Notifications
Clear all
Topic starter
01/08/2026 10:44 pm
TL;DR: Straiker’s STAR Labs report says more than 1,700 successful exploits against real coding, productivity, and first-party agents showed the same pattern: the model behaves as designed, but poisoned context, indirect prompt injection, and unmanaged tools let attackers drive harmful actions, according to Straiker. The governing problem is not model trust alone but the gap between agent architecture, deployment context, and runtime control.
NHIMG editorial — based on content published by Straikerai: Agentic security needs its own framework for context attacks
By the numbers:
- Straiker says it ran more than 1,700 successful exploits against real coding, productivity, and first-party agents.
Questions worth separating out
Q: How should security teams control context in agentic AI systems?
A: Security teams should treat context as a governed input, not an implementation detail.
Q: Why do agentic AI systems create more security risk than standard chatbots?
A: Agentic systems can turn model output into action, which means a bad instruction can affect code flow, tool use, and downstream state.
Q: What do organisations get wrong about prompt-based safety for agentic AI?
A: They assume better instructions can compensate for broad tools.
Practitioner guidance
- Define agent privilege boundaries Classify every AI agent by role, data reach, tool access, and identity used for execution.
- Govern context sources before prompts Allow agents to read only approved mailboxes, repositories, documents, and tool outputs.
- Treat connectors as privileged dependencies Inventory every MCP server, API connector, and plugin the agent can reach.
What's in the full report
Straiker’s full research covers the operational detail this post intentionally leaves for the source:
- A breakdown of the 1,700-plus successful exploit paths across coding, productivity, and first-party agents.
- The full twelve-cell STAR map showing how application, model, tools and MCP, and data layers behave by agent role.
- Named case studies, including the Claude Code source leak, with the attack sequence and outcome for each one.
- The five-control defender playbook mapped to NIST AI RMF and OWASP categories for implementation work.
👉 Read Straiker’s report on the STAR Framework for agentic AI security →
Agentic AI context attacks: what security teams are missing?
Explore further
01/08/2026 10:53 pm
Context has become the real control plane for agentic AI. The article’s central point is that the model is often not the failure point, because it is behaving as designed. The failure is the assumption that a legitimate user and an aligned model are enough to make the system safe. For identity teams, that means the security boundary has shifted toward what the agent can read, what it can invoke, and which credentials make those actions possible. The practitioner conclusion is that context must be governed like access.
A question worth separating out:
Q: How can organisations reduce blast radius when an AI tool is compromised?
A: Limit the tool's scope, separate high-risk functions from general collaboration data, and make revocation fast enough to matter. Pair least privilege with short-lived tokens, clear ownership, and logging that links the agent, the user, and the downstream system. Containment only works when those paths are visible.
👉 Read our full editorial: Agentic AI security needs its own framework for context attacks
