Fortinet brings AI Agent security to Oracle Cloud as Prompt Injection risks move into production
Fortinet and Oracle are extending security controls for enterprise AI applications and agents running on Oracle Cloud Infrastructure through FortiAIGate. The gateway can inspect prompts, model responses, MCP tool calls and sensitive data in real time, helping enterprises address risks such as prompt injection, data leakage, unsafe agent actions and uncontrolled AI usage as agentic systems move into production.
A malicious instruction hidden inside a prompt, document or tool response may no longer result only in an inappropriate chatbot answer. If an AI agent has permission to call tools or access enterprise systems, the same manipulation could influence API calls, expose sensitive data or trigger actions inside a production environment.
Against that backdrop, Fortinet and Oracle have outlined how FortiAIGate can be deployed with Oracle Cloud Infrastructure (OCI) to provide runtime security and governance for enterprise AI applications and agents.
The model reflects a broader change in AI security: enterprises are beginning to treat prompts, agents, tools and model interactions as part of the production attack surface.
Why does moving Fortinet AI Agent security into production change the security model?
Traditional generative AI deployments were often relatively contained. A user submitted a prompt, a model generated a response, and the interaction ended there. AI agents operate differently.
Depending on how they are designed, agents may be able to:
query enterprise databases;
access internal documents;
interact with code repositories;
call APIs;
connect to Model Context Protocol (MCP) servers;
create or modify files;
trigger business workflows;
use service credentials;
perform actions on behalf of users.
That means the security boundary no longer ends at the model.
The attack surface may now extend across:
User → Application → Agent → Model → MCP Tool → API → Enterprise System
A prompt injection that successfully changes the behavior of an agent can therefore have consequences far beyond the AI interface itself.
This is why enterprise cybersecurity in the age of AI increasingly depends on access control, tool permissions, data governance and runtime monitoring in addition to model-level safeguards.
How does FortiAIGate fit into Oracle Cloud Infrastructure?
FortiAIGate is designed as a self-hosted AI security and governance gateway positioned between applications or agents and the models and tools they interact with.
Oracle describes FortiAIGate as a control point that enterprises can combine with OCI's AI services, agent capabilities and cloud governance.
Instead of allowing every application to connect directly to a model or tool, traffic can pass through the gateway first.
FortiAIGate can then inspect and apply policy to:
incoming prompts;
model responses;
MCP tool calls;
MCP tool responses;
sensitive information;
agent actions;
AI usage and spending.
The solution can run within an organization's own infrastructure, including Kubernetes environments with supported NVIDIA GPUs. This allows enterprises with stricter privacy, regulatory or data-sovereignty requirements to keep prompts, responses and logs under their own control.
For security teams, the architectural value is centralization. Without a shared control point, individual AI applications may each implement their own model connections, policies and logging. As the number of agents grows, those controls can quickly become fragmented.
How does FortiAIGate address prompt injection?
Prompt injection remains one of the most discussed risks in generative AI and agentic systems.
An attacker may insert instructions intended to override, redirect or manipulate the model's behavior.
Those instructions do not necessarily have to come directly from a user's prompt.
They may also appear inside:
retrieved documents;
web pages;
files;
tool responses;
MCP content;
external data consumed by the agent.
This creates a particular challenge for agents because they may interpret malicious content as instructions and then use legitimate permissions to act on them.
Fortinet says FortiAIGate applies AI guardrails to inspect prompts and other AI interactions before they reach the model. It can detect and block prompt injection, jailbreak attempts and other policy-violating content.
For enterprises, the important distinction is that this type of control is context-aware.
Traditional network security products are designed primarily to inspect IP addresses, signatures, protocols and payloads. AI-specific security must also understand the meaning and context of prompts, model outputs and tool interactions.
Why is MCP becoming an important AI security concern?
The Model Context Protocol is increasingly being used to connect AI applications and agents with external tools and enterprise data sources.
That flexibility also creates a new trust boundary.
An MCP server may expose tools that allow an agent to query databases, interact with internal applications or trigger external actions.
If an agent receives a malicious or manipulated tool response, or if a tool call exceeds the intended scope, the impact can move directly into enterprise systems.
Fortinet says FortiAIGate inspects:
available tool lists;
tool calls;
tool responses;
data moving between agents and MCP servers.
This inspection can be used to identify prompt injection, data leakage or malicious content within agent-tool interactions.
The issue is becoming increasingly relevant beyond Fortinet's own architecture. Oracle has separately introduced governance capabilities for enterprise MCP access, reflecting growing demand for centralized identity, policy, credential and observability controls as agents connect to business systems.
What other AI risks does FortiAIGate target?
Prompt injection is only one part of the problem.
Sensitive data leakage
AI systems may process source code, customer information, financial records, employee data or other confidential material.
Fortinet says FortiAIGate includes data loss prevention capabilities that can identify multiple categories of personally identifiable and confidential information and then alert, block or redact it.
This is particularly important when sensitive data can travel not only through prompts and outputs but also through tool calls.
The risk is already relevant for organizations allowing employees or automated workflows to use generative AI. IPSIP Vietnam has also examined data leakage risks associated with enterprise AI use, where uncontrolled input, permissions and external AI services can create exposure beyond traditional application boundaries.
Unsafe agent actions
An agent may generate a technically valid tool call while still performing an action that violates business policy.
For example, an agent could attempt to access a resource outside its approved scope or send information to an unintended destination.
Runtime policy enforcement therefore needs to consider not only the content of prompts but also what the agent is attempting to do.
Shadow AI
Employees and teams may adopt AI services without central approval.
Fortinet's architecture combines network visibility with deeper AI inspection so organizations can identify AI usage and apply policy to sensitive interactions.
Denial-of-wallet attacks
AI introduces an additional economic attack surface. Large volumes of requests, excessive token consumption or unnecessarily expensive model calls can create significant costs even if the underlying infrastructure remains available.
FortiAIGate supports budgets, rate limits and spending controls by organization, workspace, project and user.
Why is inspecting prompts alone no longer enough?
For production agents, the prompt is only the beginning of the workflow.
Consider an enterprise agent that receives a legitimate request to summarize a document and then retrieves that document from an external source.
The original user prompt may be harmless. But if the retrieved document contains a hidden malicious instruction, the agent may encounter a prompt-injection attempt later in the workflow.
Similarly, the model may produce a tool call that is syntactically valid but exceeds the user's authorization or attempts to access sensitive information.
A mature AI security model therefore needs visibility into:
prompts;
retrieved content;
model responses;
tool calls;
tool responses;
API activity;
identity;
agent actions.
This is one of the key differences between securing a traditional chatbot and securing an autonomous or semi-autonomous agent.
What governance capabilities matter for global enterprises?
For multinational organizations, AI security is not only a threat-detection problem. It is also a governance and accountability problem.
FortiAIGate provides separate workspaces where organizations can assign different models, budgets, policies and logs to individual teams or projects.
Model access can also be controlled based on organizational requirements rather than allowing every application to use every available provider.
Fortinet says the platform includes more than 50 customizable policy templates aligned with regulatory and security frameworks, including the GDPR, NIST AI Risk Management Framework and OWASP guidance for LLM, MCP and agentic applications.
Logging is another important component. Maintaining records of prompts, outputs and tool calls can help security teams investigate incidents while also giving compliance teams evidence of how AI systems were used.
For enterprises operating across multiple jurisdictions, this level of visibility may become increasingly important as internal AI governance programs mature.
What should enterprises do before putting AI agents into production?
An AI agent should be treated as an application component with access privileges, not simply as a smarter chatbot.
Define the agent's allowed scope
Organizations should document:
which systems the agent can access;
which tools it can call;
which data it may read;
which information it may modify;
which actions require human approval.
Apply Least Privilege
An agent should not inherit broader permissions than its task requires.
If it only needs read access, it should not be able to modify or delete data.
Service accounts and API credentials used by agents should be scoped as narrowly as possible.
Separate testing from production
Development and evaluation environments should not automatically have access to production credentials, production APIs or sensitive datasets.
Inspect tool interactions
Security monitoring should include tool calls, API requests and MCP interactions rather than only chatbot transcripts.
Protect sensitive data
Organizations should establish clear rules for what types of information may enter AI workflows and which data must be blocked, masked or redacted.
Require approval for high-impact actions
Human approval remains important when agents can perform actions involving financial transactions, privileged access, deletion, external communications or other high-impact operations.
How can enterprises strengthen AI agent security beyond model guardrails?
AI-specific runtime guardrails are one layer of a broader security model.
Enterprises still need to secure the applications, APIs, identities and infrastructure surrounding the agent.
Assess the systems and APIs agents can reach
An agent may connect to many components that were originally designed for human users or conventional applications.
Security testing should therefore look at the entire reachable attack surface rather than evaluating the model in isolation.
Where organizations need to validate how exposed applications, APIs or infrastructure could be abused, Penetration Testing can help identify technical weaknesses within a controlled scope.
The objective is not simply to "pentest the AI model." It is to understand whether the systems and privileges available to the agent could become part of an exploitable attack chain.
Monitor the infrastructure behind the agent
AI security controls may block malicious prompts, but incidents can still manifest elsewhere in the environment.
For example, suspicious behavior may ultimately appear as:
abnormal API activity;
unusual authentication;
unexpected process execution;
access to sensitive databases;
suspicious network connections.
A 24/7 SOC can complement AI-specific controls by monitoring the servers, cloud services, applications and identities behind AI workflows.
This becomes particularly important when an AI incident crosses the boundary between model behavior and conventional enterprise infrastructure.
Enterprise AI Agent security checklist
Inventory all production AI agents.
Document every tool and API available to each agent.
Apply Least Privilege to agent identities and service accounts.
Separate development and production environments.
Keep production credentials out of testing environments.
Inspect prompts and model outputs.
Monitor MCP tool calls and responses.
Apply DLP to sensitive information.
Log important agent actions.
Require human approval for high-impact operations.
Monitor the infrastructure behind AI workflows.
Reassess controls when models, tools or permissions change.
What does Fortinet's OCI deployment signal for enterprise AI security?
The significance of FortiAIGate on Oracle Cloud goes beyond a single product integration. It reflects a broader shift in enterprise AI security from protecting models and prompts to governing runtime behavior and agent actions.
When an AI system can access enterprise applications, code, databases or external tools, the model becomes part of a larger operational environment. Security teams therefore need controls that sit between AI decisions and the systems those decisions can affect.
For global enterprises, the key question is no longer simply: "Is the model secure?"
It is increasingly: "What can this agent access, what actions can it take, and what controls prevent a manipulated agent from affecting the business?"
That is the security model organizations will need as agentic AI becomes a production technology rather than an experimental one.
References
