Agentic AI tools and browsing widen the attack surface

At a glance

What this is: This is Lakera’s analysis of how browsing-enabled and tool-using agentic AI widens exposure, with prompt injection, over-privileged tools, and retrieval-driven misuse emerging as the main risks.

Why it matters: It matters because IAM and security teams now have to govern what an AI agent can do at runtime, not just what it is configured to access, especially when browsing and tools turn into execution paths.

Context

Agentic AI changes the control problem from static access to runtime behaviour. Once an agent can browse, call tools, and act on retrieved content, the trust boundary moves from configuration to execution.

The governance gap is that traditional least-privilege and content filtering assume predictable, pre-approved use. Browsing agents can ingest untrusted text, images, or metadata and then turn that material into action, which makes indirect prompt injection and over-privileged tooling the central identity-security issues.

This is primarily an autonomous and agentic AI governance problem, not a conventional application-security one. The article’s core claim is that safe deployment depends on runtime guardrails, continuous testing, and stricter control over what the agent can do after it starts a task.

Key questions

Q: How do security teams reduce prompt injection risk in agentic browsing?

A: They should separate untrusted content from executable instructions, sanitise document and HTML fields before the reasoning layer sees them, and restrict any outbound actions through policy checks. Provenance logging is also essential so teams can trace which source element influenced the agent’s behaviour.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: What breaks when an AI agent can browse and act under a user’s identity?

A: The main failure is that the agent inherits trust from the user session while still being steerable by untrusted content. That lets hidden instructions turn normal browsing, document review, or email handling into data exposure or unsafe action. Security teams need to govern delegated actions as a distinct risk surface, not assume human session controls are sufficient.

Q: How can organisations govern sensitive agent actions without blocking automation?

A: Use a split model. Allow low-risk actions to proceed under tightly scoped, short-lived credentials, but route irreversible or high-impact actions through explicit human approval. That keeps automation usable while preserving accountability where the business impact is highest. The key is to separate routine execution from delegated authority, not to approve everything the same way.

Technical breakdown

Why browsing becomes an execution path

Browsing-enabled agents do not merely read content. They ingest text, HTML, images, and metadata into the model context, then use that context to decide what to do next. That makes retrieval execution-adjacent: a poisoned webpage, comment field, or image can become a hidden instruction stream. The technical failure is not just bad filtering, but the assumption that retrieved content is passive. Once the agent can combine web input with tool invocation, the boundary between reading and acting collapses, which is why indirect prompt injection becomes a live control problem rather than a theoretical one.

Practical implication: treat web retrieval and content parsing as an input-to-action pipeline that requires screening before the agent can use the content.

Over-privileged tools in agentic workflows

Tool access turns an agent from a summariser into an actor. If the system can send email, run code, query inventory, or trigger payments without approval gates, each tool expands the exploit surface. In practice, the risk is capability discovery followed by misuse: the model learns what it can do, then adversarial content nudges it to do too much. This is why static allow-lists are incomplete on their own. Least privilege for agentic systems has to be enforced at runtime, because the dangerous combination is not just tool presence, but tool reach plus autonomous execution timing.

Practical implication: scope agent tools to the smallest runtime permission set possible and require explicit control points for high-impact actions.

Why runtime guardrails matter more than static filters

Static filters inspect content before deployment or at the perimeter, but agentic attacks emerge during live reasoning. Runtime guardrails are therefore the control that sits between model output and real-world effect, checking inputs, outputs, and tool calls as the session unfolds. Continuous red-teaming complements that by testing how the agent fails when confronted with poisoned content or malicious workflows. The operational lesson is that autonomy is only safe when the system can detect and block unsafe transitions in real time, not after the agent has already acted.

Practical implication: place policy checks at runtime and validate them continuously against prompt injection and tool-abuse scenarios.

Threat narrative

Attacker objective: The attacker wants to use the agent’s own authority to trigger unintended actions or propagate malicious instructions through trusted automation.

1. Entry occurs through a browsing session or third-party content source that the agent is permitted to ingest without sufficient validation.
2. Credentialed or privileged capabilities are then abused when the agent turns retrieved instructions into tool calls, link generation, or code execution.
3. Impact follows when the agent republishes malicious content, executes unintended actions, or exposes data through trusted workflows.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic browsing creates an execution-adjacent trust boundary: Once an AI agent reads from the web and can act on what it finds, the old separation between content and action no longer holds. That assumption was designed for passive retrieval systems, not for systems that can browse, reason, and trigger tools in the same session. The implication is that governance has to move from content moderation to runtime authority control.

Least privilege becomes a live runtime question for autonomous systems: The article shows that tool reach, not just tool availability, defines the exposure. This is not simply over-permissioned software; it is identity authority being exercised by a system that can reinterpret instructions mid-task. Practitioners should read this as a signal that static scope design is no longer enough for agentic AI.

Indirect prompt injection is the agentic equivalent of untrusted input becoming trusted instruction: A webpage, image, or metadata field can become a control channel once the model consumes it inside its reasoning loop. That turns browsing into a policy enforcement problem, not just a retrieval problem. The result is a broader identity governance lesson: the trust decision now happens after ingestion, not before.

Runtime guardrails define the practical boundary of safe autonomy: The article’s strongest point is that safety is not a pre-deployment property. It is a runtime property that depends on continuous screening, detection, and red-teaming while the agent is active. For identity teams, that means agent governance must be operationalised as a control plane, not treated as a one-time configuration exercise.

Agentic AI identity needs a new concept of accountable action scope: We should treat the combination of browsing autonomy and tool access as an action scope, not just an entitlement set. That scope can expand through retrieval, context, and chained tools far faster than human review cycles can track. The practical conclusion is that agent identity governance must follow execution, not intent.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Read next: Top 10 Agentic AI Identity Issues

What this signals

Runtime action scope: agent governance is shifting from provisioning-time entitlements to execution-time authority, because the same browsing session can move from retrieval to action without a human checkpoint. That means identity teams need policy enforcement where the agent actually acts, not just where it is configured.

A browsing agent that can parse external content and call tools is no longer protected by classical perimeter thinking. The practical lesson is that agentic AI security depends on screening context, constraining outbound effects, and red-teaming the whole loop, not just the model prompt.

For practitioners

• Define runtime action scopes for agents Map which tools, data sources, and outbound actions each agent may use during a live session, then separate low-risk retrieval from high-impact execution.
• Treat retrieval as untrusted input Validate web content, images, metadata, and third-party MCP responses before they can influence model decisions or downstream tool calls.
• Enforce approval gates for high-impact actions Require explicit checks before agents can send email, run code, generate external links, or trigger payments, even if those actions are technically allowed.
• Run continuous red-team tests Test prompt injection, over-privilege, and browsing abuse scenarios against live agent workflows so guardrails are validated under realistic conditions.

Key takeaways

• Agentic browsing turns untrusted web content into a live control surface, which means prompt injection and tool misuse are now governance issues as much as model-security issues.
• The main risk is not that agents are malicious, but that they are allowed to act on instructions they should never have trusted in the first place.
• Runtime guardrails and continuous adversarial testing are the controls that determine whether autonomy stays useful or becomes an execution path for attackers.

Key terms

• Agentic Browsing: A browsing model in which an AI system can read content, interpret intent, and take actions on behalf of a user. It expands convenience, but it also extends trust boundaries across pages, documents, and tools that were never designed to be executable input.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.
• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Action Scope: Action scope is the set of outcomes an AI system is permitted to trigger based on its granted access and task context. In agentic environments, it is a better control target than simple account permission because it reflects what the system can actually do with data, tools, and timing.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.