AI agent security check: your risk score in 20 questions

How to use it

Answer the twenty questions for the agent you use, whether it is a personal assistant, a coding agent, an automation workflow or an agent that drives the browser. The score is computed with every answer, with nothing sent: your answers stay in your browser and disappear when you close the page.

• Yes: the protection is in place and you have checked it.
• No or Don't know: both count as a risk. Not knowing whether the agent can run a command without asking is already a gap.
• Not applicable: offered only when the question may not apply (no messaging, no MCP server, no exposed interface…). It does not count.

The result gives a risk score out of 100 (0 = all protections in place), a level, and the list of fixes to make, from most to least important, with a link to the relevant guide or definition when the site has one.

The method: 20 weighted protections

Each question is worth a number of points; the total is 100. The score adds up the points of missing or unknown protections. The weights are an editorial choice: the more a measure prevents serious, irreversible damage, the more it weighs. The six heaviest:

• 8 — Run the agent in a container, a virtual machine or a dedicated system account, with no access to your main session.
• 8 — Turn on command approval; only pre-approve read-only commands.
• 7 — Limit the agent to a working folder; never your whole home folder, your SSH keys or your backups.
• 7 — Don't expose the agent's dashboard to the internet: listen on localhost, access through a VPN or authenticated tunnel.
• 7 — Require human confirmation for anything that can't be undone: deletion, sending, payment, publishing.
• 7 — Treat all content read as data, never as orders: explicit instruction, separate reading and acting tools, approval before any action triggered by outside content.

The level follows three bands: 0 to 20, low risk; 21 to 50, moderate risk; above 50, high risk. The questions cover five families: isolation (sandbox, folders, network, exposure), actions (approval with a human in the loop, prompt injection, messaging), secrets and data (least privilege, dedicated keys, local model), extensions (MCP servers, skills) and monitoring (logs, updates, backups, emergency stop).

Why these protections

An AI agent is not just a chatbot: it acts. It reads files, runs commands, sends messages, calls services with your keys. The main risk doesn't come from a malicious AI but from two very ordinary causes: a misreading (the agent deletes the wrong folder) and an instruction hidden in content it reads (a web page, an email or a document asking it to send your files elsewhere). The second one, prompt injection, has no complete defence today: that is why most questions are about limiting damage rather than preventing it.

The worst danger appears when three conditions combine: the agent has access to private data, it reads outside content, and it can communicate outward. Removing just one of the three breaks the data exfiltration chain. The questions on outbound network, messaging and folders serve that purpose. They overlap with the risks described by the OWASP Top 10 for LLM Applications 2025: prompt injection, sensitive information disclosure, supply chain, excessive agency and unbounded consumption.

Extensions form the agent's supply chain: an MCP server or a skill installed without review can contain instructions or code that run with your rights. The guide Choosing an MCP server explains how to sort them. For a step-by-step setup, see Secure an AI agent.

Limits of the check

• It is a self-assessment. The score is only as good as your answers; it doesn't replace a security audit or a penetration test.
• The weights are choices. An agent that only touches a drafts folder doesn't have the same stakes as one that pays invoices: read the result in light of what it can break.
• A low score is not a guarantee. No combination of settings makes an agent immune to prompt injection; it reduces the consequences.
• Run it again. After each new extension, new access or model change, the risk profile changes. Method reviewed on October 25, 2026.