What security guidance does Anthropic publish for building safe AI agents?

Anthropic's security guidance for building safe AI agents emphasizes building guardrails around the model, assuming untrusted content, and implementing layered controls. This guidance covers prompt injection mitigation, secure computer and code use, and the Model Context Protocol (MCP).

• Prompt Injection Defenses Anthropic recommends pre-screening user inputs, classifying harmful requests, constraining output formats, and using separate lightweight models or deterministic code for safety checks. All external content, such as webpages or emails, should be treated as untrusted instructions, and structural separation should be used between system policy, user intent, and retrieved context. This addresses the OWASP LLM Top 10 risk of Prompt Injection (LLM01).
• Authentication and Authorization Authentication and authorization should be managed outside the model, with API keys, workspace credentials, MCP server tokens, and code-agent permissions scoped to the minimum necessary task and environment. Application code, not the model, should determine if an action is allowed based on the authenticated user, risk score, and destination system. This aligns with NIST AI RMF's Govern function, specifically regarding access control.
• Isolation and Sandboxing Anthropic repeatedly emphasizes isolation, such as making Claude Code read-only by default, using sandboxed bash options, and restricting write access to working directories. For computer use, agents should operate in trusted virtual machines or containers with minimized privileges. Code-generating agents should be executed in isolated environments without lateral network access, and planning agents should be separated from execution agents. This helps mitigate risks related to insecure plugin design (LLM07) and excessive agency (LLM09).
• Data Handling and Retention Prompts, retrieved documents, screenshots, logs, and tool results should be treated as sensitive operational data. Organizations should limit retention, redact secrets before model calls, avoid pasting credentials into prompts, and maintain audit logs. For persistent memory, review memory writes, separate users and tenants, and provide deletion workflows. This addresses data privacy and integrity concerns, aligning with NIST AI RMF's Protect function.
• Tool Permission Scoping and Human-in-the-Loop Agents should be granted a minimal set of tools mapped to explicit business functions, using distinct service accounts per agent or action group. Human approval should be required for high-impact actions like financial transfers or privilege grants, with approval workflows showing the proposed action, model reasoning, and retrieved evidence. This helps manage the OWASP LLM Top 10 risk of Excessive Agency (LLM09) and aligns with NIST AI RMF's Govern and Protect functions.
• Red Teaming and Evaluation Anthropic's Responsible Scaling Policy (RSP) emphasizes evaluation, adversarial testing, and risk reporting. Product teams should define harms, identify capabilities, set measurable thresholds, and document mitigations. Red teaming should include direct and indirect prompt injection, and for agents, evaluate complete traces including context, memory changes, tool calls, and data egress. This aligns with NIST AI RMF's Map and Measure functions.