Capability Overview
AI agents — autonomous software entities that plan, act, and call external tools on behalf of users or systems — are proliferating across enterprise environments faster than identity governance frameworks can adapt. Industry analysis published in mid-2026 is now formally calling out the gap: organisations are managing agent identities as if they were static service accounts or API tokens, and that mismatch creates systemic security exposure. Unlike a service account, an AI agent makes context-dependent decisions, chains tool calls dynamically, and may operate across trust boundaries without a human in the loop. This is not a marginal difference — it is a fundamentally different threat model.
Attack Surface Analysis
The core security problem is that agents inherit permissions designed for humans or fixed automated processes, but behave in ways neither model anticipates. Several new vectors emerge directly from this mismatch:
Over-privileged agent credentials as high-value targets. When an agent is provisioned with service-account-level credentials that grant broad resource access, compromising that identity — through prompt injection, supply chain attack, or credential theft — gives an attacker authenticated, seemingly legitimate access to production systems. Traditional UBA/UEBA tools trained on human behaviour patterns will not flag the anomaly.
Orphaned agent identities. Without agent-specific lifecycle management, deprecated or experimentally deployed agents may retain live credentials indefinitely, creating a persistent attack surface that no team actively monitors.
Prompt injection as a privilege escalation primitive. An agent operating under over-permissive identity is a force multiplier for prompt injection. A malicious instruction injected via a document, email, or API response can redirect the agent to exfiltrate data, move laterally, or modify configurations — all under a trusted identity that bypasses perimeter controls.
Invisible blast radius. Because agents execute programmatically and at speed, the window between initial compromise and significant damage can be minutes rather than hours, compressing defender response time below practical intervention thresholds.
Framework Mapping
- AML.T0012 (Valid Accounts): Attackers who compromise agent credentials gain access indistinguishable from legitimate agent operations.
- AML.T0051 (LLM Prompt Injection): The primary vector for redirecting a deployed agent under a trusted identity.
- AML.T0057 (LLM Data Leakage): Over-permissioned agents with access to sensitive data stores create high-confidence exfiltration paths.
- LLM08 (Excessive Agency): The OWASP category most directly applicable — agents granted more capability than their task requires are the root cause of this entire attack surface.
- LLM06 (Sensitive Information Disclosure): Agents with broad read access can be weaponised to harvest and exfiltrate credentials, PII, or intellectual property.
Threat Scenarios
Scenario 1 — Supply chain pivot via agent identity. A threat actor compromises a third-party tool integrated into an enterprise agent’s toolchain. The agent, operating under a privileged identity, executes malicious instructions returned by the compromised tool and exfiltrates secrets to an external endpoint — all logged as normal agent activity.
Scenario 2 — Prompt injection lateral movement. An attacker plants an adversarial instruction in a document processed by a customer-facing AI agent. The agent, credentialed with internal API access, follows the injected instruction to enumerate internal endpoints and relay findings to an attacker-controlled webhook.
Scenario 3 — Orphaned agent credential abuse. A proof-of-concept agent deployed during a development sprint is never formally decommissioned. Its credentials remain valid. Six months later, an attacker enumerates exposed tokens and leverages the orphaned identity to authenticate to production cloud resources.
Defender Checklist
- Enumerate all deployed AI agents across production, staging, and shadow IT environments
- Audit each agent’s permission scope — flag any that exceed documented operational need
- Implement dedicated agent identity lifecycle policies: provisioning approval, rotation schedules, and formal decommissioning procedures
- Deploy agent-specific behavioural baselines in your SIEM; do not rely on rules tuned for human or static service-account behaviour
- Enforce prompt injection mitigations at the agent’s tool-call boundary, not just at the input layer
- Require justification and approval workflows before agents are granted write or delete permissions on sensitive resources
- Include agent identities in your next red team or purple team exercise scope