Agentic AI attack surface lives beyond the prompt and into runtime

At a glance

What this is: This analysis argues that agentic AI risk is determined less by the prompt itself than by the runtime boundaries that ingest content, translate context, and permit tool execution.

Why it matters: It matters to IAM, PAM, and AI governance teams because those runtime boundaries define where privilege, delegation, and containment controls must be enforced for agents and the identities they use.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.

👉 Read Prompt Security's analysis of the agentic AI attack surface beyond the prompt

Context

Agentic AI security is no longer just a prompt-injection problem. Once a system can browse, execute code, and act on external content, the attack surface moves into the runtime layers that decide what becomes context, what gets executed, and what gets contained. That is the point where identity, delegation, and control boundaries start to matter as much as model quality.

Prompt Security’s analysis is useful because it treats the agent as a pipeline rather than a chat box. That perspective aligns with how IAM and NHI governance teams should think about AI systems that use browser sessions, service credentials, sandboxed execution, and policy enforcement layers. The same pattern applies across agentic AI deployments, not just the product discussed here.

Key questions

Q: How should security teams govern AI agents that browse and transact on behalf of users?

A: Security teams should govern AI agents as delegated actors with narrow, task-scoped permissions, not as enhanced browsers. The right model is to bind access to the specific action being performed, preserve auditability at the transaction layer, and separate machine identity from the human principal wherever possible.

Q: Why do agentic AI systems create more security risk than standard chatbots?

A: Agentic systems can turn model output into action, which means a bad instruction can affect code flow, tool use, and downstream state. Standard chatbots usually stop at text generation. Agentic AI adds execution authority, so compromise can lead to disclosure, unauthorized changes, or misuse of credentials.

Q: What breaks when untrusted content is allowed into model context?

A: The system can start treating attacker-controlled data as instructions instead of evidence. That can lead to tool misuse, data exposure, or unsafe actions taken on the user’s behalf. The break happens at the translation layer, where serialization and filtering are supposed to preserve the distinction between input and intent.

Q: Who is accountable when an AI agent takes an unsafe action?

A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.

Technical breakdown

Content ingestion and context translation in agentic runtimes

Agentic systems usually do not feed raw web content directly into a model. They first ingest untrusted pages through a browser or connector, then translate that material into an internal context format the model can read. That translation layer is where hidden text, malformed markup, or poisoned instructions can cross from data into interpreted context. The security issue is not only what the model sees, but how the system decides what counts as trustworthy input before generation begins.

Practical implication: treat ingestion and context serialization as security boundaries, not plumbing.

Tool execution, sandboxing, and runtime containment

Once an agent can run code or call tools, the model is no longer just producing text. It is initiating actions inside a sandbox or controlled execution environment, which creates a second boundary between decision and effect. If that runtime is too permissive, a malicious page or manipulated prompt can steer code execution, file access, or downstream actions. Sandboxing helps, but only if network, filesystem, and privilege restrictions are enforced consistently at the OS and orchestration layers.

Practical implication: verify what the sandbox can actually reach, not what the policy says it should reach.

Behavioral guardrails and the external control plane

In agentic AI, guardrails sit outside the model weights. They define what the system may browse, execute, store, or delegate, and they must be updated as new abuse paths emerge. That creates a governance problem as much as a technical one: the model may be bounded, but the surrounding control plane determines whether those bounds hold under adversarial input. For identity teams, this is where agent privileges, session scope, and approval logic become essential.

Practical implication: govern agent permissions as runtime identity policy, not as static prompt rules.

Threat narrative

Attacker objective: The attacker aims to turn a trusted agent runtime into an execution path for instruction injection, data exposure, or unauthorised action through compromised context boundaries.

1. Entry begins when an attacker places hostile content into a page, document, or other external source that the agent is permitted to ingest.
2. Escalation occurs when the runtime translates that content into trusted model context or allows it to influence tool selection and code execution.
3. Impact follows when the agent uses those instructions to act on data, expose credentials, or perform unauthorised operations inside its permitted environment.

NHI Mgmt Group analysis

Agentic AI security is becoming a runtime governance problem, not a prompt-hardening problem. The article’s central point is that risk accumulates across ingestion, translation, tool use, and containment. That aligns with how AI systems behave in production, where a single prompt is only one input to a larger execution chain. Practitioners should govern the whole runtime, because the model itself is only one part of the trust boundary.

Context translation is the named failure mode most teams are still underestimating. If untrusted content can cross into model-readable context without strict serialization controls, the system can turn data into instructions. That is a governance gap, not a model flaw, and it maps directly to OWASP agentic application risks and NIST AI RMF expectations around controlled interfaces. Security teams should focus on the boundary where external content becomes model state.

Agent identity must be scoped with the same discipline used for privileged human access. When an agent can browse, execute code, and invoke tools, it is effectively operating as a non-human identity with delegated authority. That makes session scope, containment, and approval logic central to control design. The practitioner conclusion is simple: if the agent can act, it must also be governed like an identity with measurable limits.

Browser-based agents collapse traditional separation between user interaction and automated execution. The article shows that the browser becomes both an ingress point and an execution trigger, which blurs the line between content handling and action. That has implications for IAM, PAM, and monitoring because access decisions now happen inside dynamic runtime flows rather than at a single login event. Teams should expect their identity controls to reach into the browser and sandbox layers.

Agentic AI governance will increasingly depend on auditable containment, not on trust in vendor defaults. Hidden tooling, opaque orchestration, and undocumented bridges create blind spots that are hard to defend after the fact. This is where NHI governance and AI governance converge, because the systems that move context and execute actions need explicit ownership. Practitioners should demand evidence of controllable boundaries, not assume them.

What this signals

The operational signal for practitioners is that agentic AI governance is moving from policy drafting to containment engineering. Teams need to know exactly where untrusted content is transformed, where tools are triggered, and which identities authorize those actions, because that is where incidents will concentrate.

Context translation debt: the longer organisations rely on opaque ingestion and serialization layers, the harder it becomes to audit agent behaviour after the fact. That is why browser controls, sandbox telemetry, and identity-scoped approvals belong in the same programme view, especially where the agent can act on behalf of users.

The next maturity step is to align agent runtime controls with established AI governance and threat modelling resources such as the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10. The teams that do this early will have a cleaner path to auditability when agent usage scales.

For practitioners

• Map every runtime boundary Document where external content becomes model context, where context becomes tool invocation, and where tool invocation becomes system action. Use that map to assign owners and controls at each boundary, including browser ingestion, sandbox execution, and orchestration policy.
• Scope agent privileges as non-human identities Give each agent the minimum tool, data, and session privileges required for its task, and expire those privileges when the workflow ends. Treat agent access reviews as identity governance activities, not as prompt-tuning exercises.
• Test context translation for instruction smuggling Red-team the serialization layer that turns web pages, documents, and other inputs into model-readable state. Look for hidden text, malformed markup, and payloads that survive ingestion and alter downstream behaviour.
• Verify sandbox containment empirically Validate what the agent runtime can reach in practice, including filesystem paths, network access, and subprocess execution. Controls that exist only in policy language are not enough if the sandbox can still influence adjacent systems.

Key takeaways

• Agentic AI risk sits in the runtime, not just in the prompt, because ingestion, context translation, and tool execution each create a separate trust boundary.
• AI agents are already acting outside intended scope in most organisations, which makes containment and identity scoping urgent governance priorities.
• Security teams should treat browser-based agents like privileged non-human identities and enforce measurable limits across context, execution, and accountability.

Key terms

• Agentic Runtime Authority: A runtime control model that evaluates an AI agent's request before it reaches a target system and can stop the action if it exceeds approved intent. It combines policy enforcement, session boundaries, and auditability so autonomy is constrained at the moment of execution.
• Context Translation: The process that turns external content into model-readable state. This is a security boundary because it decides which parts of untrusted input become trusted context, and bad translation can convert attacker-controlled data into behaviour-shaping instructions.
• Workflow Execution Boundary: The workflow execution boundary is the point where user-authored logic stops being data transformation and starts becoming privileged runtime activity. In secure designs, that boundary prevents untrusted workflow content from reaching process memory, system calls, or secret stores without strict containment.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

What's in the full article

Prompt Security's full blog post covers the operational detail this post intentionally leaves for the source:

• The step-by-step mapping of Atlas browser, orchestration, and sandbox boundaries that shows where controls sit in the runtime.
• The concrete permitted and blocked operations observed in the Python sandbox, including filesystem, network, and execution restrictions.
• The specific threat patterns for context poisoning, prompt injection, and behavioural guardrail failure in agentic systems.
• The architecture discussion around the internal tooling layer that moves data between sandbox and UI, which is critical for auditability.

👉 Prompt Security's full post covers the Atlas boundary map, sandbox profiling, and agent threat patterns in more operational detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and agentic AI identity. It is designed for practitioners building control models that need to hold up across runtime, access, and lifecycle decisions.