Agentic AI Systems Under Siege: Prompt Injections, Data Poisoning, and Tool Exploits
Independent expert Andrey Biryukov examines how AI agents transition from simple chat interfaces to autonomous systems capable of reading files, sending emails, calling APIs, and managing repositories, thereby becoming targets for a new class of threats.
Unlike conventional chatbots, agents possess autonomy that introduces risks to confidentiality, integrity, and availability. Confidentiality breaches occur when agents read unauthorized files or exfiltrate data through tool outputs, workspace files, memory logs, or webhooks. Integrity violations arise when agents delete files, misroute emails, initiate fraudulent transactions, or select suboptimal vendors. Availability issues emerge when long-running tasks or browser automation create cascading failures that lock entire pipelines.
Attacks via Trusted Content
Prompt injection remains the primary vector because large language models cannot reliably distinguish user instructions from processed data. Malicious commands embedded in web pages, emails, code comments, or Jira tasks can be executed with high trust. Researchers at NeuralTrust demonstrated that specially crafted strings resembling URLs caused OpenAI Atlas to interpret instructions instead of navigating, bypassing normal validation. Zscaler ThreatLabz created a fake Python library documentation site containing hidden instructions in CSS and JSON-LD metadata that convinced coding agents to purchase a $3 license key via the attacker’s cryptocurrency wallet; four of 26 tested models complied.
Data Poisoning and Backdoor Attacks
Data poisoning targets the training or fine-tuning phase. Researchers from Carnegie Mellon and Cornell Tech altered public datasets on immigration, hiring discrimination, racial disparities, autonomous driving, and AI motivation, then uploaded tampered versions to private repositories. Agents from Anthropic, OpenAI, and Google selected the poisoned datasets in approximately half of queries. In medical imaging, insertion of just 250–300 poisoned samples into a one-million-image pneumonia dataset (0.025 %) was sufficient to implant a backdoor that caused the model to miss diagnoses in specific demographic groups.
Tool and Protocol Vulnerabilities
Three vulnerabilities in Git MCP Server allowed agents to escape repository boundaries and combine file-system, terminal, and connector access to execute malicious code. Comparative testing of Function Calling versus Model Context Protocol architectures revealed distinct risk profiles: Function Calling proved more resistant to direct prompt injection but more susceptible to tool manipulation, while MCP offered better component isolation yet enabled more cross-component attacks. Composite attacks succeeded far more often than isolated ones across 3,250 test scenarios.
Defense Recommendations
OWASP published the Agentic Top 10 listing risks such as Agent Goal Hijack, Tool Misuse, identity abuse, supply-chain compromise of MCP components, and memory poisoning. Yandex and Kaspersky Lab advocate applying STRIDE and OWASP methodologies at design time. Core principles include least-privilege isolation, strict separation of trusted and untrusted data, continuous monitoring, and validation of URLs and high-risk actions. Joint guidance issued in April 2026 by Canada, Australia, the United States, New Zealand, and the United Kingdom covers the full lifecycle from design through operation.
Related articles
Skycode: Custom VS Code Extension Optimizes AI Coding Agent for Corporate Closed-Loop LLMs
A developer has released Skycode, an open-source VS Code extension that enables AI-assisted coding inside corporate closed environments using internal models such as Qwen. The project addresses strict data residency requirements in sectors like energy, where external services like GitHub Copilot or Cursor are prohibited because code would leave the perimeter. Key engineering efforts focused on aggressive context preservation within the model's roughly 100k token limit through incremental file reading, symbol-level extraction, history compression, and visual context monitoring. Additional features include tab-based parallel task handling, local voice dictation powered by Sber's GigaAM v3, and safeguards against repetitive loops or truncated file writes. The extension approach was chosen over forking the entire VS Code codebase to simplify deployment and compliance reviews, as extensions can often be installed from the Marketplace without separate approval. Skycode is positioned as a practical alternative for organizations running their own LLMs rather than relying on cloud models.
NICT and MITRE to Host AI Breach Challenge 2026 on Email Agent Security
The National Institute of Information and Communications Technology (NICT) and MITRE are organizing the AI Breach Challenge 2026: Email Agent Security competition in December 2026. The event will take place at George Mason University in Virginia and will focus on identifying security weaknesses in AI agents designed for workplace email operations. Participants will work in teams of two to four people, combining on-site and remote access over a 24-hour period on December 16 and 17. They will attempt to induce unintended behaviors in the agents and gain access to protected information within an isolated environment. NICT plans to analyze the results to evaluate the effectiveness and limitations of current AI agent security measures for future research and development.
AI Agents Becoming Core InfoSec Skill Like Microsoft Office Proficiency
Working with AI in information security is shifting from a specialized skill to a baseline expectation similar to using Microsoft Office tools. The key difference lies in the cost of errors: poor Word usage wastes time, while mishandling AI agents burns subscription limits and corporate funds. The article details practical workshops from the Engineering October series covering AI agents from beginner tools to securing the agents themselves. Core concepts include distinguishing models from agents, managing context windows to prevent forgotten instructions, and using skills, MCP connectors, and sub-agents for efficiency. Real-world examples show agents handling CVE analysis, alert triage, and threat report reviews while highlighting risks like hallucinations and data exposure. Guidance covers safe deployment in isolated environments and the irreplaceable role of human expertise in strategy and verification.
Research Exposes Limitations in AI Skill Scanners for Agent Vulnerability Detection
An independent researcher evaluated three local vulnerability scanners for AI agent skill packages without using LLMs or external APIs. The test used 12 synthetic packages containing both benign and malicious instructions, including attempts to bypass consent via sub-agents and hidden instructions in nested files. Cisco Skill Scanner, NVIDIA SkillSpector, and AgentVerus were run in isolated containers. All three tools missed a critical delegation bypass in package 10, while correctly flagging an educational attack citation in package 5 as High severity. NVIDIA SkillSpector performed best on nested file detection, and the findings directly shaped the integration of a lightweight static analyzer plus optional NVIDIA scans into the CEO AI project. The study also highlighted the need to preserve detailed findings rather than relying solely on final safety scores.