An ask is the actual instruction the attacker wants the AI agent to carry out. It is usually a plain-language request such as reading data, sending a message, fetching a URL, or modifying a record. The ask is constrained by the agent’s tools, credentials, and network reach.
Expanded Definition
An ask is the operational objective embedded in an attacker’s prompt or instruction to an AI agent. In agentic environments, the ask is not merely text: it is the action the adversary wants executed through available tools, credentials, and network access. That makes it distinct from the surrounding prompt, which may include social engineering, role-play, or benign framing intended to mask intent.
Definitions vary across vendors and research groups because ask is an emerging security term rather than a formal standard term. In practice, NHI Management Group treats it as the attacker’s intended outcome, especially where an agent can read, write, browse, call APIs, or trigger workflows. This matters because the same ask may be harmless in one environment and dangerous in another if the agent has broader permissions or access to sensitive data. For governance context, readers can anchor the surrounding control discussion in the NIST Cybersecurity Framework 2.0, even though it does not formally define the term. The most common misapplication is treating the ask as harmless user text, which occurs when teams inspect prompts for toxic language but ignore the downstream action the agent is being steered to perform.
Examples and Use Cases
Implementing ask analysis rigorously often introduces review overhead, requiring organisations to weigh faster agent execution against tighter controls on tool use and data exposure.
- An attacker asks an AI agent to retrieve customer records from a CRM and summarise them in a chat response, turning a simple request into a data exfiltration path.
- A malicious instruction tells the agent to send a message to a supplier, using trusted business context to initiate fraud or business email compromise.
- An ask instructs the agent to fetch a URL and paste the result into a ticket, which can become dangerous if the URL points to a phishing page or malicious payload.
- A prompt asks the agent to modify a record in a support system, where a write action could change account status, reset controls, or create unauthorised access.
- An agent instructed to “look up the latest policy and act on it” may be steered into using stale or untrusted sources if retrieval boundaries are not enforced.
In agentic AI security, the key question is whether the ask maps to an authorised business task or an attacker-driven objective. That distinction is especially important when the agent operates across email, SaaS applications, code repositories, and internal knowledge bases. OWASP’s guidance on Agentic AI security risks is useful for understanding how tool access and indirect instruction can be abused in real workflows.
Why It Matters for Security Teams
Security teams need to understand ask because it is the bridge between language and action. A prompt may look conversational, but the ask reveals the actual operational goal, which can involve data access, message sending, record changes, or workflow execution. If that goal is not evaluated against tool permissions and trust boundaries, an agent can become a highly efficient proxy for abuse. This is where identity and non-human identity governance become relevant: the damage depends on what the agent is allowed to do, not just what it was told.
That makes ask analysis part of broader control design, not merely content moderation. Teams should align tool permissions, session scope, and approval thresholds so that high-impact asks cannot execute automatically. Where agents operate as delegated identities, the request should be assessed like any other privileged action, especially if it touches secrets, sensitive records, or external systems. NHI Management Group sees this as a practical extension of least privilege into agentic workflows, rather than a language-only problem. Organisations typically encounter the seriousness of an ask only after an agent has already sent the message, changed the record, or exposed the data, at which point containment becomes operationally unavoidable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Covers agentic AI abuse where attacker intent is carried through tool-using prompts. | |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access limits what an attacker-driven ask can cause an agent to do. |
| OWASP Non-Human Identity Top 10 | Ask becomes risky when a non-human identity can act on delegated instructions. | |
| NIST AI RMF | AI RMF governs trustworthy AI operations, including misuse of instructions to systems. | |
| CSA MAESTRO | Agentic security guidance addresses unsafe task execution and boundary bypass risks. |
Treat agent requests as identity-governed actions and bind them to bounded privileges.
