diff --git a/README.md b/README.md
index 33703c4c1..a92021bdc 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,7 @@
   - [Node.js](#nodejs)
   - [Python](#python)
 - [🗂 Repository Structure](#-repository-structure)
+- [⚠️ Managing Risk](#%EF%B8%8F-managing-risk)
 - [🤝 Contributing](#-contributing)
 - [📜 Documentation](#-documentation)
 - [🌙 Nightly Builds](#-nightly-builds)
@@ -192,6 +193,21 @@ agentkit/
 │       └── strands-agents-cdp-server-chatbot/
 ```
 
+## ⚠️ Managing Risk
+
+AgentKit gives an AI agent a wallet. LLMs do not reliably distinguish instructions from data, so text that reaches the model's context can influence which actions the agent takes, including transfers. This is inherent to the design and cannot be resolved within the SDK.
+
+Every surface that feeds the model text increases the injection surface:
+
+- **Direct** — interfaces where a third party sends text to the agent, such as a public website, chat bot, or API.
+- **Indirect** — actions that pull external content into context. `twitterActionProvider` returns mentions and `farcasterActionProvider` returns profile data, both as tool output the model reads.
+
+Either surface, combined with a funded wallet and a fund-moving action provider (`walletActionProvider` is registered by default), is sufficient for injected text to result in an onchain transfer. AgentKit does not gate transfers behind human approval, enforce spend caps, or allowlist destinations.
+
+By using AgentKit you accept that managing these surfaces and keeping your funds safe is your responsibility as the developer.
+
+Guardrails middleware is one common strategy. See the [LangChain middleware docs](./typescript/framework-extensions/langchain/README.md#middleware) and the [guardrails chatbot example](./typescript/examples/langchain-guardrails-cdp-chatbot), which combines human-in-the-loop approval for transfers with prompt injection filtering.
+
 ## 🤝 Contributing
 
 **AgentKit is actively looking for community contributions!**
diff --git a/SECURITY.md b/SECURITY.md
index 35c5d7eb1..5f2ae7d5b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -4,4 +4,8 @@ The Coinbase team takes security seriously. Please do not file a public ticket d
 
 Please report your findings through our [HackerOne][1] program.
 
+## Prompt Injection
+
+Prompt injection is inherent to giving an AI agent a wallet and is not treated as a vulnerability in AgentKit itself. See [Managing Risk](README.md#%EF%B8%8F-managing-risk) for the risk model and mitigations.
+
 [1]: https://hackerone.com/coinbase