Agentic AI security frameworks are being built from real incidents

At a glance

What this is: This is Zenity's account of how thousands of real incidents are influencing agentic AI security frameworks and surfacing recurring threat patterns that theory missed.

Why it matters: It matters because teams deploying AI agents need governance, detection, and response models that reflect runtime behaviour, not just policy design or abstract risk categories.

Context

Agentic AI security is the problem of governing software entities that can decide, select tools, and act during runtime. The article argues that security frameworks for these systems are becoming useful only when they are grounded in what actually happens inside enterprise deployments.

For identity and access teams, the implication is direct: AI agents cannot be treated as ordinary software tasks or static automations. Their access patterns, failure modes, and abuse patterns have to be understood as an identity and governance problem, not only as an application security topic.

Key questions

Q: What breaks when agentic AI relies on static IAM assumptions?

A: Static IAM breaks when the system can decide new steps at runtime. In agentic flows, the necessary scopes may not be known until the agent inspects a task, calls a tool, or chains into another service. That makes fixed permission modelling incomplete and creates gaps between design-time approval and actual execution.

Q: Why do goal hijacking and rogue agents matter to IAM teams?

A: They matter because they turn identity into an execution problem, not just an access problem. If an agent's privileges are technically valid but its objective has been redirected, ordinary authentication checks do not protect the business process. IAM teams have to care about whether the actor is still pursuing the intended task, not just whether it is logged in.

Q: How can security teams use incident data to improve agent governance?

A: They should convert repeated incidents into control categories, detection signals, and review criteria that reflect how agents actually fail in production. That makes framework design evidence-based instead of speculative. The most useful taxonomy is the one that consistently predicts where runtime abuse and cascading impact will appear next.

Q: What is the difference between agentic supply chain risk and ordinary software supply chain risk?

A: Ordinary software supply chain risk focuses on code integrity and trusted dependencies. Agentic supply chain risk also covers components that shape behaviour at runtime, such as tools, connectors, prompts, and orchestration logic. In other words, the supply chain is not only what the software is, but what the agent is allowed to become.

Technical breakdown

Why incident-derived agentic AI frameworks differ from theory-only models

Frameworks built from incident data capture repeated attacker behaviour, control failures, and agent misuse patterns that theoretical models often miss. In agentic environments, the relevant unit is not just the model or the workflow, but the decision-making loop that links prompt, tool choice, and execution. That loop creates security questions around scope, delegation, and abuse that are not visible in static architecture diagrams. When practitioners see the same pattern across many enterprises, it becomes a framework category rather than an anecdote.

Practical implication: Treat real incident telemetry as the input for control design, not as post-incident commentary.

Goal hijacking, rogue agents, and cascading failures as agentic failure modes

Goal hijacking occurs when an agent pursues an attacker-influenced objective instead of the intended one. Rogue agents are systems that act outside expected governance boundaries, while cascading failures happen when one unsafe agent action triggers further unsafe actions across connected tools or agents. These are not just behavioural oddities. They are control-break patterns that expose missing guardrails around intent, authorization scope, and inter-agent trust. Once one agent can influence the next, a single compromise can expand into a compound failure.

Practical implication: Map each agent workflow to the point where intent can be redirected, not just where data is accessed.

Supply chain risk in agentic systems starts before execution

Agentic supply chain vulnerabilities arise when the components that shape an agent's behaviour, such as models, tools, connectors, prompts, and orchestration layers, are trusted without sufficient provenance or change control. The risk is not limited to malicious code. It also includes poisoned instructions, compromised integrations, and unreviewed dependency changes that alter what the agent can do at runtime. For security teams, the supply chain has become part of the identity boundary because it defines what an agent is allowed to become in production.

Practical implication: Track provenance for agent components and treat connector changes as security-relevant events.

Threat narrative

Attacker objective: The attacker aims to turn autonomous decision loops into a scalable control bypass that affects multiple tools or workflows.

1. Entry occurs when an attacker influences an agentic workflow through manipulated goals, compromised connectors, or unsafe third-party components.
2. Escalation follows when the agent's runtime decisions expand access or propagate actions into adjacent tools, agents, or data sources.
3. Impact appears as cascading unsafe actions, policy bypass, or repeated misuse across enterprise systems before teams can intervene.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• 12,000 secrets in LLM training data: Truffle Security found 11,908 live API keys and passwords hard-coded in web pages captured by Common Crawl, a dataset used to train LLMs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Incident data is now the only credible source for agentic AI security frameworks: The article's central claim is that meaningful frameworks for agentic systems are being built from repeated real-world failures, not from abstract threat modeling alone. That matters because agentic behaviour changes too quickly for static assumptions to stay valid for long. Security teams should expect framework design to follow observed abuse patterns rather than vendor narratives.

Agentic AI creates an assumption collapse around stable intent: Least privilege was designed for actors whose purpose is known at provisioning time. That assumption fails when the actor can re-plan, re-select tools, and alter execution path during runtime. The implication is not simply more control, but a different governance premise for how access decisions are defined.

Goal hijacking is the named concept practitioners should carry forward: The article surfaces a class of failure where an agent's objective can be redirected without breaking the surrounding infrastructure. That is materially different from ordinary compromise because the system still appears to function while serving the wrong goal. Practitioners should treat intent integrity as a security boundary, not just task completion.

Agentic supply chain risk now extends into governance, not just software integrity: When connectors, tools, prompts, and orchestration layers shape behaviour at runtime, the supply chain becomes part of the control surface for identity and authorization. The practical conclusion is that agent governance and software supply chain assurance are converging.

Community-driven incident sharing is becoming a security control in its own right: The article argues that framework quality depends on practitioners contributing anonymized incidents back into the ecosystem. That creates a feedback loop where visibility improves both detection and standardization. The field now needs disciplined incident sharing as much as it needs new policy language.

From our research library:

• Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
• Read next: Agentic AI Security Guide

What this signals

Agentic AI governance is moving from prediction to evidence: As repeated incidents accumulate, the practical unit of control becomes the runtime decision loop, not the model alone. That shifts the reader's programme toward observing how an agent behaves under pressure, especially when tool access and execution timing can change mid-task.

Trust boundaries now include orchestration layers and connectors: The article's logic implies that a secure agent programme has to govern not only identity issuance but also the components that shape action selection. For practitioners, that means incident patterns should feed directly into policy, review, and detection design.

Agentic incident sharing is a maturity signal: Teams that can contribute anonymized failure patterns to community frameworks are usually further along in detection quality and governance discipline. That is a useful benchmark for AI security programmes trying to separate symbolic controls from operational ones.

For practitioners

• Inventory agent decision points Map where an AI agent can change goals, choose tools, or continue execution without a human approval gate. Those decision points define where governance must be anchored.
• Classify recurring incident patterns Group incidents by goal hijacking, rogue behaviour, cascading impact, and supply chain influence so that detection logic reflects observed attack patterns rather than generic AI risk labels.
• Review connector and tool provenance Track which external services, plugins, and integrations can alter agent behaviour, and treat unreviewed changes as security events with governance impact.
• Separate policy intent from runtime authority Check whether policy documents describe what agents should do while operational controls still allow them to act outside that intent once a task begins.

Key takeaways

• Agentic AI frameworks are becoming more useful when they are built from repeated enterprise incidents rather than speculative threat lists.
• The central security problem is runtime behaviour, because agents can change tools, goals, and execution path after an approval decision has already been made.
• Practitioners need controls that follow observed agent failure modes, especially goal hijacking, rogue behaviour, cascading failures, and supply chain influence.

Key terms

• Agentic AI Security Framework: An Agentic AI Security Framework is a set of controls for securing AI systems that can plan, decide, and act with limited human input. It defines identity, authorization, monitoring, and containment requirements for agents, their tools, and their data access, so autonomous actions remain traceable, bounded, and governable.
• Goal hijack: A failure mode where an agent is steered away from its approved objective and begins pursuing a different one, often through manipulated inputs or chained context. For autonomous or semi-autonomous systems, the risk is not only misuse of a tool but the redefinition of the mission itself.
• Cascading Failure: A cascading failure happens when one broken component causes dependent components to fail or degrade in sequence. In microservice systems, the problem is usually not one service going down, but the combined effect of latency, retries, shared dependencies, and exhausted resources spreading the outage.
• Agentic Supply Chain: The collection of models, tools, plugins, prompts, memory stores, and middleware that an AI agent depends on to operate. Weaknesses in this chain can introduce hidden instructions, poisoned context, or exposed secrets, so security teams need inventory, trust validation, and isolation controls across the entire path.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security or AI governance programme, it is worth exploring.