Coercion

A failure mode where an AI agent or automated system performs authorized actions that have been redirected by attacker-controlled content. The identity remains valid, but the sequence of actions is no longer aligned with the organisation’s intent or policy boundary.

Expanded Definition

Coercion describes a control failure in which an AI agent or automated system still uses valid identity and permissions, but attacker-controlled content redirects that authority into actions the organisation never intended. In NHI security, the key issue is not authentication failure, but policy drift at execution time.

Definitions vary across vendors, but the common pattern is the same: the agent accepts external instructions, embedded prompts, malicious tool outputs, or crafted workflow inputs that override normal task boundaries. This differs from simple abuse of credentials because the identity itself may be legitimate while the action sequence becomes unsafe. That makes coercion especially relevant to agentic systems operating with MCP, delegated tool access, or broad execution scopes. The NIST Cybersecurity Framework 2.0 is useful here because it frames the need to govern action pathways, not only identities.

The most common misapplication is treating coercion as a generic prompt issue, which occurs when teams ignore the downstream tool call or workflow execution layer where the redirected action actually happens.

Examples and Use Cases

Implementing coercion controls rigorously often introduces tighter content filtering, approval gates, and tool restrictions, requiring organisations to weigh agent autonomy against the cost of reduced flexibility.

• An internal support agent is tricked by malicious customer text into resetting access for the wrong account, even though the agent’s API token is valid.
• A code-assistant workflow accepts untrusted repository content and is coerced into proposing or executing changes that leak secrets from CI/CD context.
• A procurement agent reads an attacker-injected document and uses authorised spending or approval tools to carry out an unintended purchase path.
• A ticketing bot receives a crafted instruction embedded in a third-party integration response and escalates a request beyond its intended policy boundary.

These scenarios are not theoretical edge cases. NHIMG’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which amplifies the damage when an agent is coerced into using legitimate access in the wrong sequence. For implementation guidance around agent boundaries and trust assumptions, the NIST Cybersecurity Framework 2.0 remains a practical reference point.

Why It Matters in NHI Security

Coercion matters because it breaks the assumption that valid identity equals safe execution. In practice, an organisation can have strong authentication, secrets management, and RBAC, yet still suffer harmful outcomes if an agent can be steered by attacker-controlled input. That is why coercion sits at the intersection of NHI governance, agentic AI safety, and Zero Trust enforcement.

The risk becomes more acute when organisations deploy autonomous agents with broad tool access, long-lived credentials, or insufficient output validation. NHIMG data shows only 5.7% of organisations have full visibility into their service accounts, and 79% have experienced secrets leaks, which means many environments already lack the observability needed to detect redirected action paths early. Coercion also exposes a deeper governance gap: policies may describe what an agent may authenticate as, but not what it may be induced to do once authenticated. Relevant controls are commonly aligned with identity governance and zero trust thinking, including the NIST Cybersecurity Framework 2.0 and the Ultimate Guide to NHIs.

Organisations typically encounter coercion after an agent has already approved, executed, or propagated the wrong action, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• When should organisations prioritise relay and coercion controls?
• Coercion-Aware Identity Governance