Rug Pull Attack

A rug pull attack is a delayed poisoning pattern where a tool appears safe during review and then changes later on the provider’s server. The agent fetches the new description at runtime, so the approved state and the active state are no longer the same.

Expanded Definition

Rug pull attack describes a delayed poisoning pattern in which a tool, prompt, or model-adjacent artifact appears acceptable during review, then changes after approval on the provider’s server. The agent retrieves the updated version at runtime, so the reviewed state and the active state diverge. In NHI and agentic AI governance, this matters because the control surface is not only the code that launched the tool, but also the remote content the tool can later fetch. This pattern is closely related to supply-chain manipulation and runtime trust drift, and it is especially dangerous where agents have tool access, broad execution authority, or implicit trust in remote instructions. NHI Management Group’s guidance on identity exposure and secret misuse shows how quickly attacker-controlled changes can turn a seemingly safe integration into an active compromise path, especially when service credentials are already overexposed in the environment. For broader threat context, compare this with the OWASP NHI Top 10 and the MITRE ATLAS adversarial AI threat matrix. The most common misapplication is treating a one-time review as permanent trust, which occurs when runtime-fetching tools are allowed to change behavior without re-validation.

Examples and Use Cases

Implementing detection and control for rug pull attack scenarios often introduces friction, because teams must balance faster vendor updates against the need to re-check what an agent will actually consume at execution time.

• A plugin passes security review, but the provider later swaps a benign instruction block for a harmful one that the agent loads at runtime.
• A remote tool schema is approved during testing, then its field descriptions are edited server-side to bias the agent into disclosing secrets or escalating actions.
• A SaaS connector returns a different policy payload after deployment, causing the agent to follow changed instructions without any local code change.
• An operator trusts a published integration because it matched review notes, but the live endpoint now redirects the agent to a different upstream instruction source.
• Attackers exploit exposed credentials elsewhere in the stack, then use runtime access to alter remote artifacts and stage a delayed payload, a pattern discussed in LLMjacking: How Attackers Hijack AI Using Compromised NHIs and mirrored in fast-abuse behavior documented by CISA cyber threat advisories.

Why It Matters in NHI Security

Rug pull attack matters because NHI risk is often hidden in trust assumptions about remote dependencies, not just in the credentials themselves. When an AI agent can fetch live instructions or tool metadata, a compromised provider, poisoned repository, or altered API response can convert a previously approved NHI workflow into an active incident. NHI Management Group’s research shows how fragile this trust layer can be: Ultimate Guide to NHIs — Why NHI Security Matters Now notes that 97% of NHIs carry excessive privileges, which means a late-stage content change can have outsized impact once an agent acts on it. This is why runtime validation, content integrity checks, provenance controls, and change monitoring must extend beyond initial approval. The same logic appears in broader control guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where configuration and integrity controls are applied to external dependencies. Organisations typically encounter the consequences only after a tool behaves differently in production, at which point rug pull attack becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Attack Surface Management
• Why does Agentic AI make NHI attack surface expand so significantly?
• What is the difference between attack surface management and NHI governance?
• Why do NHIs create a larger attack surface than human users?