Agentic AI attack vectors expose gaps in identity governance

At a glance

What this is: This is an analysis of five emerging attack paths against agentic AI and why they expand the identity and execution risk surface beyond conventional controls.

Why it matters: It matters because IAM, PAM, and NHI programmes must now govern runtime decisioning, tool use, and delegated action across autonomous systems, not just static credentials and human access.

By the numbers:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.

👉 Read Token Security's analysis of agentic AI attack vectors and defenses

Context

Agentic AI attack vectors are the control failures that appear when a system can decide, in runtime, which action to take and which tool to use. That is the key governance problem here: traditional IAM assumes access is requested, approved, and then exercised within a bounded process, while agentic systems can turn instructions into action without that human-paced loop.

For identity security teams, the issue is not just prompt abuse or API abuse in isolation. It is the broader question of how to govern non-human actors whose privileges, data access, and execution paths can change during a session, especially when those actors can chain actions, trust external inputs, and influence each other.

Key questions

Q: What breaks when agentic AI is allowed to turn untrusted text into action?

A: The main failure is that reading and executing collapse into the same control plane. If an agent can convert a prompt, webpage, file, or chat message into a task without verification, attackers can drive privileged behaviour through content that should have remained inert. Security teams need a separate trust boundary between ingestion and execution.

Q: Why do agentic AI systems complicate least-privilege governance?

A: Because privilege is no longer just a provisioned state, it becomes a runtime behaviour. Agents can select tools, chain actions, and expand their effective authority through workflow context, so least privilege must be evaluated at execution time as well as at account creation. Static entitlements alone do not describe the real blast radius.

Q: What do security teams get wrong about multi-agent AI risk?

A: They often assess each agent in isolation and miss the trust that flows between agents. A compromised agent can influence others through shared outputs, shared assumptions, or recursive delegation, which means the attack surface is the whole chain, not a single model or tool. Isolation and inter-agent verification are essential.

Q: Who is accountable when an autonomous agent repeats harmful actions through a loop?

A: Accountability sits with the organisation that allowed self-triggered execution without hard limits, not with the loop itself. Teams should assign ownership for the workflow, the tool permissions, and the stop conditions that prevent repeated side effects. Governance must cover recursion, re-entry, and approval bypass as explicit control failures.

Technical breakdown

Prompt injection and action-layer control failure

Prompt injection is effective because modern agents treat text, files, webpages, and chats as operational inputs, not just information. Once a malicious instruction reaches the action layer, the agent may convert it into a real task, especially when safety checks are weak or absent. In practice, the risk is not that the prompt is clever. The risk is that the agent has been allowed to translate untrusted content into executable intent. That breaks the boundary between reading and doing.

Practical implication: separate untrusted content ingestion from executable action approval and require policy checks before the agent can act.

API hijacking and delegated tool trust

Agentic systems depend on APIs for data, functions, and side effects, which makes API trust a primary attack surface. If authentication is weak, permissions are too broad, or responses are not validated, an attacker can steer the agent through its own tools. The security issue here is not only credential theft. It is delegated authority without strong verification of what the tool call means, what data it returns, and whether the response is trustworthy.

Practical implication: scope tool credentials tightly, validate API responses, and treat every agent-to-API call as a privileged identity event.

Action loops, recursion, and multi-agent collusion

Agentic AI often works through observe, reason, act, and refine cycles. That loop improves usefulness but also creates recursion risk, where a malicious condition can cause repeated harmful actions or sustained workload abuse. In multi-agent systems, the problem compounds because one compromised agent can influence others through shared outputs, shared assumptions, or chained instructions. The control gap is not simply lack of logging. It is the absence of runtime guardrails that limit repeated execution and prevent agent-to-agent trust from becoming an attack path.

Practical implication: impose loop limits, isolate agents, and verify inter-agent outputs before one agent can trigger another.

Threat narrative

Attacker objective: The attacker aims to turn the agent’s own trust, tools, and execution logic into a scalable mechanism for unauthorised action, data theft, or operational disruption.

1. entry occurs when malicious instructions are hidden in files, chats, webpages, or other inputs that an agent is already designed to consume.
2. credential_harvested occurs when the attacker reaches APIs, tokens, or weakly scoped permissions that let the agent perform privileged actions.
3. escalation follows when the agent repeats harmful actions through loops or when one compromised agent influences others in a multi-agent workflow.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• AI LLM hijack breach — attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Autonomous agents invalidate the assumption that access is only exercised after a stable approval cycle. Traditional IAM and NHI controls assume privilege persists long enough to be reviewed, certified, or revoked after use. That assumption fails when an agent can decide and act within the same runtime session, because the governance window is no longer human-paced. The implication is that review-centric governance stops being sufficient once execution itself becomes the decision point.

Prompt injection is not just content abuse, it is identity abuse through delegated intent. When an agent can convert external text into action, the trust problem moves from data quality into authority management. This is where OWASP-NHI and OWASP-AGENTIC both matter, because the actor is non-human even when the attack originates in a document or chat. Practitioners should treat any untrusted input that can become an action as a privileged boundary.

Multi-agent systems create an identity blast radius that conventional single-actor controls do not model. One compromised agent can contaminate outputs, influence another agent’s decisions, and multiply impact through recursive workflows. That makes inter-agent trust a governance issue, not just an engineering one. The field needs to stop thinking about isolated prompts and start accounting for chained identity behaviour across the delegation path.

Action-loop exploits show that persistence can become an attack engine when the agent is allowed to self-trigger. A looped workflow turns ordinary automation into repeated execution with compounding impact, especially where retries, exceptions, or incomplete states are treated as legitimate triggers. The core control gap is not the presence of automation. It is the lack of runtime limits on repetition, re-entry, and autonomous re-invocation. Practitioners should recognise loop governance as a first-class identity control.

Named concept: runtime authority drift. Agentic systems can begin with a narrow permission set and end with a broader effective power set once tool calls, outputs, and chained actions start influencing each other. That drift is what makes agent governance harder than static access governance. The implication is that identity programmes must examine how authority changes during execution, not just what was granted at the start.

From our research:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
• From our research: 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
• The governance gap is widening as deployment expands, so teams should pair agent controls with the broader identity guidance in OWASP NHI Top 10.

What this signals

Runtime authority drift: agentic systems can accumulate effective power during execution even when their starting permissions look reasonable. That means identity teams need to watch for tool chains, recursive delegation, and approval bypass as programme-level signals, not isolated technical oddities. The practical next step is to align review, monitoring, and containment to execution behaviour rather than static entitlements.

With 80% of organisations already reporting agent behaviour beyond intended scope, according to AI Agents: The New Attack Surface report, the risk is no longer hypothetical. Teams that already use OWASP Agentic AI Top 10 as a reference point should now map each agent workflow to a specific owner, a bounded tool set, and a clear stop condition.

The reader-level implication is straightforward: agent governance has to be embedded into identity lifecycle, access review, and privileged action controls at the same time. If those programmes remain separate, the organisation will miss the handoff points where agent intent becomes action and where one agent’s output becomes another’s input.

For practitioners

• Classify every agent touchpoint as an identity boundary Map where an agent reads untrusted input, calls tools, writes outputs, or triggers another action. Treat each boundary as a control point, not a passive integration, and require explicit approval for transitions that can change state or externalise data.
• Scope API credentials to a single agent task Replace broad shared tokens with narrowly scoped credentials tied to one action domain, one workflow, or one environment. Review whether the agent can still reach the same data or function if the token is intercepted or misused.
• Add loop and recursion limits to autonomous workflows Set hard ceilings for retries, self-triggered re-entry, and recursive delegation so an agent cannot keep acting on its own output. Pair that with anomaly checks for repeated side effects and unexpected chain length.
• Validate inter-agent outputs before reuse Do not let one agent’s output become another agent’s instruction set without verification. Use trust scoring, provenance checks, and isolation between agents so corrupted reasoning does not propagate through the workflow.
• Redesign review processes for runtime decisioning Identify controls that assume access lasts long enough to be reviewed after the fact, then redesign them for decisions that happen inside the same session. This is especially important where an agent can execute before a human can intervene.

Key takeaways

• Agentic AI expands the attack surface because untrusted inputs can become privileged actions inside the same runtime session.
• The evidence already shows the problem is operational, not theoretical, with most organisations reporting agent scope drift or missing policy coverage.
• Identity teams should govern tool access, loop limits, and inter-agent trust as first-class controls, not as optional engineering details.

Key terms

• Agentic AI: Agentic AI is software that can choose actions, tools, and execution timing during runtime rather than only following a fixed script. In identity terms, it behaves like a non-human actor that needs explicit governance over authority, boundaries, and accountability because its decisions can create real system effects.
• Prompt injection: Prompt injection is an attack where malicious instructions are embedded in content that an AI system reads and trusts. For agentic systems, the danger is that the instruction is not just interpreted but acted on, turning text manipulation into an identity and execution control failure.
• Runtime authority drift: Runtime authority drift is the gap between the permissions an agent starts with and the effective power it accumulates while acting. It can happen when tool calls, outputs, retries, or delegation expand what the system can influence, making static access reviews an incomplete view of risk.
• Inter-agent trust: Inter-agent trust is the assumption that one agent’s output can safely become another agent’s input or instruction. In multi-agent systems, this creates a propagation path for corrupted data, malicious prompts, or bad decisions, so it must be treated as a governed trust boundary, not an implementation detail.

What's in the full article

Token Security's full blog covers the operational detail this post intentionally leaves for the source:

• The article walks through concrete examples of prompt injection, API hijacking, action-loop exploits, LLM output poisoning, and multi-agent collusion.
• It includes a comparison table that maps each attack vector to a mitigation technique, which is useful when translating strategy into controls.
• The post outlines a threat-modelling approach using STRIDE and PASTA for agentic AI, including trust boundaries and behavioural threat modelling.
• It also summarises defence mechanisms such as sandboxing, trust scoring, data provenance checks, action guardrails, and red teaming for AI workflows.

👉 Token Security's full post covers the attack examples, threat-model adaptations, and defence techniques in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.