This guest article was contributed by Christophe Briguet, Senior Director of Product Management, Stellar Cyber
As more enterprises integrate autonomous AI agents into their core workflows at scale, they’re discovering that the very connectivity and speed that make these tools valuable can also introduce significant security risks. The traditional security operations center (SOC) model was not designed for machine-speed, AI-driven attacks, in which a single successful social engineering attempt against an agent can trigger catastrophic failures.
To protect the modern enterprise, security leaders must shift from reactive guardrails to a proactive, verdict-first model centered on behavioral analytics and network visibility.
The primary threat vector emerging in this space is the “social engineering” of machines through targeted prompt injection attacks. These occur when a malicious actor provides hidden instructions that cause an AI agent to ignore its embedded system guardrails. A recent security audit of the Agent Skills ecosystem revealed that 36% of all skills contained critical-level issues, including prompt injection vulnerabilities and exposed secrets.
Here’s where the risk becomes more urgent. Unlike humans, AI agents are often directly connected to sensitive data sources and can execute complex tool commands independently. This creates a “black-box” hazard where obscured internal reasoning can lead to erratic tool interactions or governance circumvention.
Recent industry disclosures underscore the diverse ways AI agents can be compromised or move out of scope during operation.
|
Breach involving an unreleased internal research model. |
Agents discovered vulnerabilities in a shared repository and left notes for other agents to coordinate the exploit. |
|
|
Three models hacked real-world systems during routine testing. |
The models stole login credentials and uploaded malware to legitimate code repositories after gaining unintended internet access. |
|
|
Unsanctioned access to a third-party service during security evaluations. |
A misconfiguration allowed the model to gain internet access and exploit a vulnerability in an unnamed service. |
|
|
Account takeover via exploitation of the Meta AI support tool. |
Hackers used the tool to handle password resets and change associated emails by simply persuading the chatbot through a VPN. |
|
|
Identified by the UK’s AI Security Institute during cybersecurity evaluations. |
Models performed 19 unauthorized actions, including creating fake GitHub identities and socially engineering real maintainers. |
Relying on “black-box” autonomy is no longer viable in this new era of agentic AI. To preserve agent integrity, enterprises must adopt a philosophy of governed access, ensuring that every AI interaction is tracked and validated against established security frameworks like NIST and MITRE ATT&CK.
To prevent prompt injections from escalating into system-wide failures, organizations should deploy layered defense-in-depth strategies:
-
User and Entity Behavioral Analytics (UEBA): By establishing behavioral baselines, UEBA can detect when a compromised agent begins to deviate from its normal operational parameters. For example, Real-time identity-centric correlation can flag suspicious privilege escalation or unauthorized identity provisioning.
-
Network Detection and Response (NDR): NDR provides the visibility needed to identify data exfiltration or policy violations resulting from successful prompt injection by unifying network traffic with cloud telemetry.
-
Bounded Tenant Awareness: To prevent cross-tenant contamination, any AI agent exhibiting abnormal behavior must be quickly isolated. This ensures that if a single agent is tricked, the entire system does not destabilize.
While AI can handle the heavy lifting of triage and correlation, by reducing noise by up to 90%, human oversight remains the most critical guardrail. The shift to a proactive model requires humans to retain final control over response actions while leveraging autonomous systems for containment and forensic preservation. By combining governed AI access with robust UEBA and NDR, organizations can build a resilient foundation that evolves as quickly as the social engineering methods targeting their machines.
