And now, cyberattacks against autonomous agents

Agentic artificial intelligence is opening up a new attack surface for organizations. Malicious prompt injection, memory poisoning, tool manipulation and the abuse of non-human identities point to a scenario in which attackers will be able to directly manipulate the agents that are authorized to operate within corporate systems.

The evolution from conversational models to autonomous agents marks a significant shift: these systems no longer just generate responses, but can plan tasks, query databases, use applications and even carry out operations on behalf of individuals or departments.

An agent connected to corporate email, a cloud platform or a technology infrastructure may have access to sensitive information and critical resources. If an attacker manages to manipulate its behavior, they can get the agent itself to carry out harmful actions using its legitimate permissions.

The problem is no longer solely about protecting the AI model. Its identity, permissions, connections and ability to act must also be protected.

New attack vectors against AI agents

1. Prompt injection: manipulating the agent’s instructions

Prompt injection is one of the fundamental risks of systems based on large language models (LLMs). It can occur directly, through malicious requests, or indirectly, by introducing hidden instructions into emails, documents, web pages or information sources that the agent consults.

This second form, known as indirect prompt injection, is particularly concerning in business environments. An agent responsible for managing emails or preparing financial reports could receive a seemingly legitimate document that leads it to gather confidential information and send it to an external address.

The user may not notice any anomaly. The agent, however, may interpret the content as a valid instruction and execute it if it has the necessary permissions.

2. Memory poisoning: compromising the AI’s memory

The most advanced agents use persistent memory to retain information between sessions and maintain the context of their tasks. Memory poisoning seeks to introduce false information or malicious instructions into that memory in order to influence future decisions.

A one-off manipulation can persist after the original interaction has ended and influence subsequent operations. It is therefore necessary to control what information can be stored, who can modify it and how it is validated before being retrieved.

3. Tool poisoning: turning tools into an attack vector

Agents use APIs, applications and external services to perform their functions. Protocols such as Model Context Protocol (MCP) make these integrations easier, but they also expand the attack surface.

Tool poisoning consists of manipulating tools or their instructions to induce unauthorized behavior. A seemingly legitimate integration may contain hidden instructions or compromised dependencies that lead the agent to access information or carry out operations beyond its intended function.

Agent security must therefore extend to the tools, providers and integrations it depends on.

4. Theft of non-human identities and privilege escalation

Agents need identities and credentials to interact with corporate systems. These identities are part of what are known as non-human identities (NHIs), along with service accounts and other automated applications.

Their proliferation raises a governance problem: an organization may rigorously control its employees’ accounts and yet not know how many agents are active, what credentials they use or what resources they can access.

Excessive permissions, persistent credentials and shared accounts can make it easier for a compromised agent to become a gateway to other systems.

5. Agent-to-agent attacks and agentic denial of service

Multi-agent architectures allow different systems to work together to complete complex tasks. However, they also create new trust relationships. A manipulated agent can pass malicious information or instructions on to others, spreading the incident through the automation architecture itself.

Autonomy can also be exploited to cause denial of service through execution loops, repeated API calls or disproportionate consumption of tokens and resources. This scenario, known as agentic denial of service, can affect both the agents and the applications and infrastructures they depend on.

How to protect AI agents in business environments

The adoption of autonomous agents requires expanding traditional cybersecurity models. It is not enough to protect user accounts or monitor devices: it is also necessary to govern the identities and capabilities of automated systems.

Priority measures include:

• Inventory agents and integrations: identify authorized systems, their owners, tools and accessible resources.
• Apply least privilege: limit each agent to the strictly necessary permissions and avoid shared or persistent credentials without justification.
• Separate decision-making from execution: require independent authorization for sensitive or irreversible operations.
• Protect memory and context: validate information sources and control changes to memory.
• Monitor activity: track tool calls, network connections, DNS queries and behavioral deviations.
• Isolate critical assets: prevent any compromised agent, device or identity from having direct and unrestricted connectivity to essential systems.
• Audit integrations: review APIs, MCP servers and third-party services.

These measures should be complemented by specific security testing, red team exercises and incident response procedures that account for the manipulation of agents and non-human identities.

The real challenge: controlling what AI can do

Agentic artificial intelligence will make it possible to automate increasingly complex processes, but its autonomy must be accompanied by a security architecture capable of limiting its consequences.

An agent can be manipulated, its credentials can be exposed and its tools can be compromised. When it has access to corporate systems, any of these scenarios can become a path to exposing an organization’s assets.

That is why AI security cannot be limited to protecting the model or validating its responses. It must extend to its entire ability to act: the identities it uses, the permissions it is granted, the tools it interacts with and the resources it can access.

At Cosmikal, we understand that protecting critical assets requires controlling how, from where and under what conditions they are accessed. Solutions such as Endurance make it possible to establish hardened Shield workspaces, isolate user devices from protected assets and govern access through control and traceability mechanisms.

This architecture provides a layer of protection that is especially relevant in IT and OT environments, where a compromised connection can put information, essential services or operational continuity at risk. It does not replace the specific controls an AI agent needs, but it helps limit the exposure of assets to potentially compromised devices and connections.

The evolution of artificial intelligence does not do away with the fundamental principles of cybersecurity. It makes them even more important.

Because the greater a system’s ability to act, the greater the control over its permissions and access must be.