A visual, source-grounded engineering guide to the architecture, runtime control loops, tool interfaces, threat modeling, and defense in depth of autonomous AI agents.
Language models are no longer just text in, text out. We are embedding them into autonomous agentic systems: programs where models direct dynamic execution loops, plan multi-step strategies, read persistent memories, and dispatch tools that read databases, execute code, and send API requests.
This shift completely breaks traditional software security assumptions. In a standard application, control flow is hardcoded in deterministic code and separated from user data. In an agentic system, untrusted data can hijack model control flow and turn the agent's own authorized tools against the host environment.
You cannot fix prompt injection with prompt engineering or regex filters. Because language models process instructions and retrieved data in the exact same token stream, untrusted data can redirect the agent's intent. Security must be enforced at runtime boundaries, credential scopes, and tool execution gates.
Memorizing generic vulnerability lists or OWASP Top 10 badges fails when engineers don't understand how the 5-step agent loop operates, how context windows get packed, how vector stores retrieve memories, or how tool schemas are dispatched. We construct the complete distributed architecture first before attacking it.
Every assertion, boundary diagram, and defensive recommendation in this handbook is grounded in official RFCs, NIST benchmarks, Model Context Protocol specs, and peer-reviewed research. We link directly to canonical sources and provide small, runnable code tests for each boundary.
