AI Agent Security Risks: When an Attacker Inherits an Agent’s Access

AI agents are rapidly moving from experimental technology into enterprise environments. They can access business applications, query databases, call APIs, execute workflows, retrieve information, and make decisions on behalf of users and organizations.

This creates a new cybersecurity challenge.

When an AI agent is granted legitimate credentials, permissions, APIs, tools, and access to sensitive information, an attacker may not need to compromise an administrator account directly. If the agent itself is manipulated, the attacker can potentially inherit the access the agent is already trusted to use.

In late 2025, Anthropic disclosed GTG-1002, an espionage campaign in which a threat actor manipulated Claude Code to perform an estimated 80–90% of tactical operations autonomously. The campaign involved an attacker-directed AI system rather than a compromised enterprise AI agent. However, it demonstrated an important capability: AI systems can chain reconnaissance, exploitation, credential use, lateral movement, and data collection at a scale and speed that would be difficult for a human operator to replicate manually.

For enterprises deploying agentic AI, this changes the risk calculation.

Authentication establishes trust. AI runtime behavior determines whether that trust is being abused.

At a glance

• AI agents operate with real credentials and permissions. A manipulated agent can use that access without generating a conventional authentication failure.
• Attackers can subvert agent trust through prompt injection, poisoned context, compromised tools and dependencies, or stolen application credentials.
• IAM, EDR, SIEM, cloud telemetry, and AI guardrails remain essential, but valid credentials and authorized API calls do not prove that an agent is acting within its intended purpose.
• Cyber deception creates controlled opportunities for malicious behavior to generate evidence when an agent accesses a honeytoken, follows a HoneyPath, or interacts with a deceptive asset.
• Acalvio Deception Guardrails extend 360 Deception into agentic AI runtimes as a capability within the ShadowPlex platform.

How AI Agents Expand the Trusted Attack Surface

Enterprise AI agents combine three capabilities that traditionally existed separately: identity, automation, and decision-making.

An agent may authenticate to enterprise systems using a service account or API credential, retrieve information from multiple sources, and then autonomously determine which actions to take.

This creates a security problem that extends beyond traditional AI model safety.

Four characteristics that expand AI security risk

Privileged identity. AI agents commonly use service accounts, OAuth tokens, API keys, or other machine identities. Their permissions may span multiple systems, while granular governance over individual actions remains uneven.

Authority to act. Unlike traditional software that performs a fixed sequence of operations, AI agents can execute scripts, retrieve information, modify records, send messages, provision resources, invoke APIs, and trigger additional workflows.

Dependence on external context and tools. Agentic workflows consume prompts, RAG data, documents, APIs, plugins, MCP servers, and instructions from other systems or agents. If a trusted information source becomes compromised or poisoned, it can redirect the agent's behavior without changing its identity.

High-volume runtime activity. An agent may execute numerous actions across different tools to complete a single objective. Each individual action may appear authorized even when the overall sequence represents malicious activity.

The security question therefore extends beyond whether an AI model is safe or an identity is valid. Defenders need to understand where trust is established, how that trust can be subverted, and where malicious use becomes observable.

Table 1: The AI Agent Trust Chain

Trust Layer	What the Enterprise Trusts	How Trust Can Be Subverted
Identity	Service accounts, OAuth tokens, API keys, and machine identities	Credentials are stolen, permissions are excessive, or the agent’s identity is impersonated
Context	Prompts, RAG data, vector databases, documents, and knowledge sources	Instructions or trusted data are poisoned to redirect agent decisions
Execution	APIs, plugins, external tools, workflows, and automated actions	A tool is compromised or an authorized capability is used for an unauthorized objective
Runtime	The live sequence of decisions, tool calls, and actions	Individually valid steps combine into lateral movement, privilege escalation, unauthorized access, or persistence

Four Ways Attackers Can Subvert AI-Agent Trust

Attackers do not necessarily need to compromise the AI model itself. They can target the information, identities, tools, and supporting infrastructure that influence how an agent operates.

Prompt Injection

Prompt injection introduces malicious instructions into content that an AI agent processes, such as documents, emails, web pages, tickets, or other external data.

Instead of exploiting software in the conventional sense, the attacker attempts to manipulate how the agent interprets instructions and determines what action to take.

Context Poisoning

Context poisoning targets the information an agent relies on when making decisions.

Attackers may manipulate vector databases, RAG content, memory stores, documents, or other trusted knowledge sources so that an agent receives misleading information and subsequently performs an unintended action.

Tool and Supply-Chain Compromise

Modern AI agents depend on tools, plugins, APIs, MCP servers, libraries, and third-party integrations.

Compromising one of these components can introduce malicious behavior into an otherwise trusted workflow. Because the agent is already authorized to use the tool, malicious actions may initially resemble legitimate activity.

Credential Theft and Identity Abuse

Attackers may steal or abuse application credentials, API keys, service accounts, OAuth tokens, and other machine identities associated with AI agents.

In this scenario, the attacker does not necessarily manipulate the agent itself. Instead, they abuse the identity and permissions that the agent already possesses.

These attack vectors are related but distinct. AI-specific manipulation maps most directly to MITRE ATLAS, while the resulting enterprise behaviors can also map to MITRE ATT&CK.

Table 2: Mapping AI-Agent Trust Attacks to MITRE

Trust Attack	Relevant Framework	Important Qualification
Prompt Injection	MITRE ATLAS: Prompt Injection	There is no direct ATT&CK equivalent; ATLAS provides the more precise AI-specific reference
Context Poisoning	MITRE ATT&CK T1565: Data Manipulation; MITRE ATLAS data-poisoning techniques	The mapping depends on whether stored, transmitted, retrieval, or runtime data is manipulated
Credential and Identity Abuse	MITRE ATT&CK T1528: Steal Application Access Token; T1552 may apply to exposed secrets	The applicable technique depends on whether the attacker steals an application token, API key, service-account secret, or another credential
Tool or Supply-Chain Compromise	MITRE ATT&CK T1195: Supply Chain Compromise	T1195 applies when an integration, dependency, or delivery mechanism is compromised

Although the entry points differ, the operational outcome can be similar: the attacker redirects trusted automation or assumes its identity instead of defeating authentication outright.

Why Authorized AI-Agent Activity Can Still Be Malicious

Existing security controls remain fundamental.

IAM determines which identities and permissions are authorized. EDR provides endpoint telemetry and protection. SIEM and cloud monitoring correlate activity across systems. Model and policy guardrails can constrain inputs, outputs, and tool usage.

However, a manipulated AI agent may continue operating entirely within these boundaries.

It can use approved credentials, call authorized APIs, and perform actions that the agent technically has permission to execute.

The challenge is determining whether a sequence of individually valid actions serves the agent's approved business purpose—or an attacker's objective.

Behavioral analytics can identify unusual patterns, but AI-agent activity naturally varies according to task, context, and tools. An individual API call may not provide enough evidence to identify compromise, while the malicious nature of a multi-stage sequence may only become apparent after significant activity has already occurred.

A different detection question

Cyber deception approaches this problem differently.

Instead of asking only:

“Does this activity look unusual?”

defenders can ask:

“Why did this identity, agent, or process interact with an asset that no approved workflow should ever require?”

When an AI agent retrieves a honeytoken, invokes a deceptive tool, or follows a HoneyPath toward a decoy API, the interaction can provide high-confidence evidence that the agent has moved outside its intended operational path.

Table 3: Existing Controls and the Runtime Security Gap

Security Capability	What It Establishes	What Can Remain Unresolved
IAM and Identity Governance	Which identities and permissions are authorized	Whether valid access is being used for its intended purpose
Model and Policy Guardrails	Whether inputs, outputs, and actions comply with defined rules	What happens after a bypass, poisoned context, compromised tool, or identity takeover
EDR, SIEM, Cloud and API Telemetry	What occurred and the surrounding endpoint, network, and application context	Whether individually legitimate events collectively prove agent misuse
Cyber Deception and 360 Deception	Whether an agent or identity interacted with an asset that no approved workflow should require	Detection confidence depends on credible placement, coverage, maintenance, and SOC integration

What Manipulated AI-Agent Behavior Looks Like in Practice

Consider a customer-support AI agent that processes uploaded documents before retrieving information from internal systems.

An attacker embeds hidden instructions inside an uploaded PDF. When the agent processes the document, the instructions attempt to redirect it toward retrieving sensitive customer records from an internal API.

The request may succeed because the agent is using legitimate credentials with authorized permissions.

Authentication has already occurred.

The security question is now whether the AI runtime action aligns with the agent's intended purpose.

Detecting Misuse After Authentication

Other security controls may identify an anomalous API call, a policy violation, or suspicious data movement.

Cyber deception adds a controlled opportunity for the behavior to generate a stronger signal.

• interacts with a decoy API;
• retrieves a honeytoken embedded in accessible data;
• invokes a deceptive or “honey” skill;
• follows a HoneyPath it should never need;
• attempts to access a deceptive identity or resource.

In this scenario, the attacker's objective has redirected the agent's behavior while the underlying identity remains valid.

Compromised credentials can be rotated. But when the problem is compromised decision-making, defenders also need visibility into how a trusted identity behaves after authentication.

Detecting and Disrupting Manipulated AI Agents

This is where Acalvio's 360 Deception approach fits into an AI-agent security strategy.

The approach makes deceptive assets appear realistic, makes production assets more difficult for attackers to classify, and introduces signals that automated reconnaissance cannot safely ignore.

Together, these capabilities create an environment where attackers and manipulated AI agents have less reliable “ground truth” for deciding what to target next.

Deception Guardrails for Agentic AI

Within the Acalvio ShadowPlex platform, Deception Guardrails extend 360 Deception into agentic AI runtimes.

The capability can deploy deceptive identities, credentials, honey skills, decoy MCP servers, RAG systems, APIs, and other controlled assets across AI-agent workflows and the infrastructure supporting them.

This complements model and policy guardrails by detecting when a trusted agent—or an attacker using its identity—moves outside an intended operational path.

This is the role of cyber deception in a preemptive cybersecurity strategy.

The objective is not to predict every possible prompt, instruction, or attack chain. Instead, deception instruments likely misuse paths so unauthorized behavior has more opportunities to reveal itself at the speed at which autonomous agents operate.

AI Runtime Deception in Practice

Honeytokens placed in agent-readable credential stores, files, and configuration surfaces can expose unauthorized credential retrieval.

Honey skills and deceptive tools can reveal when an agent invokes a capability that no approved workflow should require.

Decoy MCP servers, RAG systems, and AI agents can surface attempts to enumerate, manipulate, or pivot through the surrounding AI infrastructure.

Decoy APIs, documents, and data objects can identify unexpected application access, unauthorized collection, or attempted exfiltration.

HoneyPaths can expose lateral movement when an agent or attacker traverses infrastructure outside an approved path.

Within ShadowPlex, these deception assets can be managed across dynamic cloud and enterprise environments. As agents, identities, tools, and workloads change, deception coverage needs to evolve with them.

Automation provides the required scale, while operational discipline ensures that deception signals remain credible and actionable.

Cyber Deception Complements Existing AI Security Controls

Cyber deception does not replace prompt filtering, model safety, least privilege, tool allowlisting, IAM, EDR, cloud security, or incident response.

Instead, it adds another detection layer focused specifically on unauthorized interaction with engineered deception.

Its effectiveness depends on factors such as:

• accurate placement of deceptive assets;
• realistic deception content;
• appropriate coverage of likely attack paths;
• clear ownership and operational processes;
• integration with SOC workflows;
• ongoing maintenance as the environment changes.

The underlying detection mechanism has demonstrated measurable results against automated, credential-driven intrusion techniques.

During the FY25 U.S. Navy Cyber Resilient Systems Advanced Naval Technology Exercise (ANTX), Acalvio generated 100% true-positive alerts and denied approximately 80% of attacker objectives under controlled exercise conditions.

The exercise was not a production AI-agent deployment. However, it provides evidence for the broader security proposition: deceptive assets can expose and disrupt automated activity that relies on trusted credentials.

Securing AI Agents Requires Runtime Detection

Prompt injection, context poisoning, compromised tools, and identity abuse are persistent risks associated with agentic AI.

Prevention remains essential. However, no input filter, access policy, or behavioral model can anticipate every possible path through a system that continuously consumes new information and takes actions across dynamic environments.

The objective is not to guarantee that every malicious action will encounter a decoy.

Instead, organizations should instrument the attack paths most likely to expose misuse and turn otherwise ambiguous AI runtime activity into evidence that security teams can act upon.

A resilient AI security strategy should combine:

• identity security and least privilege;
• model and policy guardrails;
• runtime monitoring;
• cloud and API security;
• SOC and incident-response processes;
• deception-based detection.

Together, these controls provide earlier visibility into compromised AI behavior while preserving existing investments in IAM, EDR, SIEM, cloud security, and Zero Trust architectures.

The fundamental question is changing.

Instead of asking analysts to infer intent from weak signals, organizations can create environments where malicious interaction generates stronger evidence.

AI agents will continue to gain autonomy and access to enterprise systems. Organizations may not be able to eliminate every manipulation technique, but they can make unauthorized behavior more visible—and detect it before a compromised agent can turn trusted access into lateral movement, privilege escalation, or data exposure.

Strengthen Your AI Agent Security Strategy

Acalvio's ShadowPlex platform with Deception Guardrails provides a preemptive security layer for agentic AI environments, using deception to expose manipulated agents, compromised identities, and unauthorized interactions.

Learn more about how cyber deception can help secure AI agents and protect the identities, tools, APIs, data, and infrastructure they rely on.