Agentic AI doesn’t introduce new categories of vulnerability. It amplifies the ones we already knew about, at speed.

By Zinet Kemal

AI agents are no longer just generating answers. They are taking action inside our systems. They retrieve data, call APIs, and execute workflows with more access than we would ever grant a human, and far less oversight.

This shift represents a fundamental change. AI is no longer a standalone model. It is becoming an orchestrator of systems. Protocols such as Model Context Protocol (MCP) are accelerating the evolution, enabling AI to interact with tools, services, and enterprise infrastructure. As these systems become more capable, the risk compounds. The risk itself is not new. What is new is the blast radius, the speed at which it spreads, and the autonomy behind how it executes.

Privilege Amplification By Design

What once required multiple systems, credentials, and human approvals can now be executed through a single agent. AI agents inherit and aggregate access. Every API integration, database connection, plugin, and tool becomes part of a growing attack surface.

Much of the public conversation focuses on novel risks like adversarial prompts and model manipulation. Most real-world failures stem from something far more familiar.

What Is Actually Breaking In Agentic Systems

Insecure APIs. The same patterns that have driven web application failures for two decades, now reachable by autonomous agents at machine speed.

Weak identity controls. Agents inherit privileges from credentials that were never scoped for non-human actors.

Poor secret management. API keys, tokens, and credentials sitting in plaintext that AI tooling can now surface in unexpected contexts.

Overly permissive credentials. Standing access that exceeds what any agent’s task actually requires.

Compromised third-party libraries. Supply chain risk amplified by the centralization of AI infrastructure.

Prompt Injection And The Confused Deputy Problem

Prompt injection remains one of the most discussed risks in AI systems and is highlighted by the OWASP Foundation as a top threat. In agentic systems, the consequences are more severe. A manipulated model can take action, not just generate incorrect output.

This creates a modern version of the confused deputy problem, where the AI unknowingly performs actions on behalf of an attacker using its assigned privileges. Because agents interact with external tools, APIs, and data sources, these attacks propagate across systems rather than staying within a single model. The vulnerability class itself is not new. It is an evolution of a well-understood pattern: systems misusing their own privileges under manipulated input.

AI Coding Agents And The Erosion Of The Development Boundary

AI coding assistants introduce a subtle but critical expansion of an already known risk: secret exposure. Configuration files like .env have always contained sensitive data such as API keys, tokens, and credentials. The risk of leaking them through misconfigurations or accidental commits is well documented, with platforms like GitHub reporting widespread exposure of secrets in repositories. What is changing is how that exposure happens.

To function effectively, AI assistants analyze entire repositories, not just the code being executed but everything needed to understand the project. That includes .env files. Secrets that were previously isolated and only accessed at runtime can now become visible during development-time interactions. The moment an AI agent is asked to explain, debug, or refactor a project, those secrets may enter the model’s context. Once they are in context, they can surface in prompts, logs, generated outputs, or be carried across downstream tools and workflows.

This is an emerging concern reflected in the OWASP Top 10 for LLM Applications, which highlights risks such as sensitive information disclosure. The boundary between development artifacts and runtime exposure used to be clear. It is now fluid.

When Traditional Vulnerabilities Meet AI Infrastructure

A recent supply chain compromise demonstrates how these risks manifest in modern AI ecosystems. In March 2026, attackers compromised the software supply chain of LiteLLM, a widely used library that routes requests across multiple language model providers.

The compromise did not originate in the AI model itself. It began with a breach of a CI/CD tool tied to a dependency in the pipeline, allowing attackers to publish malicious versions of the library containing credential-stealing payloads. Those payloads were designed to harvest environment variables, API keys, cloud credentials, and Kubernetes secrets, effectively extracting everything the system could access.

We have seen similar patterns in past technology shifts, although not with this level of access concentrated in one place. LiteLLM acts as a central gateway for AI systems, aggregating access to dozens of model providers and services. Compromising it means compromising the control plane of AI interactions. This reflects a broader pattern: AI infrastructure centralizes access to models, data, and tools, making traditional supply chain weaknesses significantly more impactful.

These risks align with patterns already documented in the OWASP Top 10 for LLM Applications, which highlights prompt injection, insecure plugins, and supply chain vulnerabilities. They are not entirely new categories of vulnerability. They reflect how existing security weaknesses are being amplified in AI-driven systems. As agents gain the ability to take action across connected systems, a single manipulated input can trigger unintended actions, access sensitive data, or propagate risk across integrated tools and services.

Agent ecosystems are being built faster than they are being secured. The challenge is not a lack of security principles. It is ensuring those principles are consistently applied in systems where automation rapidly amplifies small misconfigurations.

Security Fundamentals Matter

Despite the novelty of AI, the most effective defenses remain unchanged.

The Defensive Fundamentals That Still Apply

Strict least privilege access for all agents. Scope every credential to the task, not the tool.

Centralized secret management. Plaintext storage in configuration files is no longer survivable when AI tooling can surface those files into model context.

Treat all prompts and inputs as untrusted data. External content reaching the agent is adversarial input, not instruction.

Full visibility into agent actions and tool interactions. What an agent did, why, and what it accessed must be observable enough to support incident response.

Rigorous vetting of third-party integrations and libraries. Especially the ones that act as control planes for AI interactions.

The Real Lesson For AI Security

Agentic AI is a force multiplier for both capability and risk. Organizations that treat it as just another AI upgrade will repeat the mistakes of past technology waves. The ones that succeed will recognize what agentic systems really are.

The difference is no longer the type of vulnerabilities. It is how quickly they cascade across interconnected systems. Agentic AI may be new. The security lessons it is teaching us are not.

What we secure has not changed. How quickly mistakes propagate when we do not has.

About The Author

Zinet Kemal is an immigrant from Ethiopia and mother of four, is a Senior Cloud Security Engineer at Mayo Clinic. A career changer from the legal field, she is now a multi-award-winning cybersecurity practitioner, TEDx speaker, LinkedIn Learning instructor, 4 times author, and mentor.