TL;DR: Agentic AI expands attack surface across LLMs, tools, configuration, and memory, where indirect prompt injection, credential theft, supply-chain tampering, and excessive permissions can redirect autonomous workflows into unsafe actions, according to CyberArk analysis. The core assumption that an LLM-driven system can be governed like chat software collapses once the system can decide, act, and persist context.
At a glance
What this is: CyberArk’s analysis breaks agentic AI attack surface into model, tools, configuration, and memory, showing how prompt injection, credential theft, and excessive permissions can bend agent workflows toward unsafe outcomes.
Why it matters: IAM, PAM, and NHI teams need to treat agentic systems as software with identity and execution rights, because the control failures emerge at decision, privilege, and persistence layers, not just at the prompt layer.
Context
Agentic AI is not just a chat interface with better automation. In CyberArk’s model, the security problem starts when an LLM can influence code flow and trigger actions through tools, credentials, and persistent memory, which turns the identity boundary into part of the attack surface.
That means governance for these systems cannot stop at model safety or input filtering. The real question for identity teams is how permissions, execution paths, and stored context behave when an LLM can choose actions and continue state across runs.
Key questions
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check. That creates a control gap between intended scope and actual runtime behaviour. The result is weak accountability, limited containment, and audit trails that show activity without explaining why the activity was allowed.
Q: Why does indirect prompt injection create more risk than a malformed request in AI applications?
A: Indirect prompt injection is risky because the payload arrives as ordinary content, such as a support ticket, document, or code comment. Nothing looks malformed, so traditional input validation often misses it. Once the model reads that content, the malicious instruction can influence tool calls, retrieval, or output, and the damage happens through the agent’s own integrations rather than the front end.
Q: How should security teams reduce the impact of credential theft in AI-assisted attacks?
A: Security teams should assume harvested credentials will be used quickly and at scale, then design for containment rather than recovery. Separate secrets from the systems they unlock, narrow their reach across internal services, and shorten their usable lifetime so replay value is low. The goal is to make one stolen credential expose as little of the environment as possible.
Q: What signals show that an agentic workflow is being manipulated?
A: Look for repeated review loops, unexpected tool calls, changes in repository selection, and output that contradicts the stated policy or task. Those are signs that context has overridden intended control flow and the agent is no longer behaving as designed.
Technical breakdown
How agentic systems expand the attack surface
CyberArk breaks an agentic system into four parts: the LLM, tools, configuration, and memory. The LLM supplies reasoning, tools provide action execution, configuration carries the system prompt and credentials, and memory preserves context across sessions. That combination is what turns a model output into an action path. Security risk grows because each layer can be targeted separately, and each layer can also be used to influence the others. The important distinction is that the system is not only generating text. It is making decisions that flow into code, external calls, and stateful persistence, which creates a much larger and more composable attack surface than a conventional chatbot.
Practical implication: Map each agent component to a distinct control surface before you approve production use.
Why indirect prompt injection becomes a control-flow problem
Indirect prompt injection works by placing malicious instructions in data the agent already consumes, such as repository files, comments, or other context sources. CyberArk’s examples show that the attack is not about tricking the model’s original prompt alone. It is about making the model prioritise attacker content over its intended objective. In an agentic workflow, that can alter review decisions, trigger unnecessary repetition, or make downstream agents act on poisoned instructions. The security issue is therefore not just content manipulation. It is control-flow manipulation through untrusted context, which is much harder to spot because the malicious text can look like ordinary input to the pipeline.
Practical implication: Treat every agent input source as potentially adversarial and validate outputs before execution.
Why credential scope and supply chain integrity matter more in agentic AI
CyberArk notes that agents often require tokens, branch rights, repository access, and other runtime credentials to complete work. If an attacker reaches the server or the supply chain, they can steal those credentials or alter the code and prompts that govern the agent. That means a compromise can move from the runtime environment into the model’s behaviour, or from the model’s context back into infrastructure actions. The same logic applies to memory, because persistent context can carry hostile instructions forward across sessions. The architectural lesson is that agentic systems need protection at code integrity, credential handling, and runtime governance layers simultaneously.
Practical implication: Enforce least privilege, code integrity, and tightly bounded credentials around every agent workflow.
Threat narrative
Attacker objective: The attacker aims to convert legitimate agent autonomy into unsafe execution, secret exposure, or destructive code and workflow changes.
- Entry begins through either traditional software compromise of the agent server or through indirect prompt injection in data the agent reads.
- Credential access or instruction capture lets the attacker steal tokens, alter the system prompt, or shape the model’s next action.
- Escalation occurs when the poisoned context changes code flow, biases downstream agents, or expands the workflow beyond its intended repository or task scope.
- Impact is unsafe execution, including malicious commits, repeated analysis loops, secret disclosure, or command execution on the host.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic AI changes the identity problem from access to action. The security boundary is no longer just who can authenticate, but what the system can decide to do after authentication. Once an LLM can trigger tools, the control plane must govern execution rights, not only login rights. The practitioner conclusion is that agentic systems need identity and workload governance together, not as separate programmes.
Indirect prompt injection is a governance failure, not just a model flaw. The attack works because trusted pipelines often assume inputs are benign if they arrived through approved sources. That assumption fails when repository text, comments, or memory can steer autonomous actions. The implication is that data provenance and execution authorisation must be treated as a single control problem.
Credential sprawl becomes agentic privilege sprawl. Agent workflows often need tokens, branch rights, and repository access that are broader than any individual user’s access. That creates a pattern where machine authority exceeds human accountability, especially when agents operate across multiple repositories or tasks. Practitioners should expect the blast radius of a compromised agent to be determined by issued privileges, not by the user that approved deployment.
Persistent memory creates cross-session trust debt. Memory is not just storage. It is retained context that can preserve attacker influence after the original event has passed. That means an injection does not have to succeed once to be dangerous once, and the governance implication is that session boundaries no longer guarantee isolation. Teams need to recognise memory as part of the attack surface, not as a benign convenience layer.
Never trust an LLM is now an architectural rule, not a slogan. CyberArk’s analysis shows that the more autonomy and tool access an agent receives, the more every surrounding control must assume adversarial intent. In practice, that means security architecture must constrain the agent’s choices, its inputs, and its ability to persist state. The practitioner conclusion is simple: agentic AI should be governed as software plus identity plus execution risk.
From our research library:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- The agentic AI market is already worth $5 billion and is projected to reach $50 billion by 2030.
- Read next: Agentic AI Identity Guide
What this signals
Identity boundaries will move into the agent runtime. The practical shift is that approvals, scopes, and persistence can no longer be governed as static preconditions. For autonomous systems, access review logic has to be replaced by execution-time control over what the agent can select, call, and retain.
Agentic privilege sprawl is the new blast-radius problem. A workflow that spans repositories, tokens, and memory can inherit more authority than any single human operator would ever hold. That is why least privilege has to be enforced at task scope, not just at account scope, according to the 2026 Infrastructure Identity Survey.
Persistent memory turns a one-off injection into a recurring governance issue. Once hostile context survives across runs, the control failure is no longer isolated to one session. Security teams need to treat retention and replay as part of the same risk model as prompt filtering and output validation.
For practitioners
- Define separate control points for LLM, tools, config, and memory Inventory which layer can change decisions, which layer can execute actions, and which layer can persist context across runs.
- Constrain agent permissions to the smallest workable scope Use tightly bounded credentials and repository rights so a compromised workflow cannot pivot into unrelated systems or higher-value codebases.
- Validate model outputs before any side effect Do not allow raw model output to drive commits, API calls, branch creation, or escalation paths without deterministic checks.
- Test for indirect prompt injection in real inputs Adversarially test comments, files, tickets, and memory content that the agent consumes, because those are the places where hidden instructions can live.
- Monitor agent loops and unusual task repetition Alert on repeated analysis passes, repeated tool calls, or workflow retries that suggest the agent has been coerced into recursive behaviour.
Key takeaways
- Agentic AI expands the control problem from model behaviour to the full execution path, including tools, credentials, configuration, and memory.
- Indirect prompt injection, credential theft, and supply-chain tampering can redirect autonomous workflows without needing to break the model itself.
- Security teams need to govern agentic systems as software plus identity plus execution risk, with tight permissions and output validation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The article centers on agents being steered into unsafe tool and action use. |
| ASI03 — Identity & Privilege Abuse | The article repeatedly shows how excess permissions widen the agent blast radius. | |
| ASI06 — Memory & Context Poisoning | Indirect prompt injection and persistent memory are central attack paths here. | |
| Recommendation — Constrain agent tool access and validate every action path before execution. Reduce agent privileges to the minimum task-scoped rights needed for each workflow. Treat agent memory and external context as adversarial inputs that require filtering and validation. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article explicitly calls out theft and disclosure of agent credentials and secrets. |
| NHI-05 — Overprivileged NHI | Agent workflows using broad repository and token access illustrate overprivileged non-human identity. | |
| Recommendation — Scan agent environments for exposed secrets and remove any credentials visible to the workflow. Rework agent entitlements so each identity can only reach the resources needed for its task. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Credential theft and expansion across repositories are the core adversary techniques discussed. |
| Recommendation — Map agent compromise paths to credential access and lateral movement to prioritise detections. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about controlling agent entitlements and execution rights. |
| PR.DS-10 — Data in Transit Is Protected | The system relies on data and context moving between repositories, prompts, and tools. | |
| Recommendation — Apply PR.AA-05 to enforce least-privilege permissions for every agent workflow. Protect agent data flows so injected or stolen content cannot alter downstream actions. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Agent tokens and credentials are a central abuse path in the article's threat model. |
| Recommendation — Apply IA-5 to govern issuance, storage, rotation, and revocation of agent authenticators. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Tool Access Scope: Tool access scope is the exact set of systems, actions, and data an AI agent is allowed to reach. It should be narrow, explicit, and reviewable, because the risk emerges when the agent can transform a prompt into a real-world operation across connected services.
- Persistent Memory: Stored state that an AI agent carries across sessions, such as instructions, preferences, history, or learned context. It matters because state can be poisoned, reused, or modified, turning memory into a control surface rather than a passive archive.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 29, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org