The Agentic Security Myth: How Your AI Stack Is Recreating 1990s Web Exploits

Your security team spent five years hardening ingress controllers, locking down IAM boundaries, and enforcing mutual TLS down to the pod level. Then your product team plugged an autonomous LLM into your core execution loops, gave it dynamic function calling, and called it innovation.

Congratulations. You built a text-driven remote code execution vector with an enterprise support tier.

We aren't talking about memory corruption or broken handshake protocols. Exploiting a C program requires deep assembly knowledge. Exploiting an autonomous AI agent requires a paragraph of plain English prose, a malicious tool payload, and an architecture built on blind trust.

You gave an LLM the agency to parse unstructured text, pick tools on the fly, and run real-world operations without a human in the loop. You didn't invent a new paradigm. You just reopened the entire OWASP Top 10 using natural language as the shell code.

Here is how agentic systems actually break when put under load, mapped directly to the OWASP Top 10 for LLM Applications and why traditional DevSecOps controls fail completely when the payload is natural language.

Indirect Prompt Injection: The Data Plane Hijack

Direct prompt injection is amateur hour. Pushing "ignore previous instructions" into a chat window gets caught by basic system prompt hardening.

Indirect Prompt Injection (OWASP LLM01) is where the real damage happens.

In an indirect attack, the adversary never touches your prompt box. They poison the data sources your agent ingests after it fires up its reasoning loop. A support bot reads an incoming email. A DevOps triage pipeline parses a pull request. A document summary agent scrapes a web page containing hidden text elements.

Your model cannot distinguish between system directives and untrusted user inputs once both sit in the context window. Tokens are tokens. Instructions and data share the exact same execution primitive.

When the model ingests that email, the injected command overwrites your control plane logic executing in memory.

The agent doesn't crash. It simply complies.

Tool & MCP Poisoning: Exfiltrating Memory via Metadata

The Model Context Protocol (MCP) and dynamic tool-calling frameworks give agents their superpower: picking endpoints on the fly based on JSON descriptions.

They are also an absolute disaster for authorization boundaries (OWASP LLM03 & LLM06).

In a Tool Poisoning attack, the adversary doesn't touch your core code. They tamper with tool metadata, either by compromising an open-source tool registry, hijacking a local service descriptor, or injecting malicious tool schemas via third-party plugins.

The user asks a routine question: "Calculate tax for invoice #402."

The agent queries available tool schemas to find a match. It picks calculate_tax based on a semantically poisoned description. The agent then follows the instructions inside that description, slurps up its entire context window—system prompts, API keys, and previously fetched database records—and dumps it straight into the tool's execution parameters.

No remote code execution required. The model's reasoning loop was hijacked to exfiltrate private runtime context over standard HTTP requests.

RAG Poisoning: The Vector Store Trojan

Retrieval-Augmented Generation (RAG) is pushed as the safe alternative to fine-tuning. "Keep your data private, vector-store internal docs, let the agent search on demand."

Except vector databases are completely blind to intent (OWASP LLM04 & LLM08).

If an attacker drops a single malicious document into your knowledge repository—via an unvetted Confluence page, a shared Notion workspace, or a public S3 bucket—they have installed a persistent Trojan in your enterprise context loop.

The Vector Trap: Vector search relies on cosine similarity, not access control. Craft a document that mirrors common system queries, and the retriever drops the poisoned payload directly into the agent's context window every single time that topic comes up.

Once inside, the payload executes a quiet exfiltration maneuver. It doesn't trigger firewall alarms because the agent is technically just "rendering Markdown" or "executing an approved read request."

Why Classic DevSecOps Fails

Traditional security models rely on hard architectural boundaries:

• Deterministic inputs: Code does what it is compiled to do.
• Strict IAM roles: Service accounts have explicit permission boundaries.
• Data vs. Instruction separation: The CPU knows the difference between executable instructions and stored data (e.g., W^X / NX bit execution prevention).

Agentic AI breaks all three assumptions simultaneously.

You cannot solve probabilistic logic flaws with static WAF rules. If your security posture assumes the agent will always follow its system prompt, your system design is broken.

The Remediation Blueprint: Hard, Open-Source Plumbing

Stop asking the LLM to "be careful" inside system prompts. You don't fix probabilistic security flaws with polite requests. You fix them by placing hard, non-AI rule engines around the model's execution loop.

If you aren't intercepting state at these three boundaries, your system is vulnerable by design. The good news you can leverage some open source projects out there to help you being less exposed.

NDLR - at ape factory we are always on the look out for these types of projects. 

Ingestion-Time Sanitization Middleware

Treat every retrieved document, email payload, and tool response as an untrusted user input. Run low-latency, CPU-bound middleware directly over raw data streams before tokens hit the LLM context window.

• StackOne Defender: Lightweight (~22MB, ~4ms execution latency) open-source middleware designed to run directly on the CPU path to catch and strip indirect prompt injections from tool responses before context serialization.
• LLM Guard (Protect AI): Open-source proxy toolkit to sanitize untrusted inputs, mask PII, and block malicious structural formatting before model processing.

Runtime Schema Validation & Execution Interceptors

Strip the LLM of implicit authority. When the agent generates an API execution payload, intercept it before network dispatch.

• NVIDIA NeMo Guardrails: Enforces programmable boundaries via Colang. Intercepts the model's dynamic tool-calling intent and evaluates whether the request violates business logic or runtime safety parameters before hitting the target API.
• Guardrails AI: Enforces hard schema validation against strict Pydantic structures at runtime. If the model attempts to dump context memory into parameter fields, the interceptor drops execution instantly.

Adversarial Pipeline Red-Teaming in CI/CD

Static application security testing (SAST) cannot parse non-deterministic reasoning loops. You need automated, continuous adversarial evaluations built directly into your build pipeline.

• Promptfoo: The open-source benchmark for automated AI red teaming. Runs continuous adversarial test suites inside CI/CD to evaluate agent prompts, tool schemas, and RAG pipelines against indirect injection, RAG data leakage, and excessive agency before shipping to production.

The DevSecOps Reality Check

Autonomy without deterministic verification isn't progress. It’s an unpatched remote code execution vector sitting inside your internal network.

If you are running agentic workflows in production today, three controls are non-negotiable:

1. Strict Tool-Level Isolation: Support bots and cluster management bots must never share an execution boundary, IAM role, or context memory. Ever.
2. Deterministic Middleware Proxies: Never trust model-generated JSON. Validate all tool parameters against strict, typed schemas using non-AI rule engines before making network calls.
3. Assume Context Contamination: Treat every payload from a RAG retriever or web scraper as hostile shell code. Strip markup, restrict dynamic rendering, and never allow unverified tool invocation based on retrieved content.

Stop relying on system prompts to protect your control plane. Build deterministic boundaries, or prepare to debug your agentic logic on a public breach forum.