Your AI Assistant Has a Blind Spot – Here’s What to Do About It
Close your eyes and picture your business’s AI usage. Maybe it’s a WhatsApp chatbot answering customer questions at 11pm. Perhaps it’s an AI tool that drafts product descriptions for your online store, or one that summarizes hundreds of Google reviews into actionable insights. Now answer this: do you know exactly what each of those tools is connected to?
For most Malaysian SME owners, the honest answer is no. AI agents – software that doesn’t just generate text but takes actions in your systems – are being plugged into business operations faster than anyone can track. That gap between adoption and oversight is exactly where problems start.
What Happened
A new practitioner guide from Mend.io, “Securing AI agents, MCP servers & LLM apps: A practical framework”, tackles this head-on. It’s organized around three moves: see what matters, fix what matters faster, and protect AI in production. The guide ships seven reusable artifacts designed for teams to implement immediately.
The guide’s central argument is that agent behavior emerges from a model, a system prompt, retrieved context, user input, and the tools it may call. Unlike traditional software where behavior is defined by code, two identical AI deployments can behave completely differently depending on these factors. Traditional application security was built on the assumption that applications do what their code says – and agentic AI breaks that assumption entirely.
The failure modes are new too. Prompt injection arrives through data, not code. An over-permissioned agent can take harmful actions without any vulnerability being exploited. A poisoned tool description on an MCP server can redirect an agent’s behavior without touching the application. None of these show up in a typical CVE feed, which means your usual security radar won’t catch them.
Why This Matters for Malaysian SMEs
You might think this only applies to tech giants. But think about the tools you’ve adopted in the past year. Did you set up an AI customer service bot? Connect an assistant to your Google Workspace to draft email replies? Use an AI plugin to auto-generate content for your website? Each of those is an AI integration with risk attached – and the risks scale with your business just as much as the benefits do.
The guide maps out five layers of attack surface that any business should understand:
| Layer | What can go wrong |
|---|---|
| Interaction | Prompt injection, context poisoning, data exfiltration |
| Agent | Over-permissioned tools, unsafe defaults, goal hijacking |
| Integration | Poisoned tool descriptions, unscoped credentials, shadow servers |
| Model | End-of-life models, supply chain risk, unsafe generations |
| Code | Vulnerable code, framework CVEs, malicious packages |
For a Malaysian SME, the most relevant layers are interaction and integration. Your chatbot’s interaction layer includes user inputs – and someone can deliberately craft inputs to manipulate the bot into revealing internal information or performing actions it shouldn’t. The integration layer covers every tool your AI connects to: your customer database, your inventory system, your accounting software. If permissions are too broad, one compromised integration can expose everything.
The guide also advises hunting for three categories: shadow agents, unregistered MCP servers, and embedded AI frameworks. In a small business, shadow AI is everywhere – an employee signing up for an AI tool and pasting customer data into it, a freelancer connecting an AI plugin to your shared drive. You don’t need a full security team to address this. Start with a simple inventory: list every AI tool you use, what data it can access, and who is responsible for it. The guide’s 12-point misconfiguration checklist includes practical items like ensuring credentials are scoped to specific resources rather than broad service-level access, avoiding shared credentials between agents, and keeping system prompts in version control instead of editable in production.
“Agent behavior emerges from a model, a system prompt, retrieved context, user input, and the tools it may call – not code alone. Two identical deployments can behave differently.” — Mend.io practitioner guide
Prioritization and Runtime Protection
When issues do surface, the guide recommends prioritizing based on reachability, exploitability context, business context, agentic amplification, and fix availability. In plain language: how easily can someone reach this issue, how much does it affect your business, and how quickly can you fix it? Small teams can’t treat every alert with the same urgency – this framework helps you focus where it counts.
For runtime protection, the guide describes guardrails that deploy as an in-app Python SDK or as a standalone Docker API server. The implementation detail matters less than the principle: you need watchpoints on what goes into your AI system and what comes out of it. Inbound guardrails catch prompt injections and out-of-policy requests. Outbound guardrails catch credentials, personal data, and proprietary information being sent out unintentionally.
The Bigger Picture
The guide’s maturity roadmap is aligned to NIST AI RMF, OWASP AIMA, ISO/IEC 42001, and the EU AI Act – four frameworks that signal where global standards are heading. AI security is moving from optional to expected. Just as basic cybersecurity hygiene like strong passwords and regular backups became standard practice for Malaysian businesses over the last decade, AI security awareness will soon be a baseline expectation from clients and partners.
The guide includes a 15-question self-assessment across four maturity stages: Emerging, Developing, Controlling, and Leading. The full guide is available from Mend.io, and it’s worth a read for owners who want to stay ahead rather than react after a problem occurs.
AI is already part of how Malaysian businesses operate and compete. The question is no longer whether you use AI – it’s whether you use it responsibly, with visibility into what it connects to and who controls it. Five years from now, securing your AI systems will be as routine as locking your office doors. The businesses that start that journey today will be the ones their customers trust tomorrow.
Ready to Streamline Your Operations?
Technology moves fast. Your operations should keep up. AutoRunBiz builds AI systems that run your daily workflows — from WhatsApp order capture to accounting. Book a free 15-min ops audit →