Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Agentic AI incidents are often controlled by repository files, installed skills, inherited identity, and approval policy rather than the prompt itself, according to Prompt. The examples of AGENTS.md hijack, marketplace skill abuse, and release-pipeline compromise show that the real governance gap is control-plane authority, not model intent, and that changes how teams should review, approve, and contain agent actions.
NHIMG editorial — based on content published by Prompt: When AI Agents Become the Supply Chain: Hidden Control Planes in Agentic Systems
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What fails when an AI agent can act on hidden instructions under inherited access?
A: The failure is not the prompt itself.
Q: Why do AI systems create identity risk as well as model risk?
A: Because AI systems rarely act alone.
Q: What signs show that agent control-plane governance is failing?
A: Look for agents that can install packages from unapproved sources, execute shell wrappers without exposing the real payload, or continue acting after instruction files are changed.
Practitioner guidance
- Map every agent's authority chain Document which repository files, skills, model endpoints, and tokens can influence or authorise each agent action.
- Constrain agent identities to task-scoped access Issue short-lived credentials with narrow tool permissions, and separate read, write, install, and publish capabilities so an injected instruction cannot escalate into broad system access.
- Harden instruction-bearing inputs Treat AGENTS.md files, retrieved pages, marketplace skills, and package manifests as privileged configuration.
What's in the full article
Prompt's full blog post covers the operational detail this analysis intentionally leaves for the source:
- Step-by-step breakdown of the AGENTS.md goal hijack workflow and the approval prompt behaviour
- Practical mechanics of marketplace skill abuse and dependency redirection in real developer environments
- Details on instruction-file integrity monitoring, session restoration, and post-compromise containment
- Discussion of browser-session authority and software supply chain exposure as agentic attack paths
👉 Read Prompt's analysis of agentic AI control-plane risk and supply-chain abuse →
Agentic AI control planes: what security teams are missing?
Explore further
02/09/2026 1:30 pm
Agentic AI governance now has a hidden control-plane problem: the prompt is often only the trigger, while the real risk sits in the files, skills, and identities that shape execution. That means traditional prompt safety controls are necessary but insufficient, because they do not answer who authorised the action, what tool path was used, or what credential made it possible. For practitioners, the governing question is provenance of authority, not prompt quality.
A question worth separating out:
A: No. The article shows that the same compromise path can begin in a repository, move through a plugin or package source, and end as an authorised action. Teams need one governance model that covers instruction provenance, dependency trust, identity scope, and action approval.
👉 Read our full editorial: Agentic AI control planes, not prompts, define real supply chain risk
