When AI Agents Become Insiders: Hidden Access Risks in Agentic Systems

Description

AI agents are rapidly evolving into high-privilege orchestrators—reading sensitive knowledge bases, invoking cloud tools, generating presigned URLs, executing workflow actions, and processing user uploads. These interactions create new attack surfaces never anticipated in traditional threat models. Modern agent frameworks blur boundaries between reasoning, automation, and infrastructure control, enabling attackers to leverage the agent’s privileged environment instead of directly exploiting the underlying system.

This talk presents a forward-looking offensive analysis—rooted in recent research, red-team findings, and cross-industry incidents—on how AI agents can unintentionally expose access pathways that escalate into major compromise. We examine failure modes where agents leak internal embeddings, produce overly-privileged presigned URLs, incorrectly validate uploaded content, hallucinate cloud instructions, or chain tools in unsafe sequences. Importantly, we do not provide exploit code; instead we analyze structural weaknesses and how attackers might conceptually exploit them.

Through simulated adversarial scenarios, we show how subtle prompt manipulation, crafted file uploads, or poisoned knowledge-base content could influence an AI agent to reveal sensitive data, execute unintended actions, or collapse internal trust boundaries. We introduce a practical framework for modeling “AI-induced access risks” and demonstrate why these agent-driven pathways are fundamentally different from classical attack chains.

Finally, we deliver actionable defensive strategies: permission-scoped tool invocation, agent behavioral monitoring, safe URL governance, isolation for upload pipelines, KB ingestion attestation, and AI-aware detection patterns.

This session is not about exploiting AI—it's about preventing AI from accidentally exploiting you.