AI agents pose confused deputy risks requiring external reference monitors for control

1. Executive summary

Rapid7 published an analysis arguing that AI agents acting with delegated credentials are a new class of privileged insider, and that the controls governing them must sit outside the model in an external reference monitor. No CVE, malware family, named threat actor or exploitation campaign is associated with this item; it is an architectural position piece, not an incident report. The risk it describes is real for EMEA financial services because agents are already being granted access to mailboxes, data lakes, ticketing systems, source code and production systems, and a successful prompt injection against such an agent needs no stolen password and fires no exploit. The exposure is the agent's own permissions, and the source argues that a system prompt is not a control. No CVSS score, severity rating or CISA KEV state applies, because no vulnerability is identified.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The source describes an attack pattern rather than a campaign. No specific victim, actor, tool, payload or indicator is given. The chain below is the mechanism the source sets out; it is a design-level description, not a reconstruction of an observed intrusion.

1. An AI agent is granted standing access to real systems: it reads mailboxes, queries data lakes, opens tickets, pushes code and acts on production systems. It runs under credentials that reach those systems.
2. An attacker places hidden instructions in content the agent will process: a poisoned email, web page, document, or, per SecurityWeek, metadata, images and code. The agent treats that content as data.
3. The agent reads the content and acts on the hidden instructions, using its own authority. The source calls this the confused deputy: a trusted program tricked into misusing its own authority on someone else's behalf. No password is stolen and no exploit fires.
4. The agent executes the injected action through its tools and APIs. The blast radius is set by the agent's permissions, not by the model's capability.
5. Where the agent has persistent long-term memory, the source notes a single poisoning can persist, leaving the agent compromised after the original input is gone.

The source identifies four properties that change detection and forensics work compared with a human insider. A monoculture means many identical agent copies share one weakness, so a working injection should be treated like a wormable bug and fixed across the fleet rather than on one instance. Replayability is lost: the same input can produce a different action on a rerun, so forensics must rest on recorded inputs and tool calls, not on replaying the agent. The command channel is mixed into the data the agent processes, so any content it reads is a potential command. Self-report cannot be trusted: the agent's account of its reasoning may not match what it did, and the source states it is not yet known how to guarantee that reasoning is faithful, so evidence must come from outside the agent.

The proposed control architecture separates three things: the model that reasons, the harness that orchestrates it, and a policy layer that decides which actions are allowed. The agent can propose anything, but only the enforcement point decides what reaches real systems, and every decision lands in a log the agent cannot alter. The source's specific recommendations are: give every agent its own identity rather than a shared service account or a person's credentials, so it can be scoped, monitored and revoked independently; enforce least privilege on actions (which tools, APIs and parameters) and require step-up human approval for high-impact actions such as payments, deletions or production changes; log every tool call, input and output to tamper-evident storage outside the agent's reach; never let a model grade its own work, using a different model, a deterministic rule or a human instead; red team continuously for prompt injection, tool misuse and data exfiltration, re-testing whenever the model, prompt or tool set changes; and build a tested kill switch that cuts off credentials and tool access mid-run, outside the agent.

On the SOC side, the source argues logging alone does not protect anyone because no human team can review millions of agent actions, and handing that review to another unsupervised model adds another black box. It recommends per-agent behavioural baselines (for example, alerting when a code-review agent starts reading the finance file share), detections for prompt-injection indicators, unusual tool chaining, sudden bursts of high-privilege actions and data flowing to unexpected destinations, correlation of agent actions to the user, session, content read and systems touched, and response playbooks that pause the agent, revoke its tokens, quarantine its outputs and roll back its changes.

The source uses WannaCry as an illustration of why a kill switch must be owned by the defender: in May 2017 a researcher registered a nonsense domain hard-coded in the ransomware and new infections stopped, but defenders did not build that control, it did nothing for already-encrypted machines, and later variants removed it.

Confidence caveats. This is a single-source architectural argument from Rapid7, corroborated in theme but not in technical detail by Microsoft's parallel post and by Help Net Security's coverage of SANS/AWS guidance that scoping should happen at retrieval time inside the role-based or attribute-based access system rather than in the system prompt. No exploitation has been observed or attributed in any of the sources. No named actor has a MITRE ATT&CK profile for this activity, and none is claimed.

4. Mitigation & containment

P1 within 24h

• Inventory every AI agent with standing access to mail, data platforms, ticketing, source control or production, and record the identity it runs under. Any agent running under a shared service account or a named employee's credentials is the first thing to remediate.
• For agents that can move money, delete data or change production, put a human step-up approval in front of those actions today, at the orchestration or API gateway layer, not in the system prompt.
• Confirm that tool-call, input and output logs for each agent are written to storage the agent cannot modify or delete, and that they can be reconstructed without querying the agent.

P2 within 72h

• Define an explicit action space per agent: permitted tools, APIs and parameters. Deny by default at the enforcement point and allow only what the task requires.
• Stand up a tested kill switch that revokes the agent's tokens and cuts tool access mid-run, and exercise it the way host isolation is exercised.
• Add SOC detections for the behaviours the source names: an agent reaching a data source outside its baseline, unusual tool chaining, bursts of high-privilege actions, and data flowing to unexpected destinations. Baseline each agent's normal tools, data sources and destinations first.
• Where agents have persistent memory, add memory state to logging and quarantine agent outputs pending review.

P3 within 7 days

• Red team the deployed agents for prompt injection, tool misuse and data exfiltration, and schedule re-testing on every change to model, prompt or tool set.
• Require that verification of important agent outcomes uses a different model, a deterministic rule or a human, and avoid single-vendor dependence for anything critical.
• Write and rehearse a response playbook: pause the agent, revoke tokens, quarantine outputs, roll back changes.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe observable behaviours but give no atomic indicators (no hashes, domains, IPs, file paths or command lines). The behavioural indicators below are drawn from the source's SOC guidance.

6. Detection

Insufficient indicators to author detection rules.

The sources contain no distinctive strings, command-line flags, mutex names, file names, registry keys or hard-coded values belonging to a threat artefact. Any rule built from the available material would match reporting about agent risk rather than malicious activity, so none is emitted. Detection effort should go into the behavioural baselines and correlation described in §4, built against the client's own agent telemetry.

7. Sources

• Rapid7, "Your Next Insider Threat Won't be Human: Securing AI Agents from the Outside in", https://www.rapid7.com/blog/post/ai-inhuman-insider-threats-securing-agents, 2026-10-19.
• Microsoft Threat Intelligence, "Agents are your newest insiders. Security must move at their speed.", https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/, 2026-10-19.
• Help Net Security, "Your AI agent's system prompt is not a security control", https://www.helpnetsecurity.com/2026/09/03/sans-aws-agentic-ai-security/, 2026-09-03.
• SecurityWeek, "The Hidden Instructions That Can Hijack AI Agents", https://www.securityweek.com/the-hidden-instructions-that-can-hijack-ai-agents/, date not stated in the supplied material.

8. Adverse Trace position

Adverse Trace assesses this as an architectural risk advisory, not an active threat: no CVE, no exploitation in the wild, no attributed actor and no indicators, so there is no severity score to assign and no patch to mandate. The client impact is concentrated in firms that have already given agents standing credentials to payment, data or production systems without an enforcement point outside the model; for those firms the exposure is the agent's permission set, and a single successful injection inherits all of it. The Rapid7 recommendations are single-sourced and should be read as design guidance to validate against your own agent inventory rather than as tested controls. We will track vendor guidance on agent identity, action scoping and kill-switch implementations as it appears, and we will reissue this advisory if an observed exploitation campaign or a named actor is identified against agentic deployments. Clients who want to act now should start with the P1 inventory in §4: you cannot scope or revoke an agent you have not enumerated.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.