Limit delegated permissions, separate write and transfer capabilities, and require provenance for high-impact actions. If an attacker can reuse valid access while steering the agent through malicious instructions, the only reliable defence is to narrow what the agent can do and to detect when its action pattern changes.
How to stop a hijacked AI agent from draining accounts
The practical answer is to treat the agent as a delegated actor with bounded authority, not as a trusted extension of the user. If an attacker can steer a valid session, they can often turn an “approved” agent into a payment path. The defence is to narrow what the agent can do, split high-risk actions, and make abnormal action sequences visible fast.
Why delegated authority becomes the failure point
Account-draining incidents usually do not require the attacker to break authentication if they can reuse valid access and influence the agent’s decisions. That is why delegated permissions matter more than the model’s intelligence: the risk sits in what the agent is allowed to initiate, approve, or repeat on the user’s behalf. A stolen or abused session can become a transfer channel if write and movement privileges are blended.
For that reason, separate capabilities that create or edit payment instructions from capabilities that move value. If one action can both prepare and execute a transfer, the blast radius is too large. Provenance for high-impact actions, such as a fresh, attributable approval trail, forces the organisation to distinguish routine agent work from value-moving instructions that deserve additional verification.
Controls that reduce drain risk without breaking useful automation
The most effective pattern is least privilege plus action-specific gating. Give the agent only the minimum permissions needed for the task, scope those permissions to a narrow time window, and require stronger checks before any action that changes balances, external payees, withdrawal routes, or transfer limits. AI Agent Authorisation Guide is useful here because it frames task-scoped access and per-action policy decisions as the control point, not broad session trust.
High-risk actions should also be segmented by function. An agent may be allowed to draft, reconcile, or recommend, while a separate workflow authorises transfer execution. Where the agent touches browser sessions or payment interfaces, isolation and site scope matter as much as model behaviour. Browser and Computer-Use Agent Security Guide is relevant because it addresses how real user sessions can be misused when the agent operates in the same trust boundary as the human.
Detection closes the gap that policy alone cannot. You need action logging that shows who, or what, initiated the request, the sequence of tools or steps used, and whether the agent suddenly started behaving unlike its normal baseline. AI Agent Observability, Audit and Incident Response Guide supports that operational view, including kill-switch thinking and attribution when an agent begins to act outside expected patterns.
Risk and Threat Considerations
Hijacked agents are attractive because they can turn legitimate access into rapid, low-friction theft without obvious malware-style signals. The attacker does not need to invent authority if the agent already has it, so over-scoped permissions, long-lived sessions, and shared privileges create a direct path from instruction steering to financial loss.
Failure mechanism: The compromise succeeds when a malicious prompt, injected instruction, or abused session causes the agent to reuse valid access for actions that were never meant to be fully autonomous, especially transfers, payee changes, or balance-moving requests.
Impact: Funds can be drained quickly, approvals can be fabricated as if they were routine, and recovery becomes harder because the activity may look like normal agent execution rather than a clear account takeover.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Hijacked agents drain accounts by abusing delegated privilege and valid access. |
| ASI02 — Tool Misuse | Account draining occurs when an attacker steers an agent into harmful tool actions. | |
| Recommendation — Constrain agent privilege and require per-action approval for value-moving steps. Restrict tool scopes and block transfer tools from routine agent workflows. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Account-drain risk rises when long-lived or reusable credentials let a hijacked agent keep acting. |
| AC-6 — Least Privilege | The question is fundamentally about limiting delegated permissions to reduce blast radius. | |
| AU-2 — Event Logging | Detection depends on logging agent actions and high-impact transfers for review. | |
| Recommendation — Rotate and limit credential lifetime for agent-access paths. Grant the agent only the minimum access needed for its current task. Log agent-initiated value-moving actions and review them for anomalies. | ||
Practitioner Guidance
What to verify: Confirm that the agent cannot both prepare and execute the same value-moving action, and test whether a stolen session would still permit transfers, recipient changes, or limit increases.
Decision rule: If the action can move money, change payment rails, or widen access, require separate approval and stronger provenance before execution. If it is only informational or draft-producing, keep it in the lower-trust lane.
What good looks like: The agent can help users work faster, but any action with financial impact is narrowly scoped, attributable, and easy to interrupt when behaviour changes.
Practitioner takeaway: Do not try to “make the agent safer” by trusting its judgment more, make it safer by shrinking the authority it can exercise and by making every high-impact step independently visible.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 10, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org