The Rise of Agentic Attack Surfaces

Executive Summary

The security conversation about AI has been dominated, for most of the past two years, by concerns about data leakage — employees feeding sensitive information into AI tools, outputs containing confidential content, training data including proprietary materials. These are legitimate concerns, and they have driven a wave of AI acceptable use policies, shadow AI governance programs, and data loss prevention configurations.

But the more consequential security challenge of AI is not data leakage. It is agency.

AI agents — systems that can perceive context, make decisions, call tools, invoke APIs, retrieve and modify data, trigger workflows, and take actions in the world — have introduced a category of enterprise attack surface that is fundamentally different from the prompt-response AI that preceded them. An agent does not just generate content. It acts. And the governance of autonomous action — what the agent can do, to what, under what conditions, with whose authority, and with what accountability — is the security challenge that most enterprises are least prepared to address.

Why This Matters Now

The deployment of AI agents in enterprise environments has accelerated well ahead of the governance frameworks designed to control them. Copilot integrations that can send emails, schedule meetings, and access documents on behalf of users. Customer service agents that can query databases, initiate refunds, and update records. IT automation agents that can provision infrastructure, modify configurations, and execute scripts. Research agents that can search the web, access internal knowledge bases, and synthesize information from across the enterprise.

Each of these represents a genuine operational benefit — the productivity improvements are real and significant. And each represents a governed extension of enterprise authority to an automated system that can exercise that authority at machine speed, across multiple systems simultaneously, without the judgment constraints, fatigue limitations, or contextual awareness of the human it is assisting.

The attack surface created by AI agents is not theoretical. Prompt injection attacks — where malicious content encountered by an agent during its operation manipulates the agent's behavior — have been demonstrated against virtually every major agent framework. Data exfiltration through agent chaining — where an agent with access to sensitive data is manipulated into transmitting that data to an external endpoint — has been demonstrated in research contexts. Identity impersonation through compromised agent credentials has real-world precedents. These are not edge cases. They are the predictable consequences of deploying autonomous systems with significant enterprise authority before governance frameworks have been established.

CISO2CISO Insight

The security question about AI agents is not "can the agent be manipulated?" — it clearly can. The question is "if it is manipulated, what can it do?" The answer to that question is determined by governance decisions that most organizations are making too slowly.

The Agentic Attack Surface — Five Dimensions

The prompt boundary. AI agents process inputs from multiple sources: user instructions, retrieved documents, web content, tool outputs, and data from connected systems. Any of these can contain malicious instructions designed to redirect agent behavior — a technique known as prompt injection. Unlike traditional software vulnerabilities, prompt injection exploits the flexibility that makes agents useful: their ability to interpret and respond to natural language instructions from multiple sources. The prompt boundary cannot be fully hardened, but it can be managed through input validation, output monitoring, and architectural choices that limit what agents can do in response to potentially malicious inputs.

The tool boundary. The capabilities of an AI agent are defined by the tools it has access to: APIs it can call, databases it can query, systems it can modify, and services it can invoke. The tool boundary determines the blast radius of a compromised or manipulated agent — an agent with access to email, calendar, CRM, and file systems can cause far more damage when manipulated than an agent with access only to a read-only knowledge base. The tool boundary is the most important governance decision in agent design, and it is typically made by development teams under productivity pressure rather than security teams under risk pressure.

The identity boundary. AI agents typically operate under credentials — service accounts, OAuth tokens, API keys — that define their identity in connected systems. These credentials carry permissions that were granted to enable agent functionality, often with generous scope to avoid access errors during development. The identity of an agent is frequently under-governed relative to an equivalent human account: no just-in-time access, no session monitoring, no regular permission review, and often no correlation with the agent's actual operational requirements. A compromised agent credential is a privileged identity that can act at machine speed.

The data boundary. Agents accumulate context across interactions — conversation history, retrieved documents, cached results — that may contain sensitive information. This context window creates a data security challenge that is distinct from the data security challenges of traditional systems: information that was accessed legitimately for one purpose may persist in the agent's context and be accessible to subsequent malicious inputs or outputs. Memory systems that allow agents to persist information across sessions amplify this challenge by extending the potential exposure window.

The action boundary. High-impact agent actions — sending external communications, modifying production systems, initiating financial transactions, provisioning resources — represent the highest-risk category of agent capability. The absence of human approval requirements for these actions is often the most consequential governance gap in agent deployments. The principle that high-impact, irreversible, or externally-visible actions require human confirmation before execution is the single most important security design requirement for enterprise AI agents — and it is the requirement most commonly absent.

Executive Framework

What CISOs Should Do Next

• Inventory every AI agent deployed in your environment — including agents embedded in productivity tools, customer systems, and IT automation platforms — and map the tools, data, and systems each agent can access.
• Apply a blast-radius assessment to each agent: if this agent were manipulated, what is the maximum damage it could cause with its current credentials and tool access?
• Establish a human-in-the-loop requirement for high-impact agent actions — define the categories of action that require human confirmation before execution and verify that this requirement is implemented.
• Review agent credential scoping: ensure that agent credentials follow least-privilege principles, with permissions scoped to operational requirements rather than development convenience.
• Implement monitoring for agent behavior: unusual tool call patterns, unexpected data access, and anomalous output content are the indicators of agent compromise or manipulation that operational monitoring should surface.
• Include agentic AI in your threat modeling: the attack paths through AI agents are different from traditional attack paths, and understanding them requires deliberate threat modeling specific to your agent architecture.

Board-Level Questions

• Do we have visibility into all AI agents operating in our enterprise environment — including those embedded in vendor products and productivity platforms?
• For each AI agent with significant enterprise authority, what is the blast radius of its compromise — and is that blast radius acceptable?
• Are there AI agents in our environment that can take high-impact or irreversible actions without human confirmation?
• Is the identity governance we apply to AI agents equivalent to what we apply to privileged human accounts with similar levels of enterprise access?

Final Executive Takeaway

Agentic AI represents a genuine paradigm shift in enterprise attack surface — not an incremental expansion of existing risk categories but a new category defined by autonomous action, delegated authority, and machine-speed execution. The governance frameworks that have developed for traditional software systems, for human identities, and for data access do not map cleanly onto agent security. New thinking is required.

The organizations that are getting ahead of this are not waiting for a standard framework to emerge — they are adapting existing governance principles (least privilege, human oversight of high-impact decisions, behavioral monitoring, credential lifecycle management) to the specific characteristics of agentic systems and building the institutional knowledge to govern AI agents as they become increasingly central to enterprise operations.

The governing principle is simple even if the implementation is complex: autonomous systems that can act with enterprise authority require governance commensurate with that authority — not less governance because they are automated, but more, because they are faster.