AI agent security risks: when an attacker inherits your agent’s access

In late 2025, Anthropic disclosed GTG-1002, an espionage campaign in which a threat actor manipulated Claude Code to execute 80-90% of tactical operations independently. The campaign involved an attacker-directed AI system, not a victim’s enterprise agent. But it demonstrated the capability that changes the risk calculation: an agent can chain reconnaissance, exploitation, credential use, lateral movement, and data collection at a scale no human operator could match step by step.

Now give an enterprise agent legitimate credentials, permissions, APIs, tools, and access to sensitive data. If an attacker redirects that agent, they may not need to steal an administrator account. They inherit what the agent is already trusted to do. Authentication establishes trust. AI runtime behavior determines whether that trust is being abused.

At a glance

• AI agents operate with real credentials and permissions. A manipulated agent can use that access without triggering a conventional authentication failure.
• Attackers can subvert agent trust through prompt injection, poisoned context, compromised tools and dependencies, or stolen application credentials.
• IAM, EDR, SIEM, cloud telemetry, and model guardrails remain essential, but valid credentials and authorized API calls do not by themselves prove that an agent is acting within its intended purpose.
• Cyber deception creates controlled opportunities for misuse to produce evidence when an agent accesses a honeytoken, follows a HoneyPath, or interacts with a deceptive asset.
• Deception Guardrails extend 360 Deception into agentic AI runtimes as a capability within the ShadowPlex platform.

Enterprise AI agents combine identity, automation, and decision-making within a single workload. That combination creates a security problem that is broader than model safety alone.

Four characteristics that expand AI risk

• Privileged identity. Agents commonly use service accounts, OAuth tokens, API keys, or machine identities. Their permissions may span several systems, while action-level governance remains uneven.
• Authority to act. Agents can execute scripts, retrieve information, update records, send messages, provision resources, and trigger additional workflows rather than simply observe or recommend.
• Dependence on external context and tools. Agentic workflows consume prompts, RAG data, documents, APIs, plugins, and instructions from other agents. A trusted source that becomes poisoned can redirect downstream behavior without changing the agent’s identity.
• High-volume runtime activity. An agent may take many variable actions across multiple tools to complete one objective. Each action may appear authorized in isolation even when the resulting sequence is not.

The security question is therefore not limited to whether the model is safe or the identity is valid. Defenders also need to know where trust is established, how it can be subverted, and where misuse becomes observable.

Table 1: The AI agent trust chain

Attackers do not need to exploit the model itself. They can redirect the information, identity, tools, or supporting systems that guide an agent’s behavior.

• Prompt injection places malicious instructions in documents, emails, websites, or other content the agent processes. The attacker exploits how the agent interprets instructions rather than exploiting software in the conventional sense.
• Context poisoning corrupts retrieval systems, vector databases, memory, or trusted knowledge sources so the agent makes decisions from manipulated information.
• Tool and supply-chain compromise introduces malicious behavior through plugins, third-party tools, dependencies, MCP servers, or external integrations that extend the agent’s authority.
• Credential theft and identity abuse allow an attacker to impersonate the agent or use its application tokens, API keys, service accounts, and machine identities. In this case, the attacker may abuse agent trust without manipulating the agent itself.

These vectors overlap, but they are not interchangeable. AI-specific manipulation maps most directly to MITRE ATLAS, while the resulting enterprise behaviors also map to MITRE ATT&CK.

Table 2: Mapping AI-agent trust attacks to MITRE

Although the entry points differ, the operational outcome is similar: the attacker redirects trusted automation or assumes its identity instead of defeating authentication outright.

Existing controls remain essential. IAM determines which identities and permissions are valid. EDR provides endpoint telemetry and protection. SIEM and cloud monitoring correlate activity across systems. Model and policy guardrails constrain inputs, outputs, and tool use.

A manipulated AI agent can still operate inside those boundaries. It may use approved credentials, call authorized APIs, and perform actions it has permission to execute. The issue is not visibility alone. It is determining whether a series of individually valid actions serves the agent’s approved purpose or an attacker’s objective.

Behavioral analytics may identify unusual patterns, but agent activity can vary by task, context, and tool. One anomalous API call may not prove misuse, while a multistep sequence may become clear only after correlation.

Cyber deception changes the detection question. Instead of asking only whether activity appears unusual, defenders can ask a sharper question: why did an identity, agent, or process touch an asset no approved workflow should require?

When an AI agent retrieves a honeytoken, invokes a deceptive tool, or follows a HoneyPath toward a decoy API, that interaction can provide high-confidence evidence that its behavior has moved outside the intended path.

Table 3: Where existing controls contribute and where the runtime question remains

Consider a customer-support AI agent that processes uploaded documents before retrieving information from internal systems.

An attacker embeds hidden instructions inside an uploaded PDF. When the agent processes the document, those instructions direct it to retrieve sensitive customer records from an internal API.

The request may succeed because the agent is using legitimate credentials with authorized permissions. Authentication has already occurred. The remaining question is whether the AI runtime action aligns with the agent’s intended purpose.

Detecting misuse after authentication

Other controls may surface an anomalous call, a policy violation, or suspicious data movement. Deception technology adds a controlled opportunity for the behavior to produce stronger evidence. That evidence appears when the manipulated agent interacts with a decoy API, retrieves a honeytoken embedded in accessible data, invokes a honey skill, or follows a HoneyPath it should never need.

The attacker’s objective has redirected the behavior while the identity remains valid. Compromised credentials can be rotated, but compromised decision-making requires visibility into how a trusted identity behaves after authentication.

This AI runtime visibility becomes particularly valuable during lateral movement, where valid credentials can mask malicious activity. Acalvio reports that roughly 60% of intrusions involve lateral movement before detection, making post-authentication behavior a consequential part of the detection strategy.

This is where 360 Deception fits. The framework makes deceptive assets appear production-real, makes real assets harder for an attacker to classify, and introduces signals automated reconnaissance cannot safely ignore. Together, those vectors create a high-uncertainty environment that degrades the stable ground truth an attacker or manipulated agent uses to choose its next action.

Within the ShadowPlex platform, Deception Guardrails extend 360 Deception into agentic AI runtimes. The capability places deceptive identities, credentials, honey skills, decoy MCP servers, RAG systems, APIs, and other controlled assets across agent workflows and the infrastructure around them. It complements model and policy guardrails by detecting when a trusted agent, or an attacker using its identity, moves outside an intended path.

This is the role of cyber deception in preemptive cybersecurity. It does not need to predict every prompt, instruction, or attack chain. It instruments likely misuse paths so unauthorized behavior has more opportunities to reveal itself at the speed agents act, before access becomes impact.

AI runtime deception in practice

• Honeytokens placed in agent-readable credential stores, files, and configuration surfaces expose unauthorized credential retrieval.
• Honey skills and deceptive tools reveal when an agent invokes a capability that no approved workflow should require.
• Decoy MCP servers, RAG systems, and AI agents surface attempts to enumerate, manipulate, or pivot through the surrounding AI infrastructure.
• Decoy APIs, documents, and data objects identify unexpected application access, unauthorized collection, or attempted exfiltration.
• HoneyPaths expose lateral movement when an agent or attacker traverses infrastructure outside an approved path.

In ShadowPlex, these deception assets can be managed across dynamic cloud and enterprise environments. As agents, identities, tools, and workloads change, coverage must change with them. Automation helps with scale, but operational discipline determines whether the signals remain credible.

Cyber deception does not replace prompt filtering, model safety, least privilege, tool allowlisting, IAM, EDR, cloud controls, or incident response. Its effectiveness depends on placement fidelity, clear ownership, workflow integration, change control, and continued coverage maintenance.

The underlying detection mechanism has demonstrated measurable results against automated, credential-driven intrusion techniques. During the FY25 Navy ANTX exercise, Acalvio generated 100% true-positive alerts and denied approximately 80% of attacker objectives under controlled exercise conditions. The exercise was not a production AI-agent deployment, but it provides evidence for the underlying proposition: deceptive assets can expose and disrupt automated activity that relies on trusted credentials.