Agentic AI’s Shadow Pipeline: Mapping the Attack Surface Behind Trusted Workflows

Enterprises connecting AI agents to cloud infrastructure create a new attack path, from cloud compute and AI development environments to production agent actions. Most security teams cannot see it yet.

For tech, media, and communications organizations, the exposure is acute. For instance, AI agents process content feeds, triage support tickets, parse documents at scale, and query production databases. They operate with service account credentials that typically carry far broader permissions than any specific task requires. The pipeline from cloud infrastructure to agent action is now the primary attack surface, and TrendAI™ Research has documented exactly how it breaks.

Compounding this is Shadow AI, the proliferation of AI agents, skills, and capabilities deployed across the enterprise without security review or centralized governance. As Vladimir Kropotov, principal threat researcher at TrendAI™ Research, warns: "AI can understand our native languages, and it is integrated into many products you are not aware of. Products we use in daily life email processing, collaboration and productivity tools all have AI capabilities, which can be silently enabled by an attacker. You cannot know every place where AI is used because it is integrated at the earliest stages of the supply chain."

Shadow AI is a significant risk. IBM’s 2025 report on the cost of a data breach found that shadow AI breaches cost US$670,000 more than average (US$4.63M versus US$3.96M). Among affected organizations, 97% lacked proper AI access controls and 63% had no AI governance policy or were still developing one. Meanwhile, BlackFog research reported that 86% of employees use AI tools weekly for work while 34% use free versions of company-approved tools, which introduce unmonitored data flows. Netskope’s report adds to this picture, with 47% of generative AI (GenAI) users accessing GenAI tools through personal accounts, bypassing enterprise controls entirely.

The threat model

TrendAI™ Research identifies five attack planes across the cloud-to-AI pipeline, which we have mapped against the OWASP Top 10 for Agentic Applications (ASI, December 2025) and the Cloud Security Alliance’s (CSA) MAESTRO threat modeling framework:

• Cloud misconfiguration: This includes overly permissioned identity and access management (IAM), hard-coded secrets, and exposed storage. In fact, 47% of organizations lack full visibility of cloud assets in multi-cloud environments.
• Agent trust boundary: AI agents cannot distinguish data from instructions when processing untrusted content. This maps to OWASP ASI01 (Agent Goal Hijack) and LLM01:2025 (Prompt Injection).
• MCP and integration protocols: To exemplify, our own research on the state of AI security analyzed more than 19,000 open-source MCP server repositories and found that up to 20% contained exploitable vulnerabilities. We also identified 1,467 exposed MCP servers with zero authentication, nearly three times the number seen in initial findings, along with 95 MCP-related CVEs in 2025 alone. This maps to OWASP ASI03 (Identity & Privilege Abuse).
• AI supply chain: Our AI security report found that 46.5% of vulnerabilities related to the AI supply chain were rated high or critical. Models are binary blobs, not diffable like source code. In fact, our own AI-Enhanced Security Intelligence & Research (ÆSIR) uncovered 21 critical vulnerabilities across Nvidia, Tencent, MLflow, and MCP tooling.
• Shadow AI: This refers to AI skills and agents deployed by product, operations, and marketing teams without security review or centralized inventory. Our own researchers, Vladimir Kropotov, Fyodor Yarochkin, and Kirill Gelfand, noted AI skills as “an emerging attack surface requiring dedicated security attention, especially in environments where shadow AI introduces unmanaged or inconsistently governed knowledge artifacts."
• OWASP agentic AI coverage: The preceding threat model addresses ASI01 – ASI04. The following ASI risks are not yet covered in this pipeline model and represent areas for further assessment:

Cloud misconfiguration as an entry point

The blast radius from an exposed credential in an AI workload is qualitatively different from a typical cloud leak. TrendAI™ documented cases (for example, CVE-2025-10643) where a single hard-coded token embedded in an application binary provided read/write access to cloud storage containing AI model weights, software binaries, and container images. An attacker with that access can poison the model supply chain and replacing artifacts that could then be deployed across production inference or distributed to users.

For media and communications organizations, a compromised content recommendation model is a direct threat to editorial integrity, brand trust, and advertiser relationships. This is not just an IT problem, but a business continuity risk, as a compromised recommendation model can distort what audiences see, weaken trust in the platform, and affect advertising inventory, brand safety, or partner commitments.

Case study: Return-to-tool (RTT) exploits—the AI-native attack class

TrendAI™ researchers have characterized a new exploit class called return-to-tool (RTT) exploits, the AI era’s structural equivalent of return-oriented programming (ROP). The agent’'s approved tools are the gadgets, while the attacker’s prompt is the chain that strings them together. RTT is a specific operationalization of the broader indirect prompt injection class (Greshake et al., OWASP LLM01:2025). What distinguishes RTT is the explicit chaining of data/instruction confusion to authorized tool invocation as the escalation mechanism, turning the agent’'s own permissions into the attack payload.

To demonstrate how it works, an attacker could plant instructions in the content that the agent is guaranteed to read, such as a support ticket, a document, a database record, or a passport image. The agent might treat those instructions as legitimate tasks and execute them using its own authorized tool access. There would be no anomalous authentication events, unusual network connections, or signature matches. The agent is doing exactly what it was designed to do.

TrendAI™ Research has already observed real-world attacks and tests using RTT exploits:

• PostgreSQL MCP read-only bypass: A widely used Docker image with over 100,000 pulls shipped with an unpatched SQL read-only bypass. An AI agent, fed a crafted support ticket, turned this vulnerability into a working exfiltration path, extracting every authentication token from the production database and posting them to a public comment thread via its own service account.
• Database ransomware without malware: A single prompt hidden in a support ticket turned the agent into ransomware that encrypted every customer email using the database's own pgp_sym_encrypt function. There was no binary on disk, process in memory, or remote code execution (RCE) involved.
• Know your customer (KYC) passport exfiltration: Hidden text inside a crafted passport image steered a KYC extraction agent into leaking other customers’' records. TrendAI™ researchers scaled this scenario across 2,600 automated runs against 13 frontier models from Anthropic, OpenAI, Google, and DeepSeek, and achieved full or partial success against nearly every vendor.

Traditional detection has limited visibility into RTT because it generates no anomalous signals. The agent uses its own credentials and approved tools, operating within its documented privileges. Web application firewalls (WAFs), container isolation, and role-based access control (RBAC) provide limited protection because the attack unfolds entirely inside the trust boundary. RTT has so far been demonstrated in controlled research environments, but adversary adoption is plausible given the low barrier to exploitation and the absence of effective countermeasures in most production deployments.

RAG poisoning and multi-agent worm propagation

The RTT threat model assumes a single attacker targeting a single agent through a single tool chain. Production environments with shared retrieval-augmented generation (RAG) databases and interagent communication introduce a qualitatively different blast radius: self-replicating prompt worms. These map to OWASP ASI06 (Memory & Context Poisoning) and ASI08 (Cascading Failures):

• RAG worm: In a study presented at the 2025 ACM Conference on Computer and Communications Security, researchers demonstrated self-replicating prompts that propagate through RAG-based ecosystems at super-linear rates. Each compromised client infected 20 new clients within one to three days. A single poisoned document in a shared knowledge base can cascade to every agent consuming that data.
• Morris II: In earlier Cornell Tech and Technion research, a proof-of-concept AI worm achieved zero-click propagation through Gemini Pro, ChatGPT 4.0, and LLaVA systems via adversarial self-replicating prompts embedded in RAG systems.

For tech, media, and communications organizations with shared content repositories, editorial knowledge bases, and multi-agent content pipelines, RAG poisoning can turn an isolated agent compromise into cross-workflow propagation. When poisoned context is retrieved, reused, and acted on by other agents, teams could lose assurance that drafts, approvals, recommendations, or published outputs are grounded in trusted source material.

MCP at scale: The connector problem

Anthropic’ s reference SQLite MCP server was forked over 5,000 times before being archived. It contained a classic SQL injection flaw that enabled stored prompt injection, where payloads propagated across agents because they implicitly trust data from internal sources. TrendAI™ documented additional critical vulnerabilities in nonofficial Azure and Amazon Web Services (AWS) MCP implementations: authentication bypass on command execution endpoints (for example, CVE-2026-5058, with a CVSS rating of 9.8), arbitrary code execution via deserialization, and unsafe standard input/output (STDIO) transport executing OS commands without sanitization.

A stronger enterprise posture starts with visibility, control, and governance across the MCP layer:

• Inventory all MCP server instances through network scanning and continuous integration and continuous delivery (CI/CD) audits.
• Use authenticated remote transports where network access is required, and restrict STDIO-based servers to trusted local execution contexts.
• Implement network segmentation. MCP endpoints should not be public without explicit justification.
• Use explicit tool allowlists per agent, and log every invocation as privileged activity.
• Pin and sign all dependencies, and require security reviews before using community forks.
• For environments with many MCP servers, consider a centralized gateway that inspects, logs, and enforces policy on all MCP traffic at a single chokepoint, similar to how API gateways consolidated REST API security. For tech, media, and communications environments, this means giving teams a central point to monitor and control how agents access content repositories, editorial systems, support platforms, and production databases. This helps reduce unmanaged access to sensitive content, customer data, and workflows.

AI supply chain: Model and pipeline poisoning

The TrendAI™ ÆSIR vulnerability research platform has discovered deserialization vulnerabilities in model loading functions across major AI frameworks (for example, CVE-2025-13716, CVE-2025-13714), enabling RCE at model load time. A poisoned model artifact distributed through a legitimate channel can executes attacker-controlled code when loaded in an inference environment. 

Our TrendAI™ AI security report also projects 2,800 to 3,600 AI CVEs this year. The 2025 AI vulnerability rate of 4.42% was the highest ever recorded. If the trajectory holds, 2026 will exceed 5% of all CVEs annually.

Our research on AI skills also highlights an additional dimension. AI skills function as “executable knowledge artifacts” that encode business logic, proprietary workflows, and access patterns. With shadow AI, where skills proliferate without centralized inventory, these artifacts become high-value intelligence targets and unaudited execution vectors.

The adversary side: AI-enabled threat actor uplift

While enterprises struggle with agent security, adversaries are using the same technology to scale their own operations. TrendAI™ research presented at this year’s RSA Conference, titled “VibeCrime,” documents layered cybercriminal AI architectures where specialized agents autonomously handle reconnaissance, targeting, and extortion.

Additionally, in May 2026, TrendAI™ researchers (Lin, Chen, Yarochkin, Kropotov) documented a solo Russian-speaking threat actor who used jailbroken Gemini to scale a fraud campaign from manual operations to fully automated execution using stolen API keys. The operational tempo achievable by a single actor with AI tools now rivals what previously required organized teams. For media and communications organizations, this means AI-generated phishing, deepfake social engineering, and automated credential harvesting are scaling faster than traditional defenses can adapt. Even subtle content manipulation, such as minor changes to headlines, captions, transcripts, or syndicated content, can distort meaning, damage editorial integrity, or create legal and brand exposure.

Agentic AI

Detection best practices: What to instrument

Detecting agentic AI abuse starts with visibility. Because compromised or manipulated agents often operate through approved credentials and tools, security teams need telemetry that shows what agents can access, which tools they invoke, and how their behavior changes after interacting with external content:

Phase 0 — Instrumentation bootstrap: In most enterprise environments today, AI agent activity is invisible to the security operations center (SOC). Before building detection rules, establish minimum viable telemetry:

1. Agent discovery: Enumerate every AI agent, its service accounts, and data access scope.
2. Log source identification: Determine which systems record agent tool calls and at what fidelity.
3. Deploy structured logging: This should be done on MCP endpoints and agent orchestration layers. Without this foundation, the detection guidance below becomes aspirational.

Phase 1 — Detection engineering:

• Agent behavioral baselines: Which tools does each agent call, in what sequence, at what frequency? Deviations after external content ingestion are high-signal RTT indicators. This requires agent-level monitoring, not signature-based detection.
• Data flow monitoring: This includes agents constructing outbound requests, writing to unusual storage, or querying data outside scope after contact with external content. Instrument MCP tool call logs and agent activity feeds to capture these patterns.
• Cloud access pattern analysis. Anomalous IAM activity in AI workload environments (for example, access to model storage by unexpected principals, or container image modifications), must be under the scope of security information and event management (SIEM).
• MCP structured logging: Ensure full parameter detail on every tool invocation. Alert on read-then-write sequences touching external content.
• RAG integrity monitoring: Track document ingestion events, detect anomalous retrieval patterns, and flag content that triggers unusual agent behavior post-retrieval. Self-replicating prompts leave signatures in retrieval frequency and cross-agent behavioral correlation.

Priority actions for hardening agentic AI environments:

Hardening agentic AI environments starts with reducing unknowns. The following priority actions focus on bringing AI systems under the same level of visibility, access control, monitoring, and incident response expected of other business-critical infrastructure:

• AI asset inventory and shadow AI discovery: This includes every agent, MCP server, AI skill, service account, and external content source. Map what exists, including shadow AI deployments, before you can secure it.
• Least-privilege enforcement: Audit AI service accounts, eliminate wildcard permissions, use time-bounded and scoped credentials, and remove hard-coded secrets.
• Prompt firewalling: Sanitize external inputs before they reach the agent's context window. Strip injection patterns and run high-risk inputs through secondary classification.
• MCP hardening: Require authenticated transport, network segmentation, explicit tool allowlists, and structured logging for MCP deployments.
• Supply chain signing: Apply cryptographic signatures on all model artifacts and container images, require signed software bills of materials (SBOMs), and integrate AI CVE feeds into vulnerability management.
• Agent behavioral monitoring: Feed agent telemetry into SIEM, establish baseline profiles and alerts for RTT-consistent deviations.
• AI-specific incident response (IR) playbook: Define procedures for agent isolation, context window forensics, data access audit, and regulatory notification.
• RAG integrity controls: Use content signing for knowledge-base documents, monitor retrieval patterns for anomaly detection, and establish isolation boundaries between agent populations that share RAG stores.
• Framework alignment: Map controls to the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF), the National Cybersecurity Center of Excellence (NCCoE) concept paper on software and AI agent identity and authorization, and the CSA MAESTRO seven-layer threat model. NIST AI RMF adoption satisfies an estimated 60% to 80% of requirements across the EU AI Act, US state-level AI laws, and international standards simultaneously.

The attack surfaces documented here—cloud misconfiguration, agent trust-boundary abuse, RAG poisoning, MCP authentication gaps, and AI supply-chain compromise—reflect the current exploitable landscape, with known vulnerabilities and reproducible proof-of-concept chains.

Closing these gaps requires enforcing least-privilege IAM on every agent identity, deploying input-validation and tool-call-sequence anomaly detection at the orchestration layer, gating MCP endpoints behind authenticated gateways, and integrating AI-specific telemetry into existing SOC workflows. With the EU AI Act’s high-risk obligations taking effect by August 2, 2026, organizations that continue to treat these controls as optional may face regulatory risks alongside technical exposure.

In the second part of this article series, we will address the governance and organizational dimensions: why visibility gaps persist, how to build an AI asset inventory, and what a defensible compliance posture looks like before the enforcement deadline.