)
The Agentic Attack Surface
Author: Thijs De Clerck
How autonomous AI breaks the assumptions security programmes were built on
Executive Summary
For two decades, enterprise security has been organised around a stable assumption: software executes deterministic instructions written by trusted developers with humans making the judgement calls. Agentic AI changes this assumption. An agent plans, chooses tools, holds credentials, retains memory across sessions, and acts across multiple systems on a user’s behalf, with little to no human supervision per action.
At the core of every agent sits a large language model, and that model cannot reliably distinguish the instructions it has been given from the data it has been asked to work on, such as the email it is summarising or the document it is searching. When it is given the ability to act, every piece of untrusted data it touches becomes a potential command channel into systems that trust it. A support ticket, a PDF, a calendar invite, a web page or a message from another agent can all carry instructions. Prompt injection stops being a curiosity about chatbot behaviour and becomes a remote code execution primitive with valid credentials attached.
Three properties make this materially different from the risks the industry already manages. Agents act rather than answer, so a content-level flaw produces a real-world consequence.
Agents operate with delegated authority that expands silently through inheritance and caching, so their effective privilege exceeds what anyone documented. And agents use approved tooling over approved network paths, so their misuse looks like ordinary administration to controls built to spot anomalous binaries.
This does not invalidate existing security work. Penetration testing, red teaming and the broader assurance programme remain the foundation, and the evidence is that they are working. The fundamentals of identity, patching, segmentation and detection engineering still determine outcomes, and organisations that neglect them are compromised through entirely conventional means long before anyone touches their agents. The point is that agentic deployments add a surface those disciplines were not scoped to cover, and that surface needs to be brought inside the same programme rather than treated as somebody else’s problem.
This brief is deliberately scoped to the attack surface, the controls and the testing that address it.
Key Findings
The agent is a new class of principal
Every access control model in enterprise use assumes a “principal”, meaning a user or a service, whose intent is either expressed through authenticated human action or fixed in code. Agents fit neither category. They act on delegated authority, but their behaviour is determined at runtime by natural-language input from sources the organisation does not control.
Instruction and data occupy the same channel
This is the root cause from which most agentic risk descends. Language models receive a single undifferentiated token stream: nothing in the architecture reliably marks one span as "system policy you must obey" and another as "customer email you should merely summarise". Guardrails, delimiters and instruction hierarchies raise the cost of an attack but they do not create a trust boundary in the way that parameterised queries create one between SQL and user input.
The practical implication for a defender is uncomfortable: any content path into an agent is an input to its control flow. This includes retrieved documents, tool outputs, search results, repository issue text, calendar entries, and messages from other agents. An organisation that has carefully hardened its human-facing attack surface may have left a dozen unauthenticated content paths into a system holding production credentials.
Email is the textbook example, because the industry has spent twenty years hardening it and the numbers are still poor. Of more than 32 million high-confidence phishing emails Darktrace detected in 2025, 70% passed DMARC authentication and 38% carried novel social engineering features. That volume of well-formed, authenticated, adversarial content has historically terminated at a human who might notice something was off. Increasingly it terminates at an agent that will not, and that can act on what it reads without anyone opening the message.
Autonomy converts a disclosure bug into an action bug
In a chatbot deployment, a successful injection yields a bad answer. In an agentic deployment, it yields a bad action, executed under valid credentials, by a trusted binary over an approved network path. This is why host-centric detection performs poorly here. When an injected instruction causes a security-automation agent to chain PowerShell, cURL and an internal API to move data out, EDR sees legitimate tooling running with correct authorisation. There is no malware artefact and no exploit signature. The malicious element is the intent, and intent is not something endpoint telemetry has ever been built to evaluate.
Effective privilege is not the privilege you granted
This builds on a trend that predates agents. Darktrace records identity compromise as the single most consistent threat across the global landscape in 2025, with SaaS and Microsoft 365 account compromise together with email-based social engineering accounting for close to 70% of recorded incidents in the Americas, eclipsing pure vulnerability exploitation. Attackers already prefer to log in rather than break in, and to live off the land once inside, using the administrative tools native to the environment rather than bringing their own malware. Agents extend that same surface. They are non-human identities, holding credentials, performing legitimate-looking actions with legitimate tooling. The difference is that an agent can be persuaded to act by anyone who can get text in front of it.
Agents also delegate to other agents, inherit context, cache credentials for reuse, and validate authorisation at the start of a workflow that may execute hours later. Each of these is a well-understood distributed-systems pattern, whether confused deputy, credential caching or time of check to time of use, recombined in an environment where the orchestration logic is written and negotiated at runtime. The consequence is that an agent’s effective privilege is frequently far larger than its documented privilege, and no one in the organisation can state what it is. A finance agent that delegates to a database query agent and passes its full permission context has, in practice, granted that agent finance-level access. This is the most common and most consequential finding in agentic assessment work, and it is invisible to any review that reads the intended architecture rather than exercising the deployed system.
Deploying agentic behaviour where it is not needed expands the attack surface without adding value.
OWASP GenAI Security Project, articulating the principle of Least-Agency, an extension of least privilege to autonomy itself
Mapping the attack surface
In December 2025 the OWASP GenAI Security Project published the Top 10 for Agentic Applications, built by more than 100 practitioners and grounded in real incident data rather than projected risk. It is the most usable shared vocabulary currently available, and it is the taxonomy we assess against. The ten entries fall into four clusters that correspond to how attacks actually unfold.
Cluster 1
Subverting what the agent is trying to do
Cluster 2
Abusing what the agent can do
Cluster 3
Poisoning what the agent is built from and talks to
Cluster 4
Exploiting the human in the loop
ASI01 Agent Goal Hijack. Manipulated input redirects the agent’s objectives, task selection or multi-step plan. Distinct from single-response prompt injection because the compromise persists across the whole workflow.
ASI06 Memory & Context Poisoning. Persistent corruption of stored context or long-term memory, so the compromise survives the session that introduced it and reasserts itself against later, unrelated tasks.
ASI10 Rogue Agents. Autonomous misalignment emerging without active attacker control, meaning an agent that has drifted from intended behaviour and continues operating with production authority.
ASI02 Tool Misuse & Exploitation. Legitimate tools invoked toward attacker ends: over-privileged APIs, tool-name typosquatting, chaining an internal-only tool to an external one, or exfiltration through an approved utility such as repeated DNS lookups.
ASI03 Identity & Privilege Abuse. Un-scoped privilege inheritance, memory-based credential retention, cross-agent confused deputy, authorisation drift between validation and execution, and forged agent personas in internal registries.
ASI05 Unexpected Code Execution. Agent-mediated command injection reaching a shell, interpreter or CI pipeline. In practice this is the fastest route from a content-level flaw to full host compromise.
ASI04 Agentic Supply Chain Vulnerabilities. Malicious or tampered models, weights, datasets, plug-ins, MCP servers, A2A endpoints and agent registries. Package ecosystems are now a live distribution channel for this, not a hypothetical one.
ASI07 Insecure Inter-Agent Communication. Spoofed, replayed or unauthenticated agent-to-agent messages. Multi-agent systems routinely trust internal traffic by default, reproducing the flat-network mistake at the application layer.
ASI08 Cascading Failures. A defect in one agent propagating and amplifying across an orchestration graph faster than any human review cycle can intervene.
ASI09 Human-Agent Trust Exploitation. Over-reliance and misplaced confidence in agent output. Approval gates degrade into rubber-stamping, and agents can generate plausible output that conceals destructive errors. A control that humans stop reading is not a control.
These categories are not independent, and real attacks chain them. An injection hijacks the goal (ASI01), the hijacked plan misuses a tool (ASI02), the tool executes under inherited privilege (ASI03), and the result is written to memory where it persists (ASI06). Assessment scoped to a single category will systematically underestimate impact.
It is worth being precise about why this taxonomy is needed at all, given that several entries match problems the industry already knows. Confused deputy, excessive privilege and supply chain tampering are not new. What is new is that the orchestration layer deciding when to invoke which capability is a statistical model taking untrusted natural language as input. That single change relocates a set of well-understood weaknesses into a component that cannot be reasoned about statically, cannot be exhaustively tested, and will behave differently on the next invocation.
The adversary is running agents too
The defensive picture is only half the problem. Verizon’s 2026 Data Breach Investigations Report shows AI assistance has moved from exception to norm across the attack lifecycle, covering target selection, initial access, tooling and malware development. The median threat actor observed on an AI platform researched or executed 15 distinct ATT&CK techniques with AI support, and some reached 40 or 50. Most of that tooling reimplements well-established techniques, and genuinely rare techniques account for fewer than 2.5% of observations. The near-term threat is therefore not novel capability. It is throughput, iteration speed and the collapse of the skill floor. Attacks that previously required a competent operator now require a prompt.
The qualitative shift is that adversaries have begun using agents to manage intrusions rather than to assist an operator. In one of the first verified cases, since catalogued by MITRE ATT&CK, an agent driving an agentic coding tool through MCP servers handled reconnaissance, vulnerability discovery and exploitation, credential testing, lateral movement, privilege escalation and exfiltration against approximately thirty organisations. Human involvement was concentrated at target selection and a small number of escalation decisions.
The commercialisation is what to watch next: AI-enabled cybercrime moving from capability to product. AI-assisted playbooks and prompt-driven attack frameworks are openly traded in criminal ecosystems. Combined with the abuse of trusted SaaS platforms, that produces attacks which are scalable, reusable and hard to separate from legitimate activity, which is the same detection problem described in Section 01 arriving from the opposite direction.
For defenders, the operational consequences are immediate: dwell time compresses toward the speed of automation. Attacker activity increasingly resembles ordinary administrative behaviour, because the agent is using ordinary administrative tooling. And the economics of targeting change, because campaigns previously reserved for high-value targets become viable against the mid-market once the marginal cost of an additional target approaches zero.
The same properties that make agents useful to your engineering teams – tool use, persistence, planning and parallelism – make them useful to the people attacking you. An organisation that adopts agents without adapting its detection and testing programme is taking on the risk from both directions while capturing the defensive benefit from neither.
Extending the testing programme
Penetration testing and red teaming are not the weak link here, and nothing in this brief should be read as an argument for doing less of either. They remain the most reliable way an organisation learns what an attacker can actually achieve, and the threat data is unambiguous that conventional tradecraft still causes most losses. Phishing, edge device exploitation, credential abuse and ransomware account for the overwhelming majority of real incidents, and AI has made those attacks faster and cheaper rather than obsolete. An organisation that responds to agentic risk by diverting budget away from established offensive security work will be compromised through the front door while it worries about the side door.
Agentic deployments introduce a surface that sits outside the scope most testing engagements are written to, and that surface needs to be brought inside the same programme, tested by the same people, reported through the same channels and remediated on the same clock. The following extend the scope and cadence of existing testing rather than replacing it. Extend application testing past the HTTP boundary. A web assessment of an agent’s front end validates authentication, session handling and injection at the transport layer, and that work remains necessary. It should be extended to the content paths through which goal hijacking arrives: retrieved documents, tool responses, indexed data and inter-agent messages.
Extend model evaluation into system impact. Jailbreak and safety testing establishes whether a model will say something it should not. The scope extension is to establish what the surrounding system then does, because that is where the loss event lives. The two are complementary and neither substitutes for the other.
Extend privilege review from design to runtime. Architecture review remains valuable for finding intent-level flaws early. Effective privilege after delegation, credential caching behaviour and runtime tool resolution are emergent properties, so they need to be enumerated against the running system as well as read from the design.
Add the trust graph to red team objectives. In multi-agent deployments the highest-impact finding is usually a path: which agent can induce which other agent to act, and what authority accumulates along the way. This maps naturally onto existing red team methodology, which is already organised around paths and objectives rather than isolated findings.
Add agentic cases to purple team exercises. Detection engineering is mature at spotting anomalous binaries and known tradecraft. It is less exercised against activity where every command is issued by an approved binary under valid credentials. Adding those cases to existing purple team cycles is a small change that closes a large blind spot.
Make agentic testing continuous rather than point-in-time. An agent’s behaviour is not fixed at deployment: models are updated, prompts and tools change, memory accumulates from every user interaction, and the same input can produce a different action on the next run. A clean result from last quarter says little about the system running today, so agentic test cases belong in a recurring cycle and should be re-run whenever the model, tooling or permissions change.
Controls that hold up
The following control set is drawn from the OWASP Agentic Top 10 prevention guidance and from findings recurring across assessment work. It is ordered by the leverage it delivers relative to implementation cost. Nothing here requires a product category that does not yet exist. Most of it is the disciplined application of principles the industry already holds, extended to a principal type they were not written for.
Two closing observations. First, sequencing matters more than completeness. Per-agent identity and task-scoped credentials unlock most of the rest, and organisations that skip them find every subsequent control difficult to enforce. Second, observability is not optional here in the way it sometimes is elsewhere: without a record of what each agent did, which tools it invoked and on whose authority, an organisation cannot investigate an agentic incident at all, which means it will not know the scope of what happened even after it knows that something did.
How Spike Reply helps
Spike Reply is a full-service cybersecurity practice. We test agentic systems the way an adversary would engage them: against the deployed system, through the content paths that actually reach it, with the objective of demonstrating consequence rather than cataloguing theoretical weakness. This work sits alongside the conventional testing programme rather than in place of it, and for most clients we deliver both.
Penetration testing and red teaming. Full-scope offensive engagements across network, application, cloud and identity. This remains the core of what we do and the foundation everything else is built on.
Agentic penetration testing. Adversarial assessment against the running deployment, covering indirect injection across every reachable content path, tool misuse and chaining, privilege enumeration after delegation, memory persistence, and code execution paths from agent to host.
Trust-graph mapping. Enumeration of effective privilege across your agent estate: which agent can induce which, what authority accumulates along each path, and where the blast radius exceeds what anyone intended.
Agentic supply chain review. Provenance and integrity assessment of models, tools, plug-ins, MCP servers and registries, with an AI bill of materials as a deliverable.
Detection validation. Purple team exercises built around living-off-the-agent activity, using approved binaries, valid credentials and approved network paths, to establish whether your SOC can see it at all.
Pre-deployment assurance. Design and configuration review before agents reach production, benchmarked against the OWASP Agentic Top 10 and the control set in Section 05.
This brief is provided for general information. It does not constitute legal or regulatory advice. Figures are reproduced as published by their respective sources; methodologies differ and figures are not directly comparable between reports. © 2026 Spike Reply.