Google’s SAIF 2.0 Maps AI Agent Risks to Security Controls
Summary
Google’s SAIF 2.0 maps four parts of an AI agent’s attack surface to risks and controls. The article explains agent-specific threats, uses EchoLeak as an example, and highlights least privilege, human approval, and observability.
Key points
- SAIF 2.0’s agent map divides the stack into Application & Perception, Reasoning Core, Orchestration, and Response Rendering.
- The framework identifies Rogue Actions and Sensitive Data Disclosure as agent-specific risks.
- The article describes EchoLeak (CVE-2025-32711) as a zero-click indirect prompt-injection issue affecting Microsoft 365 Copilot, where data was sent through a rendered Markdown image URL.
- SAIF’s suggested controls are limiting agent permissions, requiring human approval for consequential actions, and logging actions, tool calls, and reasoning.
- The article says Google donated the underlying risk data to the Coalition for Secure AI.
- The framework offers guidance for containing risk; the article notes it does not claim to solve prompt injection at the model level.
Article Details
- Topic
- Google SAIF 2.0's agent security map, its agent-specific risks, and recommended controls