Agentic AI control planes, not prompts, define real supply chain risk

At a glance

What this is: Agentic AI risk is shown to sit in the control plane, where repository files, skills, identity, and approval policy can turn ordinary prompts into unauthorised actions.

Why it matters: IAM, PAM, NHI, and agentic AI teams need to govern the authority behind model actions, not just the language that triggers them, because execution follows control-plane trust.

Context

Agentic AI systems create a governance problem when a model can choose tools and act under an identity. The security question is no longer only what the model was asked to do, but which repository instructions, skills, credentials, and approval paths can convert a suggestion into execution.

That matters to identity teams because the control plane behaves like a privileged access layer for software actors. When a file, skill, or inherited identity can steer actions, NHI governance and agent authorisation become the real boundary between intent and impact. In this article's examples, the starting position is not unusual; it reflects a pattern many teams have not yet formalised.

Key questions

Q: What breaks when agent instruction files are not governed like privileged configuration?

A: The agent can follow hidden or tampered instructions before the user realises the prompt was ordinary. That means a harmless-looking request can trigger tool use, local file access, or outbound exfiltration under trusted execution. Treat instruction files as controlled inputs with ownership, review, and change history, or they become a quiet route from intent to action.

Q: Why do inherited identities make agentic AI risk worse than prompt risk alone?

A: Because identity is what turns influence into execution. A prompt can suggest, but a credential, token, or delegated session can act. If that authority is broad or long-lived, the agent can make real changes even when the original request looked benign. The key control is to narrow and time-box authority before the task begins.

Q: What do security teams get wrong about skill marketplaces?

A: They often treat marketplaces as convenience layers rather than supply chain entry points. If there are no signatures, lockfiles, or mandatory review, a marketplace becomes a trust gap, not a distribution channel. Security teams should assume that popularity, downloads, or helpful naming do not prove safety.

Q: How should organisations verify what an agent actually did after it runs?

A: Teams should trace the identity, request, and state change for each run. That means logging who authorised the action, which instruction source influenced it, which tool was invoked, and what changed in code, data, or infrastructure. If you cannot reconstruct authority after the fact, you cannot prove the action was properly governed.

Technical breakdown

Why repository instructions behave like privileged configuration

Instruction files such as AGENTS.md can shape an agent's behaviour before a user ever sees the downstream action. In an agentic runtime, these files are not just content; they are control inputs that alter task scope, tool choice, and execution path. Indirect prompt injection works because the model reads instructions from places teams often treat as ordinary workspace material. The risk increases when approval prompts summarise only a friendly wrapper instead of the real command and payload, because the user is then approving intent without seeing the actual effect.

Practical implication: Treat agent instruction files as governed configuration and require approval views that expose the true destination and payload.

How installed skills and plugins expand the agentic supply chain

Installed skills, marketplace plugins, and helper modules can become a dependency chain for the agent itself. Once installed, they may redirect sourcing decisions, select package origins, or inherit authority that the person who launched the task did not review line by line. That creates a supply chain problem inside the agent runtime: the attack surface is not only the model or prompt, but the trusted code and content that define what the agent is allowed to fetch, build, and execute. If those sources are not pinned and approved, ordinary tooling will faithfully carry out a malicious substitution.

Practical implication: Approve agent-installed skills the same way you approve production dependencies, with source control and version pinning.

Why inherited identity is the real enforcement point

An agent becomes dangerous when a prompt, instruction file, or skill is connected to credentials and authority that outlast the immediate task. Identity is what turns influence into action, because the model does not need to own the workflow if it can borrow a session, token, or delegated permission set. This is why agentic governance overlaps with NHI and PAM: the key question is which identity executed the change, under what scope, and whether the approval boundary was enforced at issuance time. Without that, containment happens after damage rather than before execution.

Practical implication: Bind every agent action to a specific identity, narrow its scope, and verify that delegated authority expires with the task.

Threat narrative

Attacker objective: The attacker wants to convert ordinary agent activity into trusted execution that can steal data, alter software, or compromise downstream systems.

1. Entry occurs when a malicious instruction file, installed skill, or substituted dependency shapes the agent's task before the user recognises the manipulation.
2. Credential access or authority reuse happens when the agent inherits an identity, session, or approval path that can execute tool actions without a fresh human decision.
3. Escalation follows when the manipulated instruction or skill steers the agent to read local files, change packages, or touch production systems under trusted authority.
4. Impact is unauthorised code execution, data exfiltration, or supply chain contamination carried out through a legitimate-looking agent workflow.

Breaches seen in the wild

• ClawHub malicious skills 2026: Hundreds of malicious ClawHub skills for the OpenClaw agent pushed credential stealers in early 2026; Koi found 341 of 2,857 in the ClawHavoc campaign.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI supply chain risk is a control-plane problem before it is a prompt problem. The article shows that the prompt often only triggers work that authority has already made possible through repository files, skills, or inherited identity. That means the real security boundary is the set of sources and permissions that can steer execution. Practitioners should review agent control planes as privileged infrastructure, not as simple UX wrappers.

Instruction files have become privileged configuration and should be governed that way. AGENTS.md and similar inputs can alter behaviour before any business logic or policy engine gets involved, which makes them closer to configuration management than content moderation. This is a named instance of control-plane authority: a trusted file can define what an agent is allowed to attempt. Teams should classify those files as governed inputs with explicit ownership and change control.

Identity is the decisive enforcement layer for agent actions. An agent does not need autonomy to create risk, only delegated authority that outlives the task and is broad enough to be misused. That is where agentic AI intersects directly with IAM, PAM, and NHI governance. If identity review happens after execution, the control model is already too late; practitioners need issuance-time controls and task-scoped authority.

Agentic supply chains will increasingly resemble software supply chains with identity side effects. Marketplace skills, dependency substitution, and release-pipeline compromise all show that the path into agent behaviour is expanding beyond the model runtime. The named concept here is control-plane authority drift: the gradual widening of what can direct an agent without equivalent governance. Practitioners should assume this drift unless they continuously narrow sources, permissions, and approvals.

Detection must move from prompt inspection to authority tracing. The article's final test is the right one: if an agent acted at 2am, can you prove under whose authority it acted, what request ran, and what changed. That is a governance question, not just a security operations question. Teams should make authority traceability a first-class control for agentic systems.

From our research library:

• According to PwC, 79% of organizations have already adopted AI agents to some degree.
• Read next: Agentic AI Identity Guide

What this signals

Control-plane authority drift: agentic AI programmes will fail where teams assume prompts are the primary security boundary. The operational question is whether instruction sources, installed skills, and delegated identities are governed with the same discipline as production change.

If security leaders expect AI to run major portions of infrastructure autonomously within the next three years, then approval design and authority tracing become immediate control requirements, not future enhancements according to the 2026 Infrastructure Identity Survey. That makes agent identity governance part of mainstream IAM planning, not a niche AI problem.

For practitioners

• Treat agent instruction files as governed inputs Assign ownership, change control, and approval boundaries to AGENTS.md-style files, retrieved pages, and other agent instructions that can steer execution.
• Constrain installed skills and plugins Allow only approved sources, pinned versions, and documented install paths for marketplace skills, helper modules, and other agent dependencies.
• Bind actions to task-scoped identity Require every agent action to run under a narrow, traceable identity with explicit issuance, expiry, and task scope.
• Expose the real command and payload in approvals Make approval prompts show the actual destination, file access, and side effects rather than a shortened or friendly summary.
• Audit authority traces after every agent execution Record which identity executed the action, which instruction source influenced it, and what state changed so review can focus on authority, not just intent.

Key takeaways

• Agentic AI incidents often arise from control-plane authority, not from the prompt that appears to trigger them.
• Repository instructions, installed skills, and inherited identity can turn an ordinary request into trusted execution.
• Security teams need traceable authority, task-scoped credentials, and governed agent inputs before agentic systems scale.

Key terms

• Agentic Data Control Plane: An Agentic Data Control Plane is the governance layer that manages how AI agents discover, request, use, and protect data while acting on behalf of a user or system. It coordinates policy enforcement, authorization, logging, and data boundaries across tools, APIs, and repositories, so agent actions remain traceable, constrained, and auditable.
• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Authority Tracing: Authority tracing is the ability to reconstruct which identity, approval path, and instruction source led to an agent action. It matters because governance fails when teams can see that something happened but cannot prove who or what had the power to make it happen.
• Control plane drift: Control plane drift is the gradual mismatch between intended security or operational policy and the actual state of a system’s control layer. It occurs when configuration changes, automation, or exceptions accumulate without review. In identity and cloud environments, drift can weaken access controls, logging, segmentation, and enforcement consistency.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in the context of modern identity programmes. It helps practitioners translate agentic risk into the access, lifecycle, and control decisions their programmes must own.