Agentic AI control planes, not prompts, define real supply chain risk

At a glance

What this is: This analysis shows that in agentic systems, the prompt is often only the trigger, while repository instructions, installed skills, and inherited identity decide whether an agent can act.

Why it matters: That matters to IAM, PAM, and NHI teams because agent authority, tool access, and approval policy now determine whether hidden instructions become real actions in production.

By the numbers:

• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read Prompt's analysis of agentic AI control-plane risk and supply-chain abuse

Context

Agentic AI changes the attack surface because the security boundary is no longer the prompt alone. In practice, the agent's authority is shaped by repository instructions, installed tools, inherited credentials, and approval policy, which means control-plane governance now matters as much as model behaviour.

That is why this topic belongs at the intersection of AI security and identity governance. If an agent can select tools and act under an inherited identity, then NHI controls, approval gates, and lifecycle management become part of the AI security model rather than separate operational concerns.

The article's examples are typical of a broader pattern rather than isolated edge cases. Similar control-plane weaknesses appear wherever agents can read instructions, install dependencies, or act through persistent access without strong provenance checks.

Key questions

Q: What fails when an AI agent can act on hidden instructions under inherited access?

A: The failure is not the prompt itself. The failure is that repository files, skills, or retrieved content can steer an agent into using legitimate tools and credentials for attacker-chosen actions. Once inherited access is broad enough, a harmless-looking instruction becomes a real system change or data exfiltration path.

Q: Why do AI systems create identity risk as well as model risk?

A: Because AI systems rarely act alone. They depend on service accounts, API tokens, cloud permissions, and data access paths, which means a model can behave safely while its identity layer is over-privileged. Treating AI risk as only a model problem misses the access surface where misuse and lateral movement usually begin.

Q: What signs show that agent control-plane governance is failing?

A: Look for agents that can install packages from unapproved sources, execute shell wrappers without exposing the real payload, or continue acting after instruction files are changed. Those are signs that provenance, approval, and session containment are too weak to prevent injected intent from becoming action.

Q: Should security teams treat agent runtime controls and software supply chain controls as separate programmes?

A: No. The article shows that the same compromise path can begin in a repository, move through a plugin or package source, and end as an authorised action. Teams need one governance model that covers instruction provenance, dependency trust, identity scope, and action approval.

Technical breakdown

Indirect prompt injection moves through files, pages, and skills

Indirect prompt injection happens when untrusted content shapes what an agent intends to do after it has already ingested context. In agentic systems, that content is often not the chat prompt but repository files such as AGENTS.md, retrieved web pages, or installed skills that the model treats as operational guidance. The security problem is that influence and authorization are separate. A malicious instruction can survive ordinary prompt review if the agent is allowed to convert it into action through tools or credentials.

Practical implication: Treat instruction-bearing files and retrieved content as privileged inputs and require approval on the real action, not just the text that triggered it.

Inherited identity turns intent into executable authority

An agent becomes materially risky when it inherits an identity that can perform actions outside the user's immediate view. That identity may include cloud roles, local shell permissions, package publishing credentials, or API tokens that persist beyond a single interaction. The prompt may suggest, but the identity authorises. This is why agent security is not just about model alignment; it is about the access path that allows a suggestion to become a transaction, file change, or outbound request.

Practical implication: Scope every agent to the minimum identity it needs, and segregate high-risk tools behind explicit approval and short-lived credentials.

Control-plane integrity matters more than session recovery

Agent incidents often persist even after a malicious file is restored or a bad instruction is removed. Once an agent has read a compromised instruction set, cached a plan, or executed a partial action, the session state itself may remain contaminated. This makes instruction-file integrity only one layer of defence. The broader control plane includes provenance, session restart logic, execution logging, and revocation of any credentials or tokens the agent used while compromised. Without that, remediation is incomplete.

Practical implication: Pair file integrity checks with session termination, credential revocation, and post-action review whenever an agent's control inputs are tampered with.

Threat narrative

Attacker objective: The attacker wants to turn an apparently ordinary agent interaction into a trusted execution path that leaks data or alters systems.

1. Entry occurs when a malicious repository file, marketplace skill, or compromised publishing path introduces attacker-controlled instructions into the agent's context.
2. Escalation happens when the agent's inherited identity, tools, or approval workflow converts that instruction into a real command, package change, or outbound data flow.
3. Impact follows when the agent exfiltrates data, installs tainted dependencies, or changes production state under apparently legitimate authority.

NHI Mgmt Group analysis

Agentic AI governance now has a hidden control-plane problem: the prompt is often only the trigger, while the real risk sits in the files, skills, and identities that shape execution. That means traditional prompt safety controls are necessary but insufficient, because they do not answer who authorised the action, what tool path was used, or what credential made it possible. For practitioners, the governing question is provenance of authority, not prompt quality.

Identity is now part of the agent's attack surface: once a model can choose tools under an inherited identity, the boundary between AI governance and IAM collapses in practice. This is where NHI control discipline becomes directly relevant, because agents behave like machine identities with dynamic intent and broad downstream reach. Organisations that separate AI oversight from identity oversight will miss the control point that actually limits abuse.

Control-plane integrity is a more precise concept than AI safety for operations teams: it captures the fact that repo files, retrieved content, installed skills, and approval workflows are all executable governance inputs. This aligns closely with OWASP Agentic AI Top 10 thinking and with NIST AI Risk Management Framework governance expectations. The practical conclusion is that teams should audit the execution path, not just the model.

Supply-chain threats are converging with agentic runtime threats: the same software distribution path that compromises packages can now steer which tools an agent trusts and which actions it performs. That convergence means security teams should stop treating software supply chain reviews, secrets governance, and agent runtime controls as separate workstreams. The field is moving toward unified control-plane governance across code, identity, and action.

What this signals

Control-plane governance is now a practical requirement for agentic AI programmes. Teams that focus only on prompts will miss the real execution boundary, which sits across identity, tool permissions, and instruction provenance. The useful next step is to align AI governance with IAM and NHI controls so that agent authority is both reviewable and revocable.

Agentic systems are making secrets governance and identity governance inseparable. A model that can reach package sources, cloud APIs, or developer tooling through persistent credentials behaves like any other privileged workload. That means secrets rotation, short-lived access, and approval workflows should be designed together, not as separate controls.

Instruction-file integrity is becoming part of the modern trust model. Repository artefacts, marketplace skills, and retrieved content increasingly function like policy inputs, not just data. For teams mapping this to formal controls, the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both support a governance-first view of agent behaviour.

For practitioners

• Map every agent's authority chain Document which repository files, skills, model endpoints, and tokens can influence or authorise each agent action. Include the exact point where approval is required and the real identity used at execution time.
• Constrain agent identities to task-scoped access Issue short-lived credentials with narrow tool permissions, and separate read, write, install, and publish capabilities so an injected instruction cannot escalate into broad system access.
• Harden instruction-bearing inputs Treat AGENTS.md files, retrieved pages, marketplace skills, and package manifests as privileged configuration. Sign, baseline, and review them before they can steer actions in production or development environments.
• Require execution-level approval and logging Show the real command, destination, and payload before the agent acts, then log the exact request, the identity used, and the resulting change for later containment and forensics.

Key takeaways

• Agentic risk is often a control-plane problem, not a prompt problem.
• Inherited identity, tool access, and instruction provenance determine whether hidden intent becomes real impact.
• Security teams should govern agents through narrow authority, execution-level approval, and revocable credentials.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
• Inherited identity: An inherited identity is a session or access context that a non-human actor receives from a human or upstream system rather than being assigned its own standalone account. In agentic environments, this can include cloud roles, cached tokens, SSH keys, and live CLI sessions that the agent can reuse.
• Identity Provenance: Identity provenance is the record of how an agent was created, what authority it received, and what actions it performed over time. It turns agent activity into an auditable chain of trust that supports compliance, incident response, and post-event accountability.

What's in the full article

Prompt's full blog post covers the operational detail this analysis intentionally leaves for the source:

• Step-by-step breakdown of the AGENTS.md goal hijack workflow and the approval prompt behaviour
• Practical mechanics of marketplace skill abuse and dependency redirection in real developer environments
• Details on instruction-file integrity monitoring, session restoration, and post-compromise containment
• Discussion of browser-session authority and software supply chain exposure as agentic attack paths

👉 The full Prompt post covers the AGENTS.md, marketplace skill, and supply-chain examples in more operational detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control to the broader security decisions that govern modern systems.