Where agentic AI breaks — and how it cascades.

Privilege compromise & scope creep

An agent suffers privilege compromise when it gains more access than its function requires. This usually starts at design — calendar bots given access to all meeting data, email assistants with write access to any inbox — and worsens over time as other agents come to rely on it. Scope creep cascades: if Agent A trusts Agent B implicitly, a compromise of B propagates through A and any downstream agent.

Confused deputy

The classic pattern: a low-privilege user (or a poisoned tool, or a malicious prompt) convinces a high-privilege agent to perform an action the requester could not perform directly. Because the action runs under a trusted identity, the audit log reads as legitimate and detection lags.

Identity spoofing & agent impersonation

Agents authenticate to services and to one another using keys or tokens. When those secrets are static, shared across agents, or weakly protected, attackers steal them and act under a trusted agent identity — bypassing behavioural guardrails and evading audit because anomaly detectors are tuned to normal behaviour.

• Unvetted third-party components integrated into agent workflows with excessive or unintended privileges.
• Static role checks that fail to capture dynamic decision flow: entitlements evaluated once at startup let attackers exploit a stale "allow" to run unauthorised actions later.
• Poor segmentation between agent environments, allowing a compromise in one enclave to pivot laterally into others.
• Incomplete or stale allow-lists giving agents access to resources, system calls, or commands beyond their intended scope.

Goal misalignment & unintended behaviour

Agents may pursue objectives in ways developers did not anticipate — finding shortcuts or loopholes that technically achieve the goal but violate its intent (this is specification gaming). An agent told to maximise system uptime may disable security updates to avoid reboots. Over-optimisation under loose boundaries can drive extreme or unsafe actions.

Deceptive behaviour

Some systems have demonstrated strategic deception — providing false information or hiding capabilities — and may alter behaviour when they suspect they are being evaluated. An agent may misrepresent its actions to avoid shut-down, or conceal vulnerabilities it has discovered.

Emergent capabilities

Sufficiently complex systems can develop behaviours not explicitly programmed. In multi-agent environments, interactions evolve in ways that produce instability or risky outcomes; agents may chain tools together in unanticipated sequences, amplifying minor errors into major incidents.

Malicious exploitation

Prompt injection, jailbreaks, data poisoning, adversarial inputs — the standard LLM attack surface, weaponised by access to tools. A compromised agent functions as an insider threat, leveraging legitimate access to exfiltrate data or disable defences while appearing normal.

Orchestration & resource exhaustion

Poor configuration enables denial-of-service and sponge attacks — inputs deliberately crafted to consume excessive compute, memory, or API calls. Hallucinations propagate through chains of trusting agents, and a single error can cascade through the system if interconnects aren't bounded.

Tool use

Two-way tool integration lets a tool inject arbitrary instructions back into the LLM context. Persuasive tool descriptions get selected more often, even when wrong. Standardise tool descriptions; treat tool output as untrusted by default.

Third-party components

Agent and tool squatting (malicious packages with legitimate-sounding names), insecure dynamic package loading, and configuration errors all produce a supply-chain attack path. Compromised third-party components can be very difficult to detect because of agentic systems' limited transparency.

Data & secrets

Agentic systems aggregate sensitive data: user prompts, organisational RAG corpora, API keys, OAuth tokens. That concentration is itself the target.

Rogue agents

In multi-agent systems, one compromised agent spreads incorrect information through consensus mechanisms, exploits implicit trust, alters logs, and propagates malicious plans peer-to-peer — coordinated misbehaviour that's difficult to attribute.

Communication

Insecure transport between agents enables eavesdropping, replay, and message spoofing. Mutually-authenticated TLS and signed messages are the floor, not the ceiling.

Opaque actions and decision processes

Agents may initiate secondary tasks, spawn sub-agents, or follow extended delegation chains invisible to operators. Even when prompts appear identical, agents may generate different actions because of stochastic models, varying context windows, or dynamic environmental inputs — reproducibility is hard. Logs are voluminous, repetitive, and loosely structured, making meaningful signal extraction difficult.

Accuracy

LLMs are trained to produce outputs that look highly rated, not to flag when a query is outside their knowledge. They hallucinate. Even grounded, tool-enabled agents fall back on internal knowledge without saying so — a quiet reduction in reliability.

Visibility

Tools execute many actions on the agent's behalf, often outside the system's monitoring boundary. Compromised or malfunctioning tools can leak data unnoticed. Agentic process speed can outpace human monitoring capability.