Topic starter
18/08/2026 2:50 pm
TL;DR: Static skill scans miss external-doc backdoors in agentic AI because the real risk emerges at runtime, when an agent decides whether to trust, execute, or combine skills and tools, according to Ory. The governance gap is that authorization has to follow agent behaviour, not just inspect code or prompts.
Editorial analysis by NHI Mgmt Group, based on content published by Ory: “From Static Skill Scans to Runtime Agent Control: How Ory Agent Security Addresses the “Story of Skills” Threat”.
Key questions
Q: What breaks when static skill scanning is used to govern agentic AI?
A: Static scanning breaks down because it only reviews the skill package or prompt before execution.
Q: Why do external documents create backdoor risk for agents?
A: External documents become risky when an agent treats them as instructions rather than reference material.
Q: How should security teams control agent skill chaining?
A: Teams should control skill chaining by authorising the full action sequence at runtime, not by approving each skill in isolation.
Practitioner guidance
- Define runtime authorisation boundaries for agents Require every sensitive tool call or skill invocation to pass a live policy decision based on current context, not only pre-approved skill inventory.
- Classify external content as untrusted input Separate retrieved documents, web content, and tool output from instruction-bearing material so the agent cannot silently inherit authority from untrusted sources.
- Limit skill chaining in high-risk workflows Block or step up approval when one agent action would combine multiple skills or tools into a broader execution path than the original request.
Bottom line: Agentic AI backdoors are most dangerous at execution time, when trust decisions turn external content into authorised action paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:32 pm
Runtime authorisation is the control plane for agentic identity. Static analysis can tell you what is present in a skill bundle, but it cannot tell you what the agent will trust at execution time. That gap matters because the security decision is made inside the session, after retrieval, context loading, and tool selection. Practitioners should treat runtime policy enforcement as the primary governance layer for agent behaviour.
A few things that frame the scale:
- DeepSeek alone generated 113,000 new exposed API keys in 2025, illustrating how new AI providers create credential exposure before security guardrails catch up, according to the State of Secrets Sprawl 2026.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do runtime controls change governance for agentic AI?
A: Runtime controls move governance from static inventory management to decision-time enforcement. That means policy, logging, and escalation rules must apply when the agent is about to act, not just when the system is deployed. The practical result is tighter control over trust inheritance, tool use, and unintended action paths.
👉 Read our full editorial: Runtime agent control for skill backdoors in agentic AI