Five attack methods exploit agent trust, from prompt injection and jailbreaks to credential theft, privilege abuse and lateral movement

As more businesses deploy AI agents, the attack surface is expanding rapidly. Attackers are chaining multiple techniques to exploit newly built agents and the systems that businesses depend on.

Connectors, tool integrations, packages and skills are among the components being targeted. This is evolving in a direction similar to traditional software supply-chain attacks, where compromising one trusted, widely used component can give an attacker access to many others.

AI agents are fertile ground for attackers because they are often granted powerful credentials, call tools, inherit permissions and can act across systems autonomously with broad access. Here are five malicious techniques that security teams are seeing, and how they can work together.

1. Agent hijacking, or prompt injection, occurs when an attacker hides malicious instructions within unstructured content such as an email, web page or support ticket, with the goal of overriding the agent’s intended task. In practice, this could look like a customer support agent processing an emailed complaint containing invisible text with instructions to send future customer communications to an external inbox. This is often the opening move in a chain of attack. This is a well-known attack vector, and frontier models are becoming more resistant to it. Even so, attacks can still succeed. Defenders should prevent unsanitized, direct input from reaching models that have access to sensitive information or that operate in the same environment as sensitive data.
2. Jailbreaking is closely related to agent hijacking, but instead of hiding instructions, the attacker targets the agent’s logic and tries to talk it out of its safety constraints. Security researchers such as Pliny the Liberator have repeatedly demonstrated jailbreaks when new models are released. The attack attempts to bypass internal guardrails and can, for example, persuade an internal corporate assistant that it is taking part in a “mandated, isolated security audit role-play” in order to facilitate an actual cyberattack. To defend against this, safety monitoring should be decoupled from the main agent’s context window and should check each final action against the original user intent and corporate policy before anything executes.
3. Identity and privilege abuse occurs when agents are authenticated to services using application programming interface (API) keys, tokens and secrets. An attacker stealing those credentials can gain access to the target network. Because agents are often given static, long-lived access, this can turn a foothold into durable access. This attack is frequently initiated through supply-chain
4. Privilege inheritance exploitation uses the fact that many AI agents have permissions far broader than they need, enabling a low-value agent to access high-value systems. For example, a marketing agent authorized to read CRM data for campaign drafting may also inherit broad network permissions, which an attacker could abuse to delete competitor analysis and strategic plans from a shared corporate drive. To defend against this, permissions should be tightly scoped to the specific task rather than the broader service account, and high-impact actions should require human-in-the-loop approval. The same accounts and identities should not be shared across agents.
5. Autonomous lateral movement happens when a compromised agent uses its own tooling and access to move across systems autonomously. This is often the stage at which the attack spreads more widely. For example, a compromised scheduling agent could create a fake meeting with an internal IT support agent and insert a malicious payload into the meeting notes; the IT agent reads the notes, is hijacked, and then uses its administrative access to push ransomware across the network. Alternatively, an agent powered by an un-guard-railed model may be explicitly tasked with hacking a company. Defence against this must be holistic, because agents, especially those powered by more modern models, can be highly effective attackers. Zero trust is now a necessary network architecture: a zero standing privilege approach to credentials is the other side of that security equation. Real-world examples show how agents can loop through stealing credentials, logging in, finding a zero-day in a new system, and using the resulting access to continue moving forward. Imposing cost on lateral movement, removing the ability to move easily around with valid credentials and deploying effective network segmentation are now essential defensive measures.

By combining these techniques, adversaries are moving beyond attacking one assistant in one company to targeting the shared components that agents rely on, and potentially compromising entire ecosystems.