Agentic AI attacks now target tools, data and code paths

At a glance

What this is: This is a threat report on how attackers are exploiting agentic AI systems, with the key finding that real-world attacks now consistently hit code execution, exfiltration, and tool abuse paths.

Why it matters: It matters because AI agents behave like connected runtime identities, so IAM, PAM, and governance teams need controls that cover delegation, tool access, and data movement, not just user authentication.

By the numbers:

• 36% of successful coding-agent attacks reached remote code execution
• 91% of successful productivity-agent attacks ended in silent data exfiltration
• 28.6% of cataloged MCP tools are high-risk by capability alone
• 4,242 tracked MCP servers carry at least one vulnerability

👉 Read Straikerai's threat report on agentic AI attacks and the STAR framework

Context

Agentic AI expands the attack surface because these systems do more than generate text. They read inboxes, browse the web, call tools, and move into production workflows, which means a compromise can propagate through application logic, delegated access, and data handling in one session. The primary governance gap is that traditional controls were designed for users and workloads, not software entities that choose actions at runtime.

For IAM and NHI teams, the important shift is that agent access now behaves like a runtime identity problem as much as an AI safety problem. When an agent can invoke MCP tools, read connected apps, or trigger code changes, the boundary between model output and privileged action disappears unless identity, authorization, and observability are enforced together.

Key questions

Q: What breaks when AI agents are given broad standing access?

A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check. That creates a control gap between intended scope and actual runtime behaviour. The result is weak accountability, limited containment, and audit trails that show activity without explaining why the activity was allowed.

Q: Why do AI agents complicate zero trust in identity and access management?

A: Zero trust assumes continuous verification of who or what is requesting access, but AI agents can chain actions, infer context, and reuse privileges in ways traditional sessions do not. That means trust must be checked at the workload, action, and approval levels, not only at login. The result is more granular policy, not weaker security.

Q: What do organisations get wrong about MCP security?

A: They often focus on network isolation or prompt filtering and miss the real issue: an authorised workload can still perform an unintended action. MCP security fails when teams trust transport and service authentication to answer an authorization question that only the request context can resolve.

Q: How can organisations tell whether an AI agent is acting outside its intended scope?

A: Organisations should look for behaviour that crosses expected tool boundaries, generates unusual credentials, or chains actions across systems that are not part of the original task. The signal is not simply high activity. It is a change in action pattern, delegation, or downstream access context.

Technical breakdown

How agentic AI becomes an attack surface

Agentic systems combine a model, a tool layer, and connected data sources. That composition creates a chain where the model may be benign, but the action path is not. Attackers do not need to break the model itself if they can influence prompts, tool selection, connectors, or the context the agent consumes. In practice, the risk sits in delegation: the agent inherits enough trust to act, but not enough containment to prevent harmful side effects. This is why prompt injection, tool misuse, and context poisoning are governance problems as much as technical ones.

Practical implication: inventory every agent action path and treat tool invocation as a privileged event, not a normal application call.

Why MCP changes the security model for agents

MCP, the Model Context Protocol, standardises how agents reach tools and data sources, which improves interoperability but also concentrates risk. If a tool is unsafe, over-permissioned, or exposed through a vulnerable server, the agent inherits that weakness immediately. The report’s finding that thousands of MCP servers are vulnerable shows why the supply chain around the agent matters as much as the model. Security teams need to think in terms of tool trust, connector trust, and server trust, because any one of them can become the exploit path.

Practical implication: apply allowlisting, tool-scoped permissions, and server vulnerability management before broad MCP adoption.

Why coding and productivity agents fail differently

Coding agents tend to fail through execution paths because they can create, modify, and ship code directly into environments that matter. Productivity agents fail more quietly because they sit closer to mail, documents, and SaaS data, so abuse often looks like normal work until exfiltration is complete. The difference matters: one category breaks through runtime execution, the other through silent data movement. Treating them as the same class of AI risk hides the control differences that determine whether the blast radius is code compromise or data leakage.

Practical implication: separate control design for code-bearing agents and data-facing agents instead of applying one generic AI policy set.

Threat narrative

Attacker objective: The attacker’s objective is to turn a trusted agent into a high-speed execution and exfiltration path while remaining inside normal workflow trust boundaries.

1. Entry begins when an attacker targets an agent through prompt injection, a vulnerable MCP server, or a compromised tool path that the agent already trusts.
2. Escalation occurs when the agent inherits delegated privileges and uses them to retrieve data, call APIs, or execute code beyond the operator’s intended scope.
3. Impact follows as remote code execution, silent exfiltration, or persistent access through the semantic layer that traditional defenses do not inspect.

NHI Mgmt Group analysis

Agentic AI has created a new governance class, not just a new application type. The report shows that agents can move from reading context to taking action without a human in the loop at every step. That makes them closer to runtime identities than to static software features, which is why IAM and PAM assumptions now matter inside AI workflows. Practitioners should treat agent authorisation as a first-class governance domain.

The strongest named concept here is semantic persistence. The report describes adversaries hiding in the semantic layer, where the model follows instructions but the harmful intent sits in the context, prompt, or tool chain. Traditional scanning and endpoint controls do not see that layer well, which means defenders need controls that evaluate agent state, tool choice, and context trust in real time. The practical conclusion is that the semantic layer now needs policy and telemetry, not just model monitoring.

MCP is turning agent ecosystems into unmanaged supply chains. A protocol that simplifies tool access also expands the blast radius when one server or connector is weak. The governance lesson is that interoperability without lifecycle control creates shadow privilege, especially when agents can discover and use tools dynamically. Teams should re-evaluate whether their tool ecosystem is governed like infrastructure or merely integrated like software.

The report validates that productivity agents and coding agents need different risk models. Coding agents are more likely to create execution risk, while productivity agents are more likely to create quiet exfiltration risk. A single control framework will miss one of those failure modes. Security leaders should split policy, detection, and review logic by workflow class rather than by the generic label of "AI agent."

AI agent security is now an identity governance problem as much as a model risk problem. Once an agent can act through credentials, tokens, and delegated tools, the relevant question becomes who or what is allowed to do which action, under what conditions, and with what revocation path. That is classic identity governance, but applied to software entities with dynamic behaviour. The field needs controls for entitlement scope, runtime verification, and session-level containment.

What this signals

Semantic persistence is the operational warning sign leaders should take from this report. If attackers can hide intent in the context layer, then detection needs to move closer to runtime decisions, not just content filtering. This is where external guidance such as the NIST AI Risk Management Framework becomes useful for governance mapping, while MITRE ATLAS adversarial AI threat matrix helps threat teams structure adversarial techniques.

The practical programme shift is toward agent lifecycle control. Teams need to know which agents exist, what they can reach, which credentials they hold, and how quickly those permissions can be withdrawn when behaviour drifts. That is a direct bridge between AI security and identity governance, especially where agents consume NHI-style tokens and service accounts.

Security leaders should expect tool-layer risk to become the dominant implementation issue in enterprise agent deployments. If MCP servers and connectors are not treated as managed dependencies, the organisation inherits hidden exposure every time a new tool is added. The control answer is not blanket restriction, but provable trust boundaries, scoped delegation, and continuous monitoring of agent action paths.

For practitioners

• Define agent-specific trust boundaries Separate agents that read, agents that write, and agents that execute. Give each class its own approval path, data scope, and revocation trigger so a prompt compromise cannot automatically become a production action.
• Inventory and govern MCP connectors List every MCP server, exposed tool, and downstream system the agent can reach. Remove unused connectors, apply allowlisting, and track whether each server is vulnerable or externally reachable.
• Treat agent credentials as high-risk NHI Map tokens, API keys, service accounts, and delegated access used by agents as non-human identities. Rotate them, scope them tightly, and revoke them when the agent or workflow is retired.
• Add runtime detection for tool abuse Monitor for unusual tool sequences, data pulls, and code actions that do not match the approved workflow. Alert on agent behaviour that crosses from assistance into autonomous privilege use.

Key takeaways

• Agentic AI creates a governance problem because software now makes runtime decisions using delegated access, not just static code paths.
• The report’s evidence shows that coding agents and productivity agents fail through different mechanisms, with execution and exfiltration emerging as the dominant impacts.
• Practitioners should manage agents like privileged identities, with scoped tools, revocation paths, and runtime controls over both context and action.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Semantic persistence: Semantic persistence is a failure mode where malicious intent survives in prompts, context, instructions, or tool orchestration rather than in obvious malware or code. It is difficult to detect with conventional controls because the harmful behaviour is carried through meaning and workflow, not just files or binaries.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

What's in the full report

Straikerai's full report covers the operational detail this post intentionally leaves for the source:

• The full STAR framework mapping across application, model, tools and MCP, and data layers for agent defence.
• The documented exploit patterns behind coding, productivity, and first-party agent compromise.
• The methodology section explaining how the 1,700+ successful exploits were tracked and classified.
• The five-control defender playbook for breaking the agent attack chain.

👉 Straikerai's full report covers the exploit chain, methodology, and defender playbook behind the findings.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for teams that need to govern software entities and delegated access. It gives security practitioners a structured way to connect identity controls to emerging agentic AI risk.