A two-leg agent can still leak information by trying to satisfy a prompt. If it can reach sensitive data and send output, it may post customer records or internal details to an external destination without any attacker intervention. That precursor state is worth catching early because adding one more connector can turn it into full exfiltration.
Why Over-Permissioned Agents Become Data Leaks
An agent that can read sensitive data and also send output has enough capability to turn a normal task into a disclosure event. The problem is not just excessive privilege; it is the combination of broad read access, an outbound path, and a goal-seeking system that may try to be helpful even when the request is unsafe. For autonomous workloads, that turns one weak control boundary into a direct exposure path.
Current guidance suggests treating this as an access-design issue, not only a content-security issue. If the agent can retrieve customer records, internal notes, or tokens and then transmit them without a separate approval step, the organisation has effectively created an unmonitored relay for sensitive information. NHI Mgmt Group notes that 97% of NHIs carry excessive privileges, which helps explain why this pattern is so common in practice. Ultimate Guide to NHIs — 2025 Outlook and Predictions
In practice, many security teams discover the issue only after a connector, plugin, or prompt path has already allowed the agent to move data out of the environment.
How the Failure Chain Works in Practice
The failure usually has three parts: over-broad access, insufficient egress controls, and an agent that is allowed to act on untrusted instructions. If the agent can query a database, search a knowledge base, or open files, it can gather sensitive material. If the same agent can post to email, chat, tickets, webhooks, or external APIs, it can send that material onward. No attacker needs to intercept the flow when the system itself is already empowered to expose it.
This is why static role design often breaks down for agents. A role that looks acceptable for read-only internal assistance can become unsafe when the agent has tool use, retries, context aggregation, or access to multiple systems. A safer pattern is intent-based authorisation combined with narrow, ephemeral credentials and explicit outbound allowlists. The agent should only be able to send data to destinations that have been pre-approved for the specific task, and only after policy checks that can evaluate content sensitivity, destination risk, and business purpose. OWASP Agentic AI Top 10
OWASP NHI Top 10 is useful here because it frames the identity side of the problem: who or what is allowed to hold credentials, which scopes they can exercise, and how those permissions are constrained over time. If the agent must access protected data, the safer design is to time-box the credential, scope it to the minimum dataset, and route any outbound action through a separate control point that can block or redact. These controls tend to break down when the agent is allowed to chain tools across multiple systems because the second and third hop often bypass the original access assumption.
Common Variations and Edge Cases
Tighter outbound control often increases friction, so organisations have to balance automation speed against disclosure risk. Not every agent needs the same level of restriction, but the boundary should change as soon as the agent touches regulated, customer, or credential-bearing data.
One common edge case is internal-only output, such as summarising tickets or drafting messages for human review. That is materially different from an agent that can directly post externally, because the human review step creates an opportunity to catch leakage before it leaves the environment. Another edge case is benign-looking destinations, such as collaboration tools or support systems, where sensitive fields can still be copied into places with weaker retention or broader readership. Best practice is evolving, but the decision rule is clear: if the agent can read high-value data, assume any unconstrained outbound channel is a possible exfiltration path until proven otherwise.
The other failure mode is policy drift. Teams often secure the first connector but later add a new one for convenience, creating a fresh route that was never covered by the original review. That is where governance, not just technical filtering, becomes essential. In practice, the most effective programmes re-check outbound permissions whenever the agent’s tools, destinations, or data domains change.
Risk and Threat Considerations
An over-permissioned agent with sensitive-data access and no safe outbound controls creates immediate confidentiality risk and an easy abuse path for prompt-driven leakage. The danger is not limited to deliberate theft: the agent can disclose data while trying to complete a task, or an attacker can exploit the same tool path to force exfiltration.
Failure mechanism: The agent reads protected content, then uses a permitted send channel, connector, or API call to move that content outside the trust boundary. Without destination controls, content filtering, or approval gating, the system itself becomes the exfiltration mechanism.
Impact: Sensitive records, internal context, or secrets can leave the environment without triggering a traditional compromise alert. That can create privacy exposure, regulatory impact, and follow-on compromise if the leaked material includes credentials or operational details.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10, CSA MAESTRO and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 — Improper Tool Governance | Directly covers unsafe tool use and agent-mediated data exposure. |
| Recommendation — Restrict agent tools so outbound actions require policy checks and approved destinations. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Inventory and Ownership | Covers ownership and control of non-human identities that can move data. |
| Recommendation — Inventory agent identities and bind each one to least-privilege, task-scoped access. | ||
| CIS Controls v8 | 6 — Access Control Management | Applies to limiting who and what can access sensitive data and external channels. |
| Recommendation — Enforce least privilege and remove unnecessary outbound access paths for agents. | ||
| NIST AI RMF | GOVERN — Govern AI Risk | Supports governance of AI risks from unsafe autonomy and disclosure paths. |
| Recommendation — Govern agent data-sharing rules and require review for high-impact outbound use. | ||
| CSA MAESTRO | A2 — Agent Identity and Access | Addresses agent identity, tool access, and bounded autonomy in AI systems. |
| Recommendation — Constrain agent identities to approved tools, scopes, and short-lived credentials. | ||
Practitioner Guidance
What to prioritise: Separate read access from outbound authority. If an agent can retrieve sensitive material, treat any direct external send capability as a high-risk privilege, not a convenience feature.
What to verify: Confirm that every outbound destination is allowlisted, that sensitive fields are redacted or blocked before send, and that the agent cannot self-authorise a new connector without review. If the control cannot show those three facts, it is not safe to trust.
Decision rule: If the agent handles customer data, secrets, or internal operational detail, require a human or policy gate for any external transmission. If the data is low sensitivity and the destination is tightly constrained, limited automation may be acceptable, but only with auditability and rollback.
Practitioner takeaway: The key judgement is not whether the agent can read sensitive data, but whether it can turn that access into an uncontrolled outbound event; once that path exists, the blast radius grows with every added connector.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 6, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
