AI agent attacks and silent exfiltration: are your controls keeping up?

TL;DR: Straiker’s STAR Labs reports more than 1,700 successful adversarial scenarios across coding, productivity, and first-party agents, with 36% of successful coding-agent attacks reaching remote code execution and 91% of successful productivity-agent attacks ending in silent exfiltration. The findings show agentic security now depends on governing tool use, credentials, and context, not just scanning code or monitoring endpoints.

NHIMG editorial — based on content published by Straiker: Straiker Research Finds 36% of Successful AI Coding Agent Attacks End in Remote Code Execution

By the numbers:

• 36% of successful attacks on coding agents in scope, including Cursor, Claude Code, and GitHub Copilot, reached remote code execution on the developer’s machine, the same machine that holds source code and cloud keys.
• 91% of successful attacks on productivity agents ended in silent data exfiltration.
• 24% of 17,651+ tracked Model Context Protocol servers carry at least one vulnerability.

Questions worth separating out

Q: What breaks when AI agents are given broad standing access?

A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.

Q: Why do AI agents complicate existing IAM and PAM controls?

A: AI agents complicate IAM and PAM because they often inherit delegated credentials, operate across multiple systems, and keep acting after the initial approval moment has passed.

Q: How can security teams tell whether agent access is actually under control?

A: Look for evidence that the team can trace every tool call, secret use, and cross-system action back to a named owner and a valid approval path.

Practitioner guidance

• Scope each agent to a dedicated identity Assign separate credentials, tokens, and tool permissions to each AI agent so that compromise cannot inherit broad human or shared service-account access.
• Contain coding agents on isolated workstations Run coding agents in restricted environments that limit file access, shell execution, and cloud credential exposure.
• Classify data access for productivity agents Define which document types, mailbox folders, chat channels, and web destinations a productivity agent may touch, then block any cross-boundary export that has not been explicitly approved.

What's in the full report

Straiker’s full research covers the operational detail this post intentionally leaves for the source:

• Per-agent attack findings across coding, productivity, and first-party deployments, useful if you need scenario-level evidence for internal risk reviews.
• Research details on how malicious tools, prompt injection, and compromised contexts led to remote execution or silent exfiltration.
• The report’s full breakdown of Model Context Protocol and tool-chain exposure, including the shared dependency patterns that expand blast radius.
• The STAR Framework for AI Agent Security, which is the source’s structural model for mapping attack surface across layers and agent types.

👉 Read Straiker’s STAR Labs threat report on AI agent attack paths and blast radius →

AI agent attacks and silent exfiltration: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →