Runtime agent control for skill backdoors in agentic AI

At a glance

What this is: This is an analysis of why agentic AI skill backdoors require runtime control, with the key finding that static scanning alone cannot govern how agents choose and combine skills in live execution.

Why it matters: IAM, PAM, and NHI teams need to treat agent behaviour as the control point, because runtime decisions change what must be authorised, logged, and constrained.

Context

Agentic AI changes the identity problem because the actor is deciding at runtime which tools, skills, or external content to trust. In that model, a static review of code, prompts, or skill definitions can miss the real security event: the agent’s live execution choice.

For identity programmes, that means governance has to move closer to the moment of use. The question is no longer only whether a skill exists in the registry, but whether the agent can be constrained when it combines skills, follows links, or executes instructions from untrusted sources.

Key questions

Q: What breaks when static skill scanning is used to govern agentic AI?

A: Static scanning breaks down because it only reviews the skill package or prompt before execution. Agentic risk emerges when the system decides, in context, whether to trust a document, chain a skill, or call a tool. Governance therefore has to evaluate runtime behaviour, not just inspect artefacts in advance.

Q: Why do external documents create backdoor risk for agents?

A: External documents become risky when an agent treats them as instructions rather than reference material. That lets hidden content influence tool use, skill chaining, and downstream actions. The issue is not the document alone, but the agent’s willingness to convert untrusted content into authorised behaviour.

Q: How should security teams control agent skill chaining?

A: Teams should control skill chaining by authorising the full action sequence at runtime, not by approving each skill in isolation. A safe-looking skill can become dangerous when combined with other tools or retrieved content in the same session. Runtime policy must cap composition, not only individual access.

Q: How do runtime controls change governance for agentic AI?

A: Runtime controls move governance from static inventory management to decision-time enforcement. That means policy, logging, and escalation rules must apply when the agent is about to act, not just when the system is deployed. The practical result is tighter control over trust inheritance, tool use, and unintended action paths.

Technical breakdown

Why static skill scans miss runtime behaviour

Static scanning looks at the skill package, prompt text, or repository contents before execution. That catches obvious malicious code, but it does not model the agent’s live decision path, where an LLM-driven system may retrieve content, weigh trust signals, and invoke skills in sequence. The security boundary is therefore not the skill artefact alone, but the runtime authorisation event that decides whether the skill is actually used. In agentic AI, backdoors can be latent until an external document, tool output, or instruction is consumed during execution.

Practical implication: move trust decisions from pre-deployment review into runtime authorisation for every skill invocation.

How external documents become backdoors for agentic systems

An external document becomes dangerous when the agent treats it as an instruction source rather than just reference material. That creates a prompt-injection style pathway, but the identity issue is wider than prompt safety: the agent may inherit permissions, call tools, or escalate action based on untrusted content embedded in the document. The backdoor is therefore behavioural, not merely code-based. The system accepts outside content into the decision loop and then authorises downstream actions as if the content were trusted.

Practical implication: isolate untrusted content sources from tool-authorised execution paths and require explicit runtime checks before action.

Runtime agent control as an authorisation problem

Runtime control means the system authorises what the agent is about to do, not just what it was allowed to possess at build time. That is the critical shift for agentic identity governance. If the agent can choose among skills dynamically, then least privilege has to be enforced at execution time, with policy boundaries tied to the action, the context, and the current trust state. This is closer to zero trust for autonomous behaviour than to static app hardening.

Practical implication: express policy at the decision point, with contextual authorisation and explicit limits on skill chaining.

Threat narrative

Attacker objective: The attacker wants the agent to convert untrusted content into authorised actions that the operator never intended.

1. Entry occurs when an agent consumes external documentation or skill content that contains hidden malicious instructions or unsafe guidance.
2. Credential or tool access is abused when the agent treats that content as trusted and invokes skills, plugins, or connected tools accordingly.
3. Escalation happens when chained skill use expands the agent’s effective authority beyond the original intent of the session.
4. Impact is reached when the agent completes unintended actions, exposes data, or executes harmful workflows through trusted integrations.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime authorisation is the control plane for agentic identity. Static analysis can tell you what is present in a skill bundle, but it cannot tell you what the agent will trust at execution time. That gap matters because the security decision is made inside the session, after retrieval, context loading, and tool selection. Practitioners should treat runtime policy enforcement as the primary governance layer for agent behaviour.

External-doc backdoors are a trust problem, not just a code problem. The article’s core insight is that malicious influence can arrive through ordinary content if the agent is permitted to interpret that content as instruction. That breaks the old assumption that reviewing artefacts is enough to secure the execution path. Identity teams need to govern provenance, trust, and action together rather than separately.

Least privilege for agents must be bound to action, not inventory. A skill can look harmless in isolation and still become risky when combined with other skills or tools in the same session. That means entitlement reviews focused only on the catalog miss the composition risk that emerges at runtime. For practitioners, the real unit of control is the authorised action sequence, not the static skill list.

Agentic AI creates a new identity governance failure mode: trust inheritance. When an agent inherits confidence from retrieved content, tool output, or prior steps, that inherited trust can silently expand its operational scope. The lesson for IAM and NHI programmes is that authority is no longer only granted to identities at provisioning time; it is also accumulated during execution. Governance must account for trust that changes mid-session.

Skill backdoors belong in the same governance conversation as NHI and Zero Trust. The control question is whether a non-human actor can be forced to re-justify every sensitive action against current context, not historical approval. That aligns agent security with broader identity security patterns, but only if runtime decisions are treated as enforceable policy events. Practitioners should align agent controls with Zero Trust principles and NHI governance models.

From our research library:

• DeepSeek alone generated 113,000 new exposed API keys in 2025, illustrating how new AI providers create credential exposure before security guardrails catch up, according to the State of Secrets Sprawl 2026.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Read next: NHI Authentication Guide

What this signals

Runtime control is the missing layer in agent security programmes. Skill registries, static scanners, and prompt reviews can reduce obvious exposure, but they do not govern the moment when an agent decides to trust one source over another. That means the control model has to move closer to execution, where trust is actually consumed.

Trust inheritance is the concept to watch. Once an agent can treat retrieved content as instruction-bearing, authority starts to drift across content, tools, and actions in ways traditional IAM models were not built to certify. Programme owners should assume that agent risk is cumulative within the session, not fixed at onboarding.

For practitioners

• Define runtime authorisation boundaries for agents Require every sensitive tool call or skill invocation to pass a live policy decision based on current context, not only pre-approved skill inventory.
• Classify external content as untrusted input Separate retrieved documents, web content, and tool output from instruction-bearing material so the agent cannot silently inherit authority from untrusted sources.
• Limit skill chaining in high-risk workflows Block or step up approval when one agent action would combine multiple skills or tools into a broader execution path than the original request.
• Log decision-time trust signals Record which content sources, tool outputs, and policy checks influenced each action so governance teams can review why the agent acted.

Key takeaways

• Agentic AI backdoors are most dangerous at execution time, when trust decisions turn external content into authorised action paths.
• Static review still matters, but it does not govern the runtime choice to trust, chain, or execute a skill inside a live session.
• Identity teams need policy enforcement, logging, and scope limits at the decision point, because that is where the control failure occurs.

Key terms

• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Skill Backdoor: A skill backdoor is a hidden pathway that causes an agent to execute an unintended action when a skill, document, or tool output is consumed. The weakness is behavioural, not just code-based, because the danger appears when the agent treats untrusted content as instruction-bearing.
• Trust Inheritance: The condition where one credential or integration is allowed to carry trust into multiple connected systems. It is often invisible until a token is replayed from outside the intended context. In practice, trust inheritance is what turns a valid login event into a cross-platform compromise.
• Skill Chaining: Skill chaining is the combination of multiple skills or tools into one execution path that produces a broader outcome than any single step alone. In agentic AI, it can turn a low-risk capability into a high-impact action if the chain is not constrained at runtime.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.