How should security teams pentest agentic systems differently from web applications?

Why This Matters for Security Teams

Agentic systems do not fail like ordinary web apps because they are not limited to request and response. They can plan, call tools, retain state, and chain actions across systems, which means a single weakness can turn into unauthorized execution rather than a simple data leak. That is why pentesting has to cover intent, delegation, memory, and downstream effects, not just injection points and authentication flows.

Current guidance from OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework points security teams toward system-level risk, not just application inputs. The practical issue is that agentic workflows often inherit privileges from connected APIs, cloud resources, and enterprise identity systems. If the pentest stops at the chat interface, it will miss the most dangerous control failures: tool abuse, hidden escalation paths, and persistent state that survives a single session.

In practice, many security teams encounter these weaknesses only after an agent has already taken an unsafe action, rather than through intentional testing of its full decision path.

How It Works in Practice

Pentesting an agentic system starts by mapping the action surface. That includes prompts, retrieval sources, memory stores, tools, connectors, approval gates, and any identities or service accounts the agent can use. The test objective is to see whether an attacker can shape the agent’s decisions, redirect its tool use, or cause it to expose or execute something outside its intended scope. A useful baseline is to follow attack patterns from the MITRE ATLAS adversarial AI threat matrix and the OWASP Top 10 for Agentic Applications 2026.

Good testing normally includes:

• Prompt injection against user prompts, retrieved content, and tool outputs.
• Tool abuse where the agent is coaxed into calling high-risk functions with unsafe parameters.
• Privilege inheritance checks to confirm the agent cannot exceed the least privilege of its underlying identity.
• Memory and state abuse to test whether malicious instructions persist across turns, sessions, or workflows.
• Multi-step chain testing to validate whether low-risk actions can be combined into a higher-risk outcome.

Unlike a web pentest, this work has to observe the runtime as it makes decisions. The tester should validate not only whether the agent can be tricked, but whether guardrails stop the agent from acting, whether approvals are enforced, and whether outputs are checked before execution. Guidance from the CSA MAESTRO agentic AI threat modeling framework is especially useful where multiple tools, models, and orchestration layers interact.

These controls tend to break down when an agent has broad API reach, weak separation between test and production environments, or no enforced approval step before irreversible actions.

Common Variations and Edge Cases

Tighter agent controls often increase testing overhead, requiring organisations to balance coverage against speed, product agility, and operational complexity. That tradeoff becomes sharper when an agent is embedded in customer workflows, internal IT automation, or security operations, because the same controls that reduce risk can also slow legitimate work.

There is no universal standard for exactly how much autonomy is acceptable, so best practice is evolving. Some environments can be tested with static tool inventories and deterministic workflows. Others use dynamic tool selection, long-lived memory, or RAG over changing content, which makes the attack surface much harder to freeze for a traditional pentest. In those cases, the tester should also evaluate whether the system validates inputs from retrieved documents, whether outputs are screened before action, and whether the agent can be forced into unsafe cross-domain behaviour.

The strongest programmes treat agentic testing as a blend of adversarial AI review and classic security validation. The NIST AI Risk Management Framework helps anchor governance, while the Anthropic report on the first AI-orchestrated cyber espionage campaign is a reminder that operational abuse is no longer theoretical. Where approval workflows are brittle or tool permissions are too broad, the pentest needs to assume active misuse rather than benign failure.

Related resources from NHI Mgmt Group

• How should security teams contain prompt injection in agentic systems?
• How should security teams govern AI cloud infrastructure differently from web apps?
• What do security teams get wrong about least privilege for agentic systems?
• How should security teams govern API keys and M2M applications differently?