What breaks when an agent processes untrusted content and has enterprise access?

Why This Matters for Security Teams

Once an agent can read untrusted content and still act with enterprise access, prompt injection stops being a model-quality issue and becomes an identity and control-plane issue. The dangerous part is not the instruction hidden in a document or ticket, but the fact that the agent may treat it as operationally valid and then use legitimate permissions to reach email, files, code, SaaS apps, or admin functions. This is why OWASP’s OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both push teams toward runtime governance, not just pre-deployment testing.

NHI Management Group data shows why the blast radius is so often larger than teams expect: 97% of NHIs carry excessive privileges, widening the attack surface when an agent is tricked into using them. The same pattern appears in incidents such as Gemini AI Breach — Google Calendar Prompt Injection and Replit AI Tool Database Deletion, where the workflow itself became the attack path. In practice, many security teams encounter this only after an agent has already acted on malicious content and generated a real enterprise-side change.

How It Works in Practice

The core failure is that the agent is both interpreter and actor. It ingests external content, extracts instructions, and then executes them through connected tools that may already be trusted by the enterprise. That combination means a single malicious prompt embedded in a PDF, email, issue tracker, webpage, or chat can steer the agent toward credential exposure, data exfiltration, or destructive actions. Current guidance suggests treating untrusted content as a control boundary, not just a content-filtering problem.

Practically, the strongest pattern is to separate what the agent can read from what it can do. Use runtime policy checks, scoped tool permissions, and task-specific credentials so the agent never has broad standing access just because it is active. That means short-lived, per-task secrets, workload identity for the agent, and explicit approval gates for high-impact actions. Standards-aligned programs increasingly map this to least privilege, Zero Trust, and policy-as-code rather than static role grants. The OWASP Non-Human Identity Top 10 is relevant here because agent access is still an identity problem, even when the trigger is a model decision.

Real incidents illustrate the mechanics. In Amazon Q AI Coding Agent Compromised, attacker-controlled instructions reached a productive workflow. In CoPhish OAuth Token Theft via Copilot Studio, the abuse path involved an agentic workflow with real enterprise reach. Teams should therefore treat every external input as potentially adversarial, evaluate policy at request time, and revoke access immediately after task completion. These controls tend to break down in environments where agents are allowed to chain tools across email, documents, and admin consoles because the combined context becomes too broad to validate safely.

Common Variations and Edge Cases

Tighter control often increases friction, requiring organisations to balance usability against containment. That tradeoff is real, especially when teams want agents to summarize documents, act on tickets, and update systems without human review. There is no universal standard for this yet, but current guidance suggests that the more authority an agent has, the narrower its input trust boundary must be.

One edge case is read-only workflows that still matter because they can leak secrets. A harmless-looking summary agent can still expose tokens, PII, or internal plans if untrusted content manipulates it into surfacing hidden context. Another edge case is multi-agent pipelines, where one compromised stage poisons downstream decision-making. The CSA MAESTRO agentic AI threat modeling framework and MITRE ATLAS adversarial AI threat matrix are useful references for mapping those cascades.

Another variation is the “human-in-the-loop” assumption. Review does not help if the review prompt is itself polluted or if approvers cannot see the original untrusted content. Best practice is evolving toward content provenance, sandboxing, and explicit separation between retrieval, reasoning, and action. That is the right model for agentic systems because the attack is often not model hallucination, but delegated enterprise authority interacting with hostile input.

Related resources from NHI Mgmt Group

• When does AI agent access create more risk than it reduces?
• What is the difference between governing human access and governing AI agent access?
• Why is JIT access important for AI agent management?
• How should security teams govern AI agents that can access enterprise systems?