In short
The main agentic AI security risks are prompt injection that turns data into commands, excessive agency from over-broad permissions, shadow agents nobody inventoried, memory and knowledge poisoning, tool and connector abuse, cascading failures across multi-agent systems, and compromise of the AI Principals that create and train agents — the failure mode with the largest blast radius.
Definition
Agentic AI risk differs from classical application risk in three ways: the action path is chosen at runtime, the actor holds credentials of its own, and the population can grow without a human decision. Each property converts a familiar weakness into something faster and wider.
OWASP's GenAI Security Project enumerates agent-specific threats including memory poisoning, tool misuse, privilege compromise, cascading hallucination and identity spoofing. MITRE ATLAS maps adversary techniques against AI systems observed in the wild. Both are useful checklists; neither replaces threat-modelling your own agents against your own data.
Prioritize by reversibility and reach. A risk that produces a wrong answer is not equivalent to one that moves money, changes entitlements or reproduces itself.
Security risks
1. Prompt injection, direct and indirect
Untrusted content instructs the agent. With tools attached, the instruction becomes an action. Mitigate with trust separation, sanitization and hard capability limits.
2. Excessive agency
Permissions exceed the task because scoping is hard. Mitigate with task-derived, short-lived credentials and per-action authorization.
3. Shadow agents
Agents created in SaaS and developer tooling never enter inventory. Mitigate with continuous identity-side discovery and mandatory ownership.
4. Memory and knowledge poisoning
Writable memory and retrieval corpora persist manipulated content across sessions. Mitigate with write policy, provenance and quarantine.
5. Tool and connector abuse
Generic tools, unsigned manifests and unreviewed MCP servers expand reach silently. Mitigate with allow-lists, signing and parameter validation.
6. Multi-agent cascades
One agent's output is another's trusted input, so errors and injections propagate. Mitigate with inter-agent authentication and confidence-aware handoffs.
7. Identity spoofing and impersonation
Agents sharing service accounts make attribution impossible. Mitigate with one credential per agent and cryptographic workload identity.
8. AI Principal compromise
Compromising a creator or trainer mass-produces implanted agents. Mitigate with tier-0 treatment of the creation layer, signing and lineage revocation.
9. Unbounded resource and cost abuse
Loops and adversarial prompts drive token spend and API volume. Mitigate with quotas, circuit breakers and anomaly alerts.
10. Insufficient traceability
Without prompt, plan and tool-call records, incidents cannot be reconstructed. Mitigate with structured tracing and retention.
Examples
Data exfiltration through a legitimate tool
An agent uses its approved outbound email tool exactly as designed, on content chosen by an attacker's injected instruction.
Entitlement escalation during routine work
A DevOps agent adds a role to complete a task, and the role is never removed because no one reviews agent-made changes.
Corpus poisoning at scale
One manipulated internal page changes the answers of every retrieval-augmented agent in the company.
Fleet-wide implant
A compromised agent template silently adds an exfiltration step to every agent created after the change.
Architecture
Attack surface inventory
Enumerate inputs, tools, memory stores, credentials, models and creation paths for each agent class.
Impact classification
Score each possible action by reversibility, data sensitivity and financial exposure.
Control mapping
Map each risk to a specific enforcement point — identity issuance, tool broker, approval gate or monitoring rule.
Detection coverage
Define what abnormal looks like per agent: unusual tools, unusual data volumes, unusual creation rates.
Response playbooks
Pre-agreed procedures for revoking an agent, a Principal lineage or a model version.
Controls
Assume injection succeeds
Design so that a successful injection still cannot perform an unacceptable action.
Cut standing privilege
Short-lived, task-scoped credentials reduce the impact of nearly every risk in this list.
Gate by reversibility
Autonomy for reversible actions, approval for irreversible ones, with the threshold documented and enforced in code.
Govern creation
Rate-limit and authorize agent creation, sign templates, and prevent unbounded self-replication.
Trace everything
Capture prompts, plans, tool calls and outcomes; without them, detection and forensics both fail.
Rehearse containment
Test revoking an agent population end to end, and measure how long it actually takes.
Comparison
Prioritizing risks by blast radius and reversibility.
| Risk | Blast radius | Reversible? | Priority |
|---|---|---|---|
| AI Principal compromise | Entire agent population | Rarely, without lineage tooling | Critical |
| Excessive agency | All systems in scope | Partially | Critical |
| Indirect prompt injection | Per session, per agent | Usually | High |
| Memory poisoning | All future sessions | With provenance and rollback | High |
| Shadow agents | Unknown by definition | After discovery | High |
| Cost abuse | Budget | Yes | Medium |
Frequently asked questions
Which risk causes most real incidents today?
Excessive agency combined with untrusted input. Most damaging outcomes involve an authorized action taken for an attacker-chosen reason.
Are multi-agent systems inherently riskier?
They add propagation paths and reduce human checkpoints, so the same weakness reaches further and faster.
How often should agent threat models be refreshed?
On every change to tools, model version, data scope or creation path — these change the agent's capability more than code changes do.
What is most commonly missed?
The creation layer. Programs are creating agents faster than governance registers them, and few teams inventory those programs at all.
Sources
How Andeavour addresses it
Risk-ranked agent inventory
AgentGuard scores each discovered agent by privilege, autonomy and data reach so remediation starts with the highest blast radius.
Creation-layer defense
Principals are monitored and their lineage recorded, addressing the risk most tooling omits entirely.
External agentic attacks
AgentHunter covers the inbound side: autonomous adversarial agents probing and abusing your applications.
See it against your own environment
A 30-minute technical session with the Andeavour team — no integration required to start.