Vertical agentic risk shows why taint analysis now matters

At a glance

What this is: This is a Pillar Security analysis of vertical agentic risk, arguing that taint analysis can reveal when benign-looking tools become dangerous once an AI agent chains them into a workflow.

Why it matters: It matters because IAM, IGA, PAM, and AI governance teams need to control agent behaviour across tool chains, not just approve each tool in isolation.

Context

Vertical agentic risk occurs when an AI agent combines otherwise acceptable tools into a workflow that creates a new security exposure. The governance gap is not the tool list itself, but the sequence and timing of actions the agent can take across systems.

In this pattern, taint analysis is used to trace untrusted input from its source to a sensitive sink such as a code commit, database write, or deployment action. That makes the identity question more precise for agentic AI: what data, permissions, and execution paths can the agent combine at runtime?

Pillar Security frames the issue as a vertical problem because the risk emerges in the workflow layer, not in any single isolated control. That is typical for agentic systems that operate across multiple integrations with limited human review.

Key questions

Q: What breaks when an AI agent chains safe tools into one workflow?

A: The safety of each tool no longer predicts the safety of the combined workflow. Once an agent can take untrusted input, reason over it, and then write to a sensitive system, the risk comes from the path between tools, not from any single permission.

Q: Why do agentic workflows increase the blast radius of untrusted input?

A: Because the agent can propagate tainted information from a low-trust source into a high-trust action without a human pausing the sequence. That creates a direct route from message or API input to code, data, or deployment changes.

Q: How can security teams tell when an agent workflow is becoming unsafe?

A: Look for sessions where private data, untrusted input, and an external communication path all appear in the same task. That combination signals that the agent can be steered from routine work into leakage or misuse. The useful indicator is not model quality, but whether the workflow can support risky action convergence.

Q: How should teams govern risky agent actions across systems?

A: Govern the handoff into privileged execution, not just the tools themselves. Require explicit approval or policy enforcement before an agent can move from untrusted intake to a sink such as repository writes, database updates, or deployment tasks.

Technical breakdown

How taint analysis maps untrusted input through agent workflows

Taint analysis tracks whether data from an untrusted source can influence a sensitive action. In agentic systems, the source can be a prompt, message, file, API response, or external instruction. The analysis follows the data as the agent interprets it, stores it in memory, and uses it to select downstream actions. If tainted input reaches a sink such as code execution, repository write access, or database modification, the workflow has crossed a trust boundary. The value of the method is that it models composition, not just individual permission checks.

Practical implication: map your agent's sources, transforms, and sinks before you grant it access to sensitive tools.

Why isolated tool security fails in vertical agentic workflows

A tool can be safe on its own and still become dangerous when paired with another tool in the same agent workflow. Read-only access, write access, and retrieval access each look defensible in isolation, but the agent can chain them into a path from untrusted input to harmful output. That is why vertical agentic risk is not the same as ordinary least-privilege design. The control problem is emergent behaviour across integrations, where the agent's runtime decisions create a new attack surface that no single tool owner can see in isolation.

Practical implication: review tool combinations as a system, not as separate approvals.

Why human review breaks down once agents act across systems

Human review assumes a person can observe the intent, pause the action, and intervene before impact. Agentic workflows compress that window because the system can ingest, reason, and act across multiple tools in one chain. That is especially relevant when the agent can move from message intake to repository change or production-side action without a hard approval gate. In governance terms, the review point moves too late unless it sits at the transition from untrusted data to privileged execution, not after the output is already assembled.

Practical implication: place approval controls at the handoff into privileged execution, not after the agent has already decided.

Threat narrative

Attacker objective: The attacker wants to convert trusted agent behaviour into an execution path that performs a harmful privileged action on their behalf.

1. Entry occurs when an attacker or disgruntled user places malicious content into the agent's trusted input channel, such as Slack or another monitored message source.
2. Credential access is not the issue here; instead, the agent inherits the trust of the message and propagates that taint into its internal reasoning and action selection.
3. Escalation happens when the agent combines read access and write access into a single harmful workflow, turning a message into a code change or other sensitive action.
4. Impact follows when the tainted action reaches a sink such as a production branch, creating the conditions for data breach, service disruption, or downstream supply chain compromise.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Vertical agentic risk is a workflow governance problem, not a single-tool security problem. The article correctly shows that individually safe tools can become unsafe once an agent chains them together across systems. That changes the practitioner question from 'is this tool approved?' to 'what happens when this tool is paired with another under autonomous control?'. The implication is that governance must reason about combinations, not just components.

Taint analysis gives identity teams a way to model trust propagation in agentic systems. In classic security use, taint marks untrusted input and follows it to a sink; in agentic workflows, the same logic exposes when agent reasoning carries untrusted influence into privileged execution. That is a more useful lens than static allowlisting because the risk emerges at runtime. Practitioners should treat taint boundaries as identity boundaries for agent behaviour.

Human review assumptions collapse when the actor can move from intake to action in one decision chain. Access review cadences were designed for privileges that persist long enough to be observed and certified. That assumption fails when an agent can consume data and trigger a sensitive action before a reviewer ever sees the intermediate state. The implication is that governance must shift from periodic inspection to pre-action control at the point of delegation.

Vertical agentic risk makes blast radius a design variable, not an incident afterthought. The article is strongest when it connects taint propagation to the potential for code commits, data writes, and supply chain effects. That is the right mental model for agentic AI security: every additional integration expands the possible path from untrusted input to business impact. Practitioners should measure blast radius by reachable sinks, not by tool count.

Agentic workflows need control-plane thinking if organisations want to avoid toxic tool chains. Once an agent can coordinate multiple tools, security teams need to govern the sequence, not just the endpoint. This is where NHI and agentic AI converge: runtime trust, privileged tool use, and lifecycle oversight become one problem. The practical conclusion is to govern agent actions as a controllable access path, not as isolated automation.

From our research library:

• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
• Read next: Red Teaming AI Agents for Identity Abuse

What this signals

Toxic tool chains change the governance unit of measure. Security teams should stop asking whether a single AI tool is approved and start asking whether an agent can assemble a harmful sequence from otherwise acceptable parts. That is the difference between tool governance and agent governance, and it is where control design now has to begin.

The strongest programmes will model agent actions as source, propagation, and sink paths, then place controls at the point where untrusted input can first influence privileged execution. That approach is more durable than trying to predict every bad prompt, because it focuses on the reachable action graph rather than the content of one message.

For practitioners

• Audit source-to-sink paths for every agent Inventory the untrusted inputs each agent consumes, the transformations it performs, and the privileged sinks it can reach. Focus on message channels, third-party APIs, and repository or deployment actions that can turn benign content into execution.
• Break toxic tool combinations into separate trust zones Do not let read access, reasoning, and write access live in one uncontrolled workflow when the output can affect code, configuration, or production data. Separate the chain so that tainted input cannot travel directly into a privileged sink.
• Move approval gates to the privilege transition point Require human or policy approval before an agent crosses from untrusted content handling into repository writes, database updates, or deployment steps. Approval after the action is too late because the taint has already reached the sink.
• Test agents for sequence abuse, not only single-tool abuse Red team the exact workflows an agent can assemble from multiple tools, including message ingestion, summarisation, code generation, and writeback. Look for prompts or messages that cause the agent to chain safe actions into an unsafe one.
• Tie agent permissions to specific business outcomes Grant the narrowest possible access for each workflow and make the allowed outcome explicit, such as creating a draft rather than committing code. If the intended business outcome changes, re-evaluate the whole action chain.

Key takeaways

• Vertical agentic risk emerges when individually acceptable tools become dangerous in sequence, which means control design has to move from isolated approvals to workflow-level governance.
• Taint analysis is useful because it traces how untrusted input can influence an agent's reasoning and reach a privileged sink such as a code commit or database write.
• The practical control point is the transition from untrusted intake to privileged execution, where approval and monitoring can still stop the chain.

Key terms

• Taint Analysis: A method for tracking untrusted data as it moves through a system until it reaches a sensitive operation. In agentic environments, it helps security teams see when external content can influence tool selection, code changes, or other privileged actions that should not have been reachable from that input.
• Vertical Agentic Risk: The risk created when an AI agent is built for a specific workflow and combines multiple tools or integrations into a sequence that was never evaluated as a whole. The danger is not the individual permission, but the runtime composition of those permissions into a harmful path.
• Sensitive Sink: A sensitive sink is a code location where untrusted data becomes dangerous because the function has elevated impact. In this article, formatting functions such as printf or logging APIs are sinks because they interpret structure. Security tools look for unsafe paths from input sources into these sinks.
• Source-to-Sink Path: The end-to-end route from untrusted input to a sensitive action. In agent governance, it is the most practical way to understand whether a message, API response, or external signal can reach a high-impact operation without a trustworthy control boundary intervening.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.