When adoption runs ahead of visibility and policy, attackers do not need novel exploits. They just need one weak link in the agent’s inputs, tools, or memory.
In production, agent compromises usually follow a small number of repeatable paths because agents blur the line between “content” and “instructions,” then turn decisions into tool calls. A good example is the Reprompt attack disclosed by Varonis Threat Labs in January 2026, where a crafted link could trigger Copilot into leaking sensitive data through an indirect prompt-injection style flow.
Microsoft patched the issue, but it’s a clean illustration of the core risk where once an assistant can interpret external content and act on it, prompt injection stops being a prompt problem and becomes an access problem.
From there, the threat model usually collapses into four buckets you can actually design for: prompt injection, tool misuse/privilege escalation, memory poisoning, and supply chain risk.
Prompt Injection (Direct + Indirect)
Agents process “instructions” and “data” as one stream of text, which creates a built-in weakness: an attacker can slip control signals into the same channel the agent trusts for context.
That semantic gap is the reason prompt injection is more than a content problem. Once an agent is tool-connected, injected instructions can push it past internal guardrails and into unauthorized state changes.
The risk includes direct injection (overt chat commands that override intent) and indirect injection (poisoned external content the agent retrieves and treats as legitimate context). The text obfuscation (for example, invisible characters) bypass detection and get malicious directives executed anyway.
What makes this dangerous in agent systems is that a successful injection does not have to “hack” anything. It just has to win the next-step decision.
Without rigorous validation, the agent cannot reliably distinguish malicious instructions from legitimate requests, so you end up with policy violations, logic subversion, and state changes you did not intend.
Tool Misuse and Privilege Escalation
This is the classic pivot: once an attacker gets the agent to follow the wrong instruction, they use the agent’s legitimate permissions against you. That’s why the draft calls it “semantic privilege escalation.”
You are not bypassing auth; you are tricking the system into making authorized calls for the wrong reason. Research indicates that attacks utilizing natural language for exploits have been shown to achieve over 90% reliability.
It gets worse because the activity looks normal to traditional controls. This logic gap confirms that existing security frameworks inadequately address new challenges introduced by autonomous decision chains. It also lists concrete examples of what this looks like in practice and it includes pulling sensitive tokens through cloud metadata endpoints, exfiltrating credentials from mounted volumes, and triggering “zero-click” style tool activations via incoming email streams.
The practical takeaway from this is that if the agent has write access to production systems or can trigger privileged endpoints, you are implicitly trusting every untrusted document, email, or retrieved snippet it processes, unless tool use is tightly constrained.
Memory Poisoning (Persistent Backdoors)
Long-term memory turns an agent’s context into a target.
Attackers can inject false or malicious data into vector stores the system treats as truth, similar to “search poisoning” where the retrieval flow itself becomes compromised.
Unlike transient prompt injection, the draft emphasizes persistence. Malicious directives can get embedded into stored context and function like low-level instructions that survive session resets. That creates a durable backdoor: poisoned data can drift across sessions, override direct user prompts, and resurface later through delayed triggers that quietly exfiltrate sensitive data.
If you do not govern what can enter memory, you are allowing permanent contamination of the agent’s decision context.
The threat is considered the baseline defenses where you validate the origin of memory inputs before ingestion, filter untrusted content, keep immutable audit trails so changes are traceable, and use typed memory schemas that separate low-trust notes from high-trust facts.
It also calls for runtime retrieval scoring filters so agents do not act on corrupted records during critical loops.
Supply Chain Risk in Agent Toolchains
Agents inherit a sprawling dependency graph including third-party models, datasets, orchestration tools, plugins, and build pipelines. That makes end-to-end verification hard, and it shifts attacker incentives upstream.
Instead of hitting your infrastructure directly, they compromise a dependency and let the risk propagate through your agent stack.
The exposure points are poisoned training data that implants backdoors, unsafe serialization formats that can execute malicious payloads at load time, retrieval layers vulnerable to cache poisoning and decision steering, and CI/CD paths that can leak secrets.
It’s a layer-by-layer map (pre-trained models, RAG vectors, no-code agents, CI/CD) tied to operational impacts like remote code execution, logic bypasses, and secret exfiltration.
| Component Layer | Primary Vulnerability | Operational Impact |
|---|
| Pre-trained Models | Serialized Artifacts | Remote Code Execution |
| RAG Vectors | Cache Poisoning | Decision Steering |
| No-Code Agents | Logic Bypasses | Unmonitored Flows |
| CI/CD Pipelines | Prompt Injection | Secret Exfiltration |
On mitigation, the backbone is integrity and provenance. Cryptographic signing of artifacts, SBOMs to expose hidden dependencies, behavioral monitoring to catch anomalies post-deploy, and explicit data mapping across the chain so sensitive data does not leak through vendor or tooling layers.
Forensics
