Security teams worried about large language model safety may be focusing on the wrong problem. The real risk in enterprise AI systems lies in the infrastructure around the model, including agents, connectors, orchestration frameworks, and tool integrations that enable access to enterprise data and actions.
An AI agent can read documents, query databases, send email, invoke APIs, and interact with other agents once it is linked to corporate systems. This is what makes agents so helpful and what makes them attractive to attackers.
Many emerging attacks do not target the model itself. They manipulate the instructions agents receive or abuse the permissions agents inherit from users. This creates a new attack surface that traditional application security models were never designed to address.
Prompt Injection Is a Structural Problem
Prompt injection is often treated as a vulnerability that can be patched or filtered. However, it is really a structural property of how agent context windows work. Every instruction, document, memory snippet, and tool output enters a flat trust domain where the model cannot distinguish legitimate directives from attacker-controlled content. Builders call this context engineering. Security teams should recognize it as security engineering.
AgentFlayer research published in 2025 showed how malicious instructions embedded inside ordinary content can manipulate AI assistants connected to external services. In the demonstration, a payload hidden in an uploaded document instructed an AI assistant to search a user’s connected Google Drive for API keys and embed the credentials in an image hosted on Azure Blob Storage. The storage domain was treated as trusted infrastructure, allowing the data to reach attacker-controlled analytics systems before the user finished reading the AI-generated summary.
This type of attack is commonly described as indirect prompt injection. It arises when models process untrusted content while also interacting with external tools or connected data sources. The OWASP Top 10 for Large Language Model Applications identifies prompt injection as one of the most significant risks in systems that combine language models with integrations and automated actions.
No exploit code is required. The attack is delivered entirely through instructions embedded in content the agent is expected to process. This is also why memory and context poisoning, identified as ASI06 in the OWASP Top 10 for Agentic Applications, represents a distinct and persistent threat: corrupted context compounds across sessions and alters autonomous reasoning long after the initial injection.
When AI Agents Act With Your Authority
The most dangerous thing about AI agents in enterprise environments is that they can be tricked. And when they are tricked, they act with the full authority of the user who deployed them.
Most enterprise AI agents operate with access to tools such as email systems, CRM platforms, internal APIs, and corporate databases. From a monitoring perspective, the resulting activity often appears legitimate because the agent is operating with valid permissions.
Researchers demonstrated this dynamic in late 2025 using a malicious Model Context Protocol (MCP) server introduced into an agent gateway. The server enabled ongoing access to enterprise data flows and allowed data exfiltration using the user’s own credentials, including tokens issued through standard authentication mechanisms.
From the platform’s perspective, nothing unusual occurred. But in practice the attacker had effectively inherited the operational privileges of the CFO. Any agent with meaningful tool access creates this risk. The agent’s permissions become the attacker’s permissions the moment untrusted content enters its context.
The ecosystem surrounding AI agents is becoming a new supply chain risk. A large-scale study analyzing more than 42,000 agent skills found that 26% contained at least one security vulnerability, and 81% of those vulnerabilities were associated with active data exfiltration patterns.
This pattern reflects a predictable attack path. When a user approves a skill or plugin, the agent often receives persistent permissions to read files, write data, download code, and open network connections with little ongoing oversight. Researchers demonstrated this dynamic in late 2025 when a malicious Model Context Protocol (MCP) server introduced into an agent gateway caused a CFO’s personal assistant agent to begin exfiltrating CRM data during routine interactions using the CFO’s own credentials obtained through JWT bearer token authentication.
Rethinking Security for Agent-Based Systems
Organizations deploying AI agents need to treat agent ecosystems as a distinct security layer, not an extension of application security.
That starts with the principle of least agency: do not grant autonomous decision-making capability an agent does not need, regardless of what permissions it holds. An agent with read-only access but full autonomy to decide when and what to query is still over-provisioned. Map trust boundaries across connectors, skills, orchestration frameworks and tool integrations.
Security teams should assume that any agent interacting with enterprise systems will encounter untrusted instructions. Treat every LLM output as untrusted input to the next action. A policy enforcement point should validate intent and arguments before any tool executes, issue short-lived credentials scoped to that action, and revoke on drift.
Agent supply chains require the same scrutiny applied to open source software. Skills, plugins, and MCP servers introduce persistent execution paths that must be continuously evaluated.
Agents with access to sensitive data or operational systems should be treated as privileged entities, with continuous behavioral monitoring that captures reasoning traces and tool interactions, not just API call logs.
The rapid adoption of AI agents is transforming enterprise workflows, but it is also creating a new security boundary that many organizations have not yet recognized. Teams that focus only on model safety will miss the infrastructure layer where many of these attacks are already happening.
Rock Lambros is Director of AI Security and Governance at Zenity and a cybersecurity leader with more than 30 years of experience in technology and security. He is a core contributor to the OWASP Agentic Security Initiative, helping develop the industry’s emerging Top 10 framework for AI agent security. Lambros advises enterprise leaders on AI governance, cybersecurity strategy, and agentic AI risk management.
_____
Rock Lambros is Director of AI Security and Governance at Zenity and a cybersecurity leader with more than 30 years of experience in technology and security. He is a core contributor to the OWASP Agentic Security Initiative, helping develop the industry’s emerging Top 10 framework for AI agent security. Lambros advises enterprise leaders on AI governance, cybersecurity strategy, and agentic AI risk management.
Join our LinkedIn group Information Security Community!
