Most agentic breaches are not exotic. They follow a predictable chain: untrusted content, a hijacked goal, an over-scoped permission, and a quiet exfiltration. Here is the anatomy, step by step, and where to break the chain.
When an agentic AI system is compromised, the post-mortem rarely reads like a thriller. There is no zero-day, no nation-state, no clever memory-corruption exploit. There is a piece of text that should not have been trusted, an agent that did exactly what it was built to do, and a permission that was broader than the task required. The interesting part is how mundane each step is, and how reliably they chain together.
This is the anatomy of a typical agentic breach. It is deliberately not about any one named incident, because the value is in the pattern, which repeats across deployments regardless of the specific product. If you can see the chain, you can break it.
Step 1: Untrusted content enters the context
Every agentic breach starts with an attacker getting text in front of the agent. This is the easy part, because ingesting outside content is the agent's job. The vector might be a web page the agent browses, a document it summarises, an email in the inbox it manages, a record returned by a database query, or a tool's output. Crucially, the attacker does not need to be the user. They just need their text to reach the context window through any of the channels the agent is designed to read.
The instruction hidden in that content does not announce itself. It is phrased as documentation, as a system note, as a routine request. It only has to look ordinary enough to survive a glance, because nothing is looking harder than a glance.
Step 2: The goal gets hijacked
Once the malicious instruction is in context, the model does what models do: it follows instructions in the content it reads. It cannot reliably distinguish the user's intent from the attacker's, so it folds the injected instruction into its plan. The agent's objective quietly shifts. It is still producing plausible output and still appears to be on task, but part of what it is now trying to accomplish belongs to the attacker.
This is the hinge of the whole breach. In a chatbot, a hijacked response is an embarrassment. In an agent, a hijacked goal becomes a sequence of real actions.
Step 3: Over-scoped permissions turn intent into impact
Now the agent acts, and it acts with whatever permissions you gave it. This is where breadth becomes damage. If the agent's credentials can read the whole customer database when the task only needed one record, the injected goal can reach the whole database. If the agent can call any tool when the task needed two, the attacker can compose tools into a capability you never intended to expose.
Almost every serious agentic breach is, at its core, a least-privilege failure wearing a prompt-injection costume. The injection decides what the agent tries; the permissions decide how much it can touch.
Step 4: Exfiltration through a legitimate channel
Finally the data leaves, and it leaves through a door you installed on purpose. The agent sends an email, makes an API call, writes to a shared store, posts to a webhook. Because the channel is legitimate and the agent is authorised to use it, nothing trips. The exfiltration looks like normal agent behavior, which is exactly why it so often runs for weeks before anyone notices, if they notice at all.
The chain, and where it breaks
| Step | What happens | Where you break it |
|---|---|---|
| 1. Ingestion | Malicious text reaches the context | Scan untrusted content for injected instructions before it influences the agent |
| 2. Goal hijack | The model folds in the attacker's instruction | Treat tool output and retrieved content as untrusted; evaluate intent, not just form |
| 3. Over-scope | Broad permissions amplify the hijacked goal | Least privilege per task; scope identity, tools, and data access tightly |
| 4. Exfiltration | Data leaves via a legitimate channel | Egress allowlisting; constrain and monitor outbound actions |
The single most important thing this table shows is that you do not need to win at every step. The chain only completes if all four links hold for the attacker. Break any one reliably and the breach does not happen. Break two and you have defense in depth.
Why monitoring alone is not enough
A common reaction is to add logging and call it covered. Logging is necessary, and you should absolutely have it for audit and forensics. But logging is a step-4 control, it tells you the data left after it left. By then the breach has happened. The leverage is earlier, at steps 1 and 3, where you can stop the chain before any action is taken. Detection at ingestion and discipline at permissions prevent the incident; logging documents it.
Frequently asked questions
Do these breaches require a sophisticated attacker? No, and that is the point. The hardest technical step, getting text in front of the agent, is the step the agent's design hands to the attacker for free. The rest is patience and a plausible instruction.
Why do they run for so long undetected? Because every action in the chain is something the agent is authorised to do. There is no malformed request, no failed login, no signature to match. The malicious behavior is shaped to look exactly like legitimate behavior.
Is this the same as prompt injection? Prompt injection is step 2. The breach is the whole chain. Treating injection as the only problem is how teams end up with a detection control and no permission discipline, or vice versa.
Where Promptention fits
We focus on the two links with the most leverage: detecting injected instructions in the untrusted content reaching your agents, and helping enforce policy on what those agents are permitted to do and where they can send data. The model will keep following instructions in its context, and your channels will stay legitimately open. Our job is to make sure the malicious instruction never lands, and that if it does, the agent is too tightly scoped and too tightly fenced for it to matter.
Promptention Guard detects prompt injection at the input layer and supports policy enforcement on agent actions, breaking the breach chain before exfiltration.
Further reading: OWASP Top 10 for Agentic Applications (2026); Simon Willison, "The Lethal Trifecta for AI Agents" (2025).
