Enterprises grant agents permissions they would never give a new hire. When compromised, the agent keeps working, produces normal outputs, and executes an adversary's goals using your own access tokens. Here is the formal threat model your security team does not yet have.
Your CISO has a model for insider threats. Your SOC has runbooks for ransomware. Your incident response team has a playbook for credential theft. None of them have a model for what happens when an AI agent, already inside your network with granted permissions, is turned against you.
This is not a theoretical gap. Enterprises are deploying agents that read executive email, modify code before it ships, approve vendor invoices, and update personnel records. When one of those agents is compromised, the attacker does not need to breach your perimeter. They already have a seat at the table with the keys you handed them.
What makes this different from every prior category of enterprise threat is a property unique to AI agents: a compromised agent does not go offline, does not make social slips that alert colleagues, and does not hesitate before taking action. It continues to produce plausible, high-quality outputs while executing an adversary's goals at machine speed, around the clock, for as long as it takes your team to notice something is wrong. The Routing Policy Gap documented in the AI budget accountability post is one symptom of how poorly enterprises currently instrument their agents. The threat described here is an order of magnitude more severe.
Traditional cybersecurity threat modeling is anchored in three assumptions that do not hold for AI agents: that the attacker is outside the perimeter, that compromise produces anomalous system behavior (unusual network traffic, file access patterns, authentication events), and that the time window for damage is bounded by how quickly a human attacker can operate.
AI agents invalidate all three. The agent is already inside, operating with granted credentials. Its behavior when compromised is semantically coherent: the right API calls, the right outputs, the right tone in communications. And its action velocity is not human-speed, it is model inference speed, meaning an adversary who has redirected an agent has the equivalent of a tireless, credentialed employee who never sleeps, never hesitates, and never tips off a colleague at the water cooler.
The very properties that make AI agents valuable, their consistency, their speed, their ability to operate without fatigue, are the same properties that make a compromised agent more dangerous than a compromised human employee with identical access.
The Agent Compromise Surface (ACS) of an enterprise AI agent is the set of vectors through which an adversary can redirect the agent's behavior to serve adversarial goals without triggering the agent's safety constraints or the organization's monitoring systems. The ACS is characterized by four distinct vector types, each with independent detectability, blast scope, and mitigation profile. This term originates with this work.
NIST AI RMF, ISO 42001, and OWASP's LLM Top 10 each address parts of this surface. None of them unify the four vectors into a single threat model that an enterprise security team can operationalize. The ACS framework does.
Prompt injection remains the most documented attack vector against LLM-based agents [2]. The enterprise variant is more sophisticated than the academic examples: an attacker embeds adversarial instructions inside documents, emails, or database entries the agent is authorized to read. When the agent processes that content as part of its normal workflow, the embedded instructions redirect its behavior. The agent has not been hacked. It is following instructions, exactly as designed, from a source it was told to trust.
Indirect prompt injection, where the adversarial payload reaches the agent through data it retrieves rather than through direct user input, is particularly difficult to detect because the agent's audit log shows only the data source accessed, not the semantic content of the payload [3].
Enterprise agents call external tools: APIs, MCP servers, databases, code execution environments. If any tool in that chain is compromised, every agent that calls it becomes a vector for adversarial outputs. The attack surface here is the entire tool dependency graph, which most organizations have never mapped. A poisoned MCP tool can return subtly incorrect data that accumulates over time, or can inject instructions that redirect the agent's subsequent actions within the same session.
Agents with persistent memory, the kind needed for long-running enterprise workflows, maintain a context that spans sessions. An adversary who can write to that memory, through a compromised document that gets ingested, through a manipulated retrieval result, or through a prior successful input injection, can corrupt the agent's long-term behavioral context. The agent then gives subtly wrong advice, makes subtly wrong decisions, and surfaces subtly wrong information for weeks before anyone notices. The formal treatment of enterprise memory architecture in the Memory Governance paper identifies this as a governance gap without yet naming it as an attack vector.
Multi-agent systems where one agent orchestrates others create a trust inheritance problem. If the orchestrating agent is compromised, every sub-agent operating under its instructions is implicitly compromised as well. The sub-agents have no independent basis for verifying the legitimacy of orchestration instructions they receive. This is the highest-blast-radius vector in the ACS taxonomy because a single compromise propagates laterally across the entire agent network.
The Agent Dwell Window (ADW) for a compromised enterprise AI agent is the interval [t₀, t₁] where t₀ is the time of compromise and t₁ is the time of confirmed detection and containment. The ADW is bounded from below by zero (immediate detection) and is unbounded from above. The expected ADW for any enterprise deployment is structurally longer than the equivalent human-actor dwell time, because the behavioral signals that typically trigger human-actor detection (anomalous hours, unusual access patterns, social indicators) are absent in agent operations. This term originates with this work.
IBM Security's 2024 Cost of a Data Breach Report documents an average enterprise breach dwell time of 194 days for breaches involving human actors [1]. For agents, the structural conditions that produce early detection in human-actor scenarios do not apply.
A human threat actor accessing systems at 3am triggers behavioral anomaly alerts. A compromised agent that runs at 3am looks identical to its normal operation, because agents routinely run scheduled tasks at all hours. A human exfiltrating data generates unusual access volume. A compromised agent that reads and sends data looks identical to an agent completing its assigned task. A human attacker eventually makes a social slip. An agent never does.
Memory injection attacks (Vector 3) have the longest expected ADW of any ACS vector, because the corruption accumulates gradually. An agent whose memory has been poisoned does not immediately produce wrong outputs. It produces subtly biased outputs that drift toward adversarial goals over weeks. By the time any single output is clearly wrong, the ADW has extended long enough for substantial damage.
Organizations that have deployed agents without baseline behavioral profiles have no reference point for detecting ADW onset. They cannot measure a dwell window they have no instrument to observe. Establishing behavioral baselines before deployment, not after compromise, is the prerequisite for any ADW reduction program.
The Semantic Blast Radius (SBR) of an enterprise AI agent at time t is the set of downstream effects the agent can produce using its current permission set under full adversarial control, measured across two axes: reversibility (what fraction of actions taken during the ADW can be undone post-detection) and blast scope (how many organizational systems and processes are affected). SBR is not a fixed property of an agent; it grows with the ADW and shrinks only through permission reduction or reversibility gate insertion. This term, building on Action Blast Radius introduced in Shadow AI Is Already Running Your Company, originates with this work.
The practical implication of SBR is that the total damage from an agent compromise is not determined at the moment of compromise. It is determined by the product of the agent's permission scope, the ADW, and the reversibility profile of the actions taken during that window. An agent with read-only access and a 30-day ADW causes less damage than an agent with write access to financial systems and a 7-day ADW, even if the second agent is detected faster.
These are not generic risks. They are the specific patterns documented in enterprise agent deployments that result in program suspension, regulatory inquiry, or reputational damage severe enough to set organizational AI adoption back by years.
An agent with read access to sensitive data (contracts, employee records, customer PII, source code) is compromised via input manipulation. The attacker does not instruct it to bulk-copy files (which would trigger DLP controls). Instead, the agent is redirected to include small, relevant excerpts from sensitive documents in its normal outputs: summaries, reports, responses. Each output looks legitimate. Over a 90-day ADW, the cumulative exfiltration is substantial. The audit log shows only normal agent activity. Detection requires semantic analysis of output content, a control almost no organization has deployed.
Early warning signal: Output verbosity increases without corresponding task complexity increase. Agents begin including unrequested detail from documents outside the immediate task scope.
An agent with write access to a knowledge base, CRM, or decision-support system is compromised via memory injection. Over 60-90 days, it introduces subtle errors: mispriced contracts, incorrect regulatory interpretations, flawed financial projections. Each individual error is plausibly a model mistake. Only pattern analysis across outputs over time reveals the systematic nature of the corruption. By the time the pattern is recognized, the corrupted information has been acted upon, distributed, or committed to external parties.
Early warning signal: Increase in human override rate on agent recommendations. Subject matter experts begin noting that the agent's outputs "feel off" without being able to articulate specific errors.
An orchestrating agent is compromised via orchestration hijack (Vector 4). It begins routing tasks to sub-agents with modified instructions. The sub-agents, operating under legitimate orchestration commands, execute adversarial tasks without any individual sub-agent behaving anomalously. The multi-agent governance topology framework in this paper addresses trust inheritance in multi-agent systems; the ACS Cascading Hijack failure mode is the adversarial expression of exactly that governance gap.
Early warning signal: Sub-agent task completion rates diverge from historical baselines. Orchestrating agent begins requesting elevated permissions for sub-agent delegations.
An agent with access to identity systems (HR platforms, SSO configurations, provisioning tools) is compromised and used to create or elevate credentials for a persistent human threat actor. The agent's actions look like routine provisioning. The threat actor now has human-level access independent of the agent. Even after the agent compromise is detected and remediated, the threat actor's persistence goes undetected. This is the highest-severity failure mode because it converts an agent compromise into a full, persistent human-actor breach.
Early warning signal: Provisioning activity outside of expected business hours or personnel events (onboarding cycles, role changes). Agents accessing identity systems for tasks without corresponding HR system triggers.
Before a security team can build defenses, they need a structured way to assess which agents are most exposed. The following framework maps the two primary exposure dimensions to a response posture.
| Permission Scope | High Reversibility Actions | Low Reversibility Actions | Recommended Posture |
|---|---|---|---|
| Read-only (summarize, retrieve, analyze) | All outputs are advisory | Exfiltration risk only; no write damage | Behavioral baseline + output semantic monitoring |
| Limited write (draft, suggest, flag) | Human approval gate before commit | Drafts that auto-send or auto-post | Reversibility gate on all auto-commit paths; human-in-loop for external communications |
| Broad write (commit, approve, provision) | Version-controlled outputs with rollback | Financial approvals, identity changes, regulatory filings | Hard permission ceiling + dual-agent confirmation for irreversible actions; ADW monitoring required |
| Orchestration authority (directs other agents) | Sub-agent task logs observable | Sub-agent actions that cascade externally | Inter-agent trust attestation required; sub-agents must independently verify orchestration instructions above a defined severity threshold |
An AI agent deployed to monitor and triage security alerts is compromised via tool chain poisoning through a third-party threat intelligence feed the agent calls. The adversary begins filtering what alerts the agent surfaces to analysts, suppressing indicators of their own persistent access while keeping noise high. The agent's behavior is indistinguishable from a high false-positive-rate model: plausible, documented, not flagged. The CISO's team does not know to look for compression in alert diversity; they only monitor alert volume. The correct control: alert diversity metrics as a behavioral baseline, and independent verification of the threat intelligence feed's integrity.
A clinical decision-support agent with read access to patient records and write access to care coordination notes is compromised via memory injection. Over 45 days, it introduces systematic bias in care pathway recommendations for a specific patient population. Each individual note is within normal variance. The pattern only becomes visible through population-level outcome analysis. By the time the CRO's team identifies the drift, the corrupted recommendations have influenced care decisions for hundreds of patients. The correct control: population-level output distribution monitoring with automated drift alerts, running independently of the agent's own audit interface.
A contract review agent with authority to flag and annotate contracts before legal sign-off is compromised via prompt injection embedded in a counterparty's contract draft. The agent begins systematically missing specific clause types in contracts from that counterparty, clearing contracts that would otherwise be flagged for legal review. Six contracts execute over a 90-day period. The General Counsel's team has no reason to audit contracts the agent cleared; human review is reserved for flagged items only. The correct control: adversarial red-teaming of the contract review agent against known injection payloads before deployment, and periodic blind testing where legal staff independently review a sample of agent-cleared contracts.
A read-access agent over a 90-day ADW can exfiltrate the semantic equivalent of every document it was authorized to read. For agents with access to M&A materials, customer contracts, or source code, this constitutes a material breach under most regulatory frameworks.
Under the EU AI Act, organizations deploying high-risk AI systems (including those in healthcare, legal, and financial services) bear responsibility for agent security. A documented ADW in a regulated context creates direct regulatory exposure independent of whether external harm occurred.
The Credential Pivot failure mode converts an agent compromise into a persistent human-actor breach. The average cost of a human-actor breach, already cited at structurally higher levels than automated intrusions, grows with ADW duration [1]. A single Credential Pivot event can exceed the total cost of an enterprise agent security program.
In the current regulatory and board attention environment, a publicized agent compromise is likely to result in program suspension pending review. The cost of suspension is not only operational; it is the competitive delay of months to years in AI-driven capability development. That cost is not recoverable.
| Capability | Build | Buy | Configure |
|---|---|---|---|
| Behavioral baselines | Build if agents are custom; baseline profiles are specific to your task distribution | Agent observability vendors offer baseline tooling for standard LLM APIs | Configure drift alerting thresholds to your organization's acceptable variance range |
| Reversibility gates | Build: gates must be specific to your action types and approval workflows | Workflow orchestration platforms offer approval gate patterns | Configure per action-type thresholds; not one-size-fits-all |
| Immutable audit logs | Build integration between agent framework and existing SIEM | Cloud SIEM vendors (existing contract, likely) handle immutability at infrastructure level | Configure agent logging to route to existing SIEM; ensure agent has no write path to log store |
| Tool chain integrity verification | Build a verified tool registry internal to your infrastructure | Emerging MCP security vendors; evaluate against your tool inventory | Configure approved-tool lists as environment constraints before agent deployment |
| Prompt injection detection | Build: detection must be calibrated to your document and data types | LLM security vendors offer injection detection middleware | Configure sensitivity thresholds; expect false positives requiring tuning |
Enumerate all deployed agents. For each: document the full ACS, classify permission scope, and establish behavioral baselines during a controlled observation period. Deliverable: Agent Security Registry with ACS classification and baseline profiles. Go/no-go gate: all agents in Registry; no agent operating without documented baseline.
Insert reversibility gates on all irreversible actions for agents with broad-write or orchestration-authority classification. Deploy behavioral anomaly monitoring against established baselines. Redirect audit logs to immutable SIEM. Deliverable: automated ADW detection capability. Go/no-go gate: baseline deviation alerts are live and tested; at least one reversibility gate per high-classification agent.
Commission independent adversarial red-team exercises covering all four ACS vectors. Address findings. Establish quarterly red-team cadence. Implement inter-agent trust attestation for multi-agent orchestration chains. Success criteria: all four ACS vectors have documented detection controls; Cascading Hijack scenario has been tested and mitigated.