) {
return async (req: Request, res: Response, next: NextFunction) => {
let clientToken: string | null = null;
try {
clientToken = await this.getAppRoleToken();
const dynamicSecret = await this.vaultClient.write(
`sys/leases/generate/${targetServiceRole}`,
{ ttl: '60s' }
);
req.headers['authorization'] = `Bearer ${dynamicSecret.data.token}`;
req.body.ephemeralContext = {
leaseId: dynamicSecret.lease_id,
expiresAt: Date.now() + 60000,
};
next();
} catch (error) {
res.status(500).json({ error: 'Failed to inject ephemeral dynamic secret' });
} finally {
clientToken = null;
}
};
}
}
`
Writing the code isn't the end of the story. Because the heap memory of Node.js's V8 engine relies on garbage collection running unpredictably, token strings remain in the heap for a while even after you clear the variables. If subjected to a heap dump attack, there is a risk of data exposure.
Buffer object immediately upon receiving the API response.Buffer.fill(0) to forcibly zero out the bytes.null to the reference variables so they are handed over for garbage collection.Taking care of these three steps significantly reduces the probability of token leakage via memory profiling.
| Credential Management Approach | Average Lifetime (TTL) | Impact Scope Upon Theft | Audit Trail |
|---|---|---|---|
| Hardcoded Master API Key | Unlimited | Full infrastructure privilege takeover | Single key shared; impossible to identify subject |
| Environment Variable (.env) Static Secret | Process lifetime | Abuse of all privileges of that Node process | Impossible to track user-specific workflows |
| Vault AppRole Ephemeral Token | 60 seconds | Restricted to a single execution of that tool | Second-by-second tracking via Vault Audit Logs |
Even if a prompt jailbreak causes an agent to execute a command like "Fetch all member details," it doesn't matter if the database engine itself rejects it. In a multi-tenant SaaS environment, you should configure PostgreSQL's Row Level Security (RLS).
Extract the userId and tenantId from the Auth0-issued JWT and pass them into LangChain's RunnableConfig session context. Inject this context as session variables within a Prisma transaction.
`typescript
import { RunnableConfig } from '@langchain/core/runnables';
import { PrismaClient } from '@prisma/client';
export interface AgentUserClaims {
userId: string;
tenantId: string;
}
export async function executeAgentToolWithRLS(
prisma: PrismaClient,
config: RunnableConfig,
dbOperation: (tx: any) => Promise
): Promise {
const claims = config.configurable?.userClaims as AgentUserClaims;
if (!claims || !claims.tenantId || !claims.userId) {
throw new Error('Unauthorized: Missing OIDC Claims in Agent Execution Context');
}
return await prisma.transaction(async (tx) => {
await tx.executeRawSELECT set_config('app.current_tenant_id', ${claims.tenantId}, true);
await tx.$executeRawSELECT set_config('app.current_user_id', ${claims.userId}, true);
return await dbOperation(tx);
});
}
`
Passing true as the final argument in set_config ensures that the variables apply only to the current transaction scope (SET LOCAL). This is a critical configuration in database connection pooling environments to prevent previous user privileges from leaking into subsequent requests.
Now, create a policy in your SQL file that reads these session variables:
`sql
ALTER TABLE tenant_documents ENABLE ROW LEVEL SECURITY;
ALTER TABLE tenant_documents FORCE ROW LEVEL SECURITY;
CREATE POLICY agent_tenant_isolation_policy ON tenant_documents
FOR ALL
TO authenticated_agent_role
USING (
tenant_id = current_setting('app.current_tenant_id', true)::uuid
)
WITH CHECK (
tenant_id = current_setting('app.current_tenant_id', true)::uuid
);
`
With this setup in place, no matter how strange a query the agent generates, it cannot even read data outside its own tenant scope. Even if a breach occurs, your Mean Time to Recovery (MTTR) is reduced from days to mere minutes.
You can't manually test permission isolation every time a developer updates the agent tool code. By combining open-source tools Promptfoo and Microsoft's PyRIT into GitHub Actions, you can validate security on every pull request.
`yaml
name: Agent Red Teaming Security Gate
on:
pull_request:
paths:
- 'src/agents/'
- 'src/tools/'
- 'prompts/**'
jobs:
security-eval:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
cache: 'npm'
- name: Install Dependencies
run: npm ci
- name: Run Promptfoo Scan
uses: promptfoo/promptfoo-action@v1
with:
config: 'promptfooconfig.yaml'
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
github-token: ${{ secrets.GITHUB_TOKEN }}
- name: Run PyRIT Multi-Turn Test
env:
AGENT_ENDPOINT: 'http://localhost:3000/api/agent'
run: |
python -m pip install pyrit
python scripts/run_pyrit_eval.py --endpoint $AGENT_ENDPOINT --pass-threshold 0.98
`
At the server runtime, attach circuit breaker middleware that immediately halts execution upon detecting threat patterns.
`typescript
import { Request, Response, NextFunction } from 'express';
export class AgentCircuitBreaker {
private failureCount: number = 0;
private readonly threshold: number = 3;
private state: 'CLOSED' | 'OPEN' | 'HALF_OPEN' = 'CLOSED';
private forbiddenSignatures: RegExp[] = [
/ignore\s+all\s+previous\s+instructions/i,
/system::override_privileges/i,
/grant\s+role\s+admin/i,
/concat\s*(\s*select/i
];
public middleware() {
return (req: Request, res: Response, next: NextFunction) => {
if (this.state === 'OPEN') {
return res.status(503).json({
error: 'CircuitBreaker:Open - Agent execution halted'
});
}
const promptInput = JSON.stringify(req.body);
const isPatternViolated = this.forbiddenSignatures.some(sig => sig.test(promptInput));
if (isPatternViolated) {
this.failureCount++;
this.dispatchSecurityAlert(req.body);
if (this.failureCount >= this.threshold) {
this.state = 'OPEN';
}
return res.status(403).json({
error: 'Security Policy Violation: Malicious prompt pattern'
});
}
next();
};
}
private dispatchSecurityAlert(payload: any): void {
const webhookUrl = process.env.SECURITY_WEBHOOK_URL;
if (!webhookUrl) return;
fetch(webhookUrl, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
event: 'AGENT_PRIVILEGE_ESCALATION_DETECTED',
timestamp: new Date().toISOString(),
payload
})
}).catch(() => {});
}
}
`
Building the security test pipeline is straightforward:
promptfooconfig.yaml in the project root and define jailbreak and excessive-agency test rules.AgentCircuitBreaker middleware in front of your Express endpoints to halt agent execution if injection patterns are detected 3 consecutive times.By putting this architecture in place, you can save over 5 hours per week previously spent on manual prompt reviews.
| Evaluation Metric | Manual Verification Approach | Zero-Trust Automation Adoption |
|---|---|---|
| Audit Preparation Time | 5–8 hours per week | Under 1 hour per week |
| MTTR Upon Privilege Leakage | Days (Full log/DB inspection) | Minutes (Restricted to RLS scope) |
| Prompt Injection Blocking Rate | ~23% | 99.9% |
| Billing Risk on Key Leakage | Uncapped cloud billing | Prevented via 60s TTL |
The core of agent security isn't praying that the model follows instructions. It's putting handcuffs on the infrastructure layer so that even if the model hallucinates or succumbs to an attack, it remains incapable of harming the system.