Those three capabilities form a complete exfiltration path. An attacker can hide instructions in content the agent is meant to process, then use the agent’s own permissions to retrieve sensitive data and transmit it outward. No malware or stolen credentials are required, so traditional endpoint defenses may never see the attack chain.
Why Agents Become Higher-Risk When They Can Read, Retrieve, and Send
An agent with all three abilities can turn ordinary workflow steps into a complete abuse path: it can ingest malicious instructions, reach into connected systems, and return data or actions to an external destination. That combination matters because the trust boundary moves from a single tool or application call to a chain of delegated actions that may look legitimate at each step. The problem is not just access, but continuity of access across input, context, and output.
This is why agent risk rises sharply once read permissions and outbound communication are paired. A prompt, document, ticket, or message can become the delivery vehicle for hidden instructions, while the agent’s own credentials supply the authority to act. A useful way to think about it is that the attacker no longer needs to steal a session; they only need to influence the agent’s decision path. NHI Mgmt Group research shows how common that exposure can be: 97% of NHIs carry excessive privileges, which broadens the attack surface when an autonomous workflow is allowed to read and send on behalf of the organisation.
OWASP Agentic AI Top 10 frames this as a design problem in which tool use, memory, and output channels must be treated as part of the security boundary. In practice, many security teams discover the issue only after an agent has already been trusted to bridge systems that were never meant to be connected by one decision-making workflow.
How It Works in Practice
The risk emerges because each capability strengthens the next. Read access lets the agent consume content or query data. Decision logic lets it decide what is relevant, which is useful for productivity but dangerous when instructions can be hidden inside content. Send access then provides the exfiltration or action channel, which means the agent can move information outward, trigger side effects, or relay content into another system without a human in the loop.
In practical deployments, this often shows up in one of three patterns. First, the agent is asked to summarise content and ends up following attacker-supplied instructions embedded in that content. Second, the agent is allowed to query internal systems and can be steered to over-collect data beyond the original user intent. Third, the agent can send messages, create tickets, open pull requests, or call webhooks, which turns the output channel into an outbound control path. The key weakness is that traditional IAM may say each step is individually authorised, while the overall chain is not.
NIST AI Risk Management Framework is useful here because it emphasises mapping AI system behaviour to risk, not just securing the model in isolation. For identity-heavy deployments, OWASP Non-Human Identity Top 10 helps teams focus on the credentials, tokens, and service identities that make the read and send path possible. The operational lesson is that short-lived, tightly scoped access is safer than long-lived standing permissions, especially when the agent can act across multiple tools.
JIT-style access, bounded output destinations, and explicit policy checks reduce the chance that one compromised input becomes a full data path. They also make it easier to detect when an agent is trying to do something outside the expected task. These controls tend to break down when agents are given broad workspace access and unrestricted egress because the system can no longer distinguish normal task completion from covert data movement.
Common Variations and Edge Cases
Tighter control often reduces automation speed, so organisations have to balance productivity against blast radius. That tradeoff becomes most visible in agents that support many tools, multiple users, or cross-environment workflows, because the convenience of one reusable identity can quickly become the main source of exposure.
One edge case is read-only access that still leaks sensitive information through summaries, classifications, or transformed output. Another is an agent that cannot directly access a sensitive system but can instruct another connected service to do so on its behalf. There is no universal standard for every agent architecture yet, so current guidance suggests treating both indirect retrieval and indirect output as security-relevant, not just direct secret access.
Anthropic — first AI-orchestrated cyber espionage campaign report is relevant as a threat reference because it illustrates how autonomous workflows can be chained into reconnaissance, collection, and delivery phases. The main exception to watch for is constrained internal agents that cannot reach sensitive data or external destinations at all; once either boundary is relaxed, the risk profile changes materially and must be reassessed. What looks safe in a sandbox often becomes dangerous the moment the agent is connected to production data and outbound channels.
Risk and Threat Considerations
The material risk is covert data exfiltration through trusted automation. When an agent can read content, access data, and send output, an adversary can abuse the agent’s own authority to move data out without stealing credentials or deploying malware.
Failure mechanism: Prompt or content injection steers the agent’s reasoning, the agent retrieves sensitive data through legitimate permissions, and the output channel carries the data to an external endpoint, message, file, or API.
Impact: Confidential information can leave the environment under valid authentication, traditional endpoint tooling may miss the chain, and investigators may struggle to separate normal task execution from malicious exfiltration.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 — Prompt Injection | Hidden instructions in content can steer agent actions and data access. |
| A2 — Excessive Agency | Read, access, and send together create overbroad autonomous capability. | |
| Recommendation — Harden agent prompts and tool boundaries against instruction injection. Limit agent autonomy to the minimum action set needed for the task. | ||
| CSA MAESTRO | GOV-01 — Governance and Oversight | Agent workflows need explicit governance over delegated actions and outputs. |
| Recommendation — Define approval and oversight for high-impact agent actions. | ||
| NIST AI RMF | MAP-1 — Map the AI Context | The full read-access-send chain must be mapped as a risk-bearing workflow. |
| Recommendation — Map agent data flows and trust boundaries before enabling autonomy. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secrets and Credential Management | The risk depends on the credentials and tokens that power read and send access. |
| Recommendation — Scope and rotate agent credentials to constrain exfiltration paths. | ||
| CIS Controls v8 | 6.3 — Credential Access Management | Agent permissions should be tightly controlled and revoked when not needed. |
| Recommendation — Restrict agent access to only the credentials required for the workflow. | ||
Practitioner Guidance
What to prioritise: Treat the output path as part of the control surface, not just the input path. If an agent can read sensitive sources and send text, files, or API calls outward, assume the full workflow can be repurposed unless the destination, scope, and content types are tightly bounded.
Decision rule: If the agent can access production data, require time-limited credentials, explicit destination allowlists, and reviewable logging before allowing autonomous send actions. If any of those are missing, keep the agent in assisted mode rather than fully autonomous mode.
What to verify: Verify that the agent cannot escalate from one approved tool call to another unapproved one, and that hidden instructions in retrieved content do not override task intent. Also verify that revoked access really stops the agent from reaching the source system, not just the user interface.
Practitioner takeaway: The core issue is not whether the agent is “trusted”; it is whether its permissions, memory, and output channels are bounded enough that a single malicious input cannot become a complete data-loss path.
