Deadly Duo

Expanded Definition

The deadly duo is an agentic AI risk pattern where an LLM can ingest untrusted content and then execute privileged actions based on that content. The danger is not limited to direct data exfiltration. The real issue is instruction injection through attacker-controlled text that influences tool use, queries, approvals, or workflow decisions.

In NHI security, the term is most useful when describing systems that bridge read and act capabilities without strong trust boundaries. That includes agents connected to internal APIs, ticketing systems, cloud operations, or secret-bearing workflows. No single standard governs this yet, and usage in the industry is still evolving, but the control logic aligns closely with NIST Cybersecurity Framework 2.0 principles for governance, access control, and secure execution.

The most common misapplication is treating the model as the risk source alone, which occurs when organisations ignore the attacker-controlled input path and the downstream tool permissions that make the compromise actionable.

Examples and Use Cases

Implementing deadly duo protections rigorously often introduces workflow friction, requiring organisations to weigh autonomous speed against stronger input validation, approval checks, and tool isolation.

• An internal support agent reads a malicious email thread and uses connected tools to create a fraudulent password-reset request.
• A code assistant ingests a poisoned issue comment and then generates a destructive deployment command against a production environment.
• A finance bot summarizes attacker-written invoice text and triggers an approval workflow tied to privileged payment systems.
• A knowledge agent consumes untrusted web content and then queries internal systems with overbroad entitlements, exposing operational data.
• Security teams use the Ultimate Guide to NHIs to map how agent permissions, secrets, and rotation controls affect tool-enabled AI systems.

These cases usually require a combination of content provenance controls, tool allowlisting, scoped credentials, and human approval for sensitive actions. Guidance from NIST Cybersecurity Framework 2.0 helps structure those safeguards across identify, protect, detect, respond, and recover activities.

Why It Matters in NHI Security

The deadly duo matters because it turns an LLM from a passive interpreter into an execution path for attacker intent. Once untrusted input can influence privileged actions, the organisation faces tool abuse, destructive automation, unauthorized requests, and difficult-to-trace operational impact. In NHI environments, the agent often inherits service account privileges, API keys, or workflow authority that were never meant to be steered by adversarial text.

This is especially dangerous when secrets, connectors, and delegated permissions are already overexposed. NHI Mgmt Group reports that 97% of NHIs carry excessive privileges, which means agentic systems can inherit a broad attack surface before any prompt-level abuse even begins, as documented in the Ultimate Guide to NHIs. The right control mindset is to separate ingestion from execution, limit what any agent can invoke, and require explicit trust checks before action. Organisaties typically encounter the operational cost only after a malicious input has triggered a harmful tool call, at which point the deadly duo becomes impossible to ignore.

Related resources from NHI Mgmt Group

• How should security teams evaluate Duo Security alternatives for IAM governance?
• Why do Duo OTPs and similar one-time codes still fail against phishing?