Agentic AI CTF shows the attack surface is the architecture

At a glance

What this is: This is Tego AI’s analysis of an agentic AI capture-the-flag exercise that found architecture, tool access, MCP exposure, and inter-agent trust create the real security risk, not jailbreaks.

Why it matters: It matters because security teams evaluating agentic AI need to govern identities, tools, and delegation paths, not just prompt content or model behaviour.

By the numbers:

• 2,293 players interacted with the Agentic AI CTF, showing broad hands-on engagement with agentic attack paths.
• Only 1 player completed all 10 levels, highlighting how difficult multi-step agentic exploitation remained.
• The average successful solver consumed roughly 300K input tokens per level, with Level 6 averaging over 1M tokens.

Context

The core governance gap in agentic AI is that natural language policy is not an enforcement boundary. Once an AI system can call tools, read data, and communicate with other agents, the security model shifts from prompt control to runtime control over identities, permissions, and trust boundaries.

AI agents vs agentic AI matters here because the article is not about a chatbot being tricked into saying something harmful. It is about a full agentic system whose attack surface comes from tool use, delegation, and the way components trust one another.

That distinction is what makes the CTF useful: it shows how quickly security assumptions collapse when an AI system behaves like an operational actor rather than a text generator.

Key questions

Q: What breaks when an agentic system relies on prompt rules instead of enforced controls?

A: Prompt rules fail because they are advisory, not authoritative. If the runtime can still execute tools, read untrusted content, or delegate work, an attacker only needs to shape the agent’s context to trigger unsafe action. The fix is not stronger wording. It is enforcement at the boundary where the agent requests real capabilities.

Q: Why do MCP environments increase the risk of unauthorized actions when AI agents can call tools directly?

A: MCP increases risk because it gives LLMs and agents direct, machine speed access to tools, data, and commands. If prompts, metadata, or credentials are manipulated, the agent may execute unintended actions without human review. That combination creates a fast path from misuse to data exposure, service disruption, or unauthorized system changes across connected environments.

Q: What are the signs that an AI agent access model is too weak?

A: Warning signs include unrestricted prompt handling, broad access to knowledge bases, unguarded API calls, and responses that can expose sensitive information without review. If the agent can act before permissions are checked, or if the same policy is not applied to inputs, data, tools, and outputs, the control model is already too loose.

Q: How should security teams test and harden agentic AI applications before they go into production?

A: Security teams should treat agentic AI as a living attack surface, not a one-time deployment. Start with continuous AI red teaming, then pair it with traditional penetration testing, runtime guardrails, and monitoring of prompts, embeddings, and outputs. That combination helps surface prompt injection, model inversion, data poisoning, and control drift before they scale across users or workflows.

Technical breakdown

Why prompt injection is not the real control failure

Prompt injection is only one entry point. In this CTF, the flags were not in the model context and could not be extracted by “asking harder”; they were generated server-side and only released when the architecture was actually exploited. That means the security issue is not model persuasion, but whether the agent can be induced to act on untrusted inputs and unsafe tool outputs. The meaningful boundary is the execution layer, where a tool call can become a privileged action. If that boundary trusts the agent’s intent instead of enforcing policy, then the prompt becomes an unreliable proxy for authorisation. See the AI Agent Authorisation Guide.

Practical implication: Treat prompt safety as a supporting control and move enforcement to the tool call boundary.

How MCP changes the identity and privilege model

MCP is not just another integration pattern. It turns tool schemas, scoped credentials, and server trust into part of the agent’s operational identity. If the agent can discover hidden capabilities, escalate through poorly scoped tools, or inherit more access than intended, then the problem is not merely API connectivity. It is privilege projection into a runtime that can request actions on demand. The article’s Levels 4 and 9 show why tool definitions themselves become attack surface: exposed schemas reveal capability, and capability can be abused if access is broader than the task requires. See the Agentic AI Identity Guide.

Practical implication: Review MCP servers as privileged access surfaces, not as neutral plumbing.

Why multi-agent trust becomes a privilege boundary

Once agents communicate with each other, identity is no longer just authentication at login. It becomes continuous trust validation across message flows, delegation chains, and scoped responsibilities. The article’s hardest levels involved agent-to-agent abuse, which is exactly where weak identity assumptions surface: self-declared identity, unverified delegation, and trust inherited from upstream agents. That is a governance problem as much as a technical one. In practice, multi-agent systems need explicit assurance around who a peer is, what it may request, and whether a delegated action can expand beyond its original scope. Otherwise, the communication channel becomes the escalation path. See the Multi-Agent and A2A Security Guide.

Practical implication: Apply identity checks and delegation limits to agent-to-agent communication paths.

Threat narrative

Attacker objective: The attacker’s objective is to coerce the agentic system into authorising a privileged action that should never have been reachable through prompt manipulation alone.

1. Entry begins when a player influences the agent through injected instructions, manipulated emails, hidden debug parameters, or other untrusted inputs that the system reads as part of normal operation.
2. Credential or capability abuse follows when the agent is induced to call tools, read sensitive data, or trust a spoofed peer agent, turning ordinary runtime permissions into exploitable access.
3. Escalation occurs when the attacker chains tool misuse, MCP exposure, or multi-agent delegation into broader system control that the original natural-language policy never truly constrained.
4. Impact is the release of a session-bound flag or equivalent privileged outcome, proving that the architecture, not the prompt, determined the breach path.

Breaches seen in the wild

• xinference PyPI compromise 2026: Three xinference releases on PyPI carried a stealer for cloud, Kubernetes and registry keys, reportedly via a compromised bot account.
• 12,000 secrets in LLM training data: Truffle Security found 11,908 live API keys and passwords hard-coded in web pages captured by Common Crawl, a dataset used to train LLMs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI security is really runtime identity security: The article shows that the decisive control point is not the prompt but the tool boundary, where an agent can turn language into action. When an AI system can search mail, call tools, and delegate work, identity becomes the mechanism that decides what it may do. Practitioners should stop treating model output as the security boundary and start treating action execution as the control plane.

Natural language policy fails as an enforcement model: The CTF demonstrates that “do not do X” instructions are not a substitute for enforced authorisation. Agents can be persuaded, redirected, or confused, but the deeper issue is that execution remains possible unless the runtime blocks it. This is a structural failure of soft governance, not a tuning problem.

MCP introduces a new kind of privilege surface: Tool schemas, scoped credentials, and hidden capabilities are now part of the attack surface, which means discovery alone can reveal usable power. That makes least privilege for AI agents a governance issue, not a configuration preference. Security teams should treat every exposed tool as an access decision, not just an integration detail.

Multi-agent trust is the new escalation path: The most difficult levels show that agent-to-agent communication can become the route to privilege expansion when identity is self-declared or weakly verified. This is where old assumptions about stable operators collapse, because the actor making the next request may be another software entity rather than a person. The implication is that delegation chains need explicit identity checks, not inherited trust.

From our research library:

• The agentic AI market is already worth $5 billion and is projected to reach $50 billion by 2030.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Identity controls have to move into runtime: When an agent can read inputs, call tools, and negotiate with peers, the security question becomes who can cause a state change, not who can type a prompt. The old assumption that a human operator sits behind every privileged action no longer holds, so governance must anchor on task-scoped authority and verified delegation.

Agentic AI security will converge on access governance, not model moderation: The industry is already scaling faster than its controls, with 67% of organisations still relying heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey. That makes the practical challenge less about improving prompts and more about redesigning issuance, scoping, and revocation for systems that act on their own.

Runtime trust, not prompt quality, will define maturity: The next phase of agentic governance will be measured by whether an organisation can prove which tools an agent may use, which peers it may trust, and which actions are blocked even when the model is confident. Teams that keep treating the agent as a chatbot will keep missing the real control surface.

For practitioners

• Audit runtime enforcement at the tool boundary Map every action an agent can take, then identify where policy is still expressed only in prompts, soft constraints, or developer intent. Replace those gaps with enforceable checks at execution time.
• Inventory MCP and agent-to-agent trust paths List every MCP server, tool schema, delegated credential, and peer-agent channel that can extend an agent’s capability. Rank them by the privilege they expose, not by how easy they are to integrate.
• Constrain agent capability to task scope Limit each agent to the minimum tools, data sources, and delegation rights required for a single task, then revoke or expire access as soon as the task ends.
• Test for indirect injection in real workflows Red team email, file, and web-content inputs that the agent reads during normal work, because those are the channels where malicious instructions can be smuggled into execution.

Key takeaways

• The article’s central finding is that agentic AI risk sits in runtime architecture, not in the model prompt itself.
• The CTF data shows how quickly practitioners struggle once attacks shift from jailbreaks to tool misuse, MCP exposure, and multi-agent trust abuse.
• Identity, delegation, and tool authorization are the controls that determine whether an agent can be safely allowed to act.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · Agentic AI Identity Guide · Multi-Agent and A2A Security Guide · AI Agent Observability, Audit and Incident Response Guide

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• MCP: Model Context Protocol, an open way for AI agents to connect to tools and data sources. It improves interoperability, but it also introduces a shared integration layer that must be governed carefully because the protocol can widen access across many systems at once.
• Tool Boundary: The tool boundary is the point where an agent's model output becomes an enforced action. In agentic systems, this boundary acts like a permission layer because tool names, schemas, and implementations determine what the agent can actually do, not just what it appears able to request.
• Agent-to-agent trust: The rules that determine whether one AI agent can authenticate, delegate, or share context with another. This is an identity problem as much as an integration problem, because uncontrolled trust propagation can create hidden access paths and make accountability harder to prove.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.