What Is the Agentic Attack Surface?
The agentic attack surface is the set of systems an autonomous AI agent can reach, combined with every channel through which untrusted content can enter that agent's context. It is distinct from the application attack surface because the vulnerability is not in the code. It is in the model's inability to distinguish an instruction from a piece of data.
For fifty years, secure computing rested on one discipline: keeping code and data apart. Instructions on one side, content on the other. Every control in the enterprise stack, from the firewall to DLP to IAM, assumes that line exists.
A large language model erases it by design. Instructions and data arrive as the same stream of tokens, and the model acts on all of it. This is not a defect awaiting a patch. It is the reason the technology works at all.
That was survivable while the model could only talk. Then the industry gave the model hands, through the Model Context Protocol and a wave of AI coding assistants that read repositories, query production data, and call tools they discover on their own. The blast radius stopped being an awkward sentence and became the systems the agent can reach.
What Are the 6 Main AI Coding Agent Attack Vectors?
The techniques below are distinct in mechanism but identical in principle. Each smuggles instructions into a place the model trusts. Learn the six and almost every headline becomes recognizable.
1. Indirect Prompt Injection
Hidden instructions sit inside data the agent reads: an email, a document, a ticket, a web page. The model treats the text as a command and acts on it, with no malware and no exploit code. OWASP classifies this as ASI01, the leading threat in its 2026 agentic applications list.
Observed in EchoLeak and the Mexican government breach. Google researchers monitoring the web recorded a 32% increase in malicious prompt injection payloads embedded in web content between November 2025 and February 2026.
2. Tool Poisoning
Malicious directives are written into an MCP tool's description or JSON schema, a channel that looks like configuration rather than input. The model reads the metadata as instructions the moment it lists the tool.
Observed in MCPoison and CurXecute. A disclosed Cursor vulnerability allowed an attacker to poison the agent's execution environment so that allowlisted commands delivered arbitrary payloads. The allowlist made the attack easier by auto-approving exactly the commands the attacker needed.
3. Rug Pull
A tool is approved as benign on day one, then mutates its own definition later. By day seven it quietly reroutes credentials, having already earned the user's trust.
Observed across malicious MCP registries. The attack requires no new access. The trust was granted at approval, and the behavior change happens silently on a routine update.
4. Cross-Server Shadowing
With several MCP servers connected to one agent, a malicious server intercepts or overrides calls meant for a trusted one, borrowing the agent's ambient authority to act where it should not.
Observed in multi-server MCP setups. Most such environments have no mechanism to detect one server impersonating another.
5. Excessive Agency
An agent holds more permission than its task requires. One compromised credential or device then cascades.
Observed in the Step Finance drain and the Amazon Q incident. This is the vector conventional permission review misses most reliably, because the agent is not acting outside its permissions. It is acting precisely within them. Scoping this correctly is the central control problem for homegrown AI agents.
6. Supply Chain Compromise
A package or server ships clean, builds trust, then adds exfiltration code in a later release. Or a backdoored build is downloaded thousands of times before anyone notices.
Observed in postmark-mcp and the LiteLLM backdoor. Neither required a novel exploit. Both required only that no one was inspecting the connector layer after initial approval.
AI Agent Security Statistics 2026
The distance between the first two numbers is where the breaches live. Agents are deployed, productive, and largely ungoverned, while the security budget still sits with the perimeter.
The distance between the second two is why this will continue: the leading attack technique is structurally unsolved, and adversaries have already demonstrated they can run an entire campaign through a hijacked agent with minimal human involvement.
AI Agent Security Incidents 2025 to 2026: CVEs and Confirmed Breaches
Each incident below maps to one or more of the six vectors above. The pattern holds across every entry: no novel exploit, no stolen credential, just content the agent was trusted to read.
- EchoLeak (CVE-2025-32711, CVSS 9.3): First documented zero-click attack on an AI agent. A single crafted email made M365 Copilot exfiltrate internal data with no user interaction.
- Copilot "YOLO mode" (CVE-2025-53773, CVSS 9.6): Remote code execution on more than 100,000 developer machines via prompt injection hidden in code comments that triggered autonomous execution.
- MCP Infrastructure RCE (CVE-2025-6514, CVSS 9.6): Remote code execution in widely used MCP infrastructure, exposing any host running the affected connector layer.
- Claude Code Hooks RCE (CVE-2025-59536, CVSS 8.7): A repository plants a malicious config that executes when the agent opens the project, before the trust dialog appears.
- Codex CLI Injection (CVE-2025-61260, HIGH): Project-local configuration files execute commands without user consent when the agent runs in the directory.
- GTG-1002 (state-sponsored, CRITICAL): A state-sponsored group hijacked Claude Code instances to run autonomous espionage against approximately 30 targets. The agent executed 80 to 90% of operations.
- Mexican Government Breach (December 2025 to February 2026, CRITICAL): One attacker used coding agents to breach nine government agencies. 150GB exfiltrated, including 195 million taxpayer records.
- Postmark-mcp (supply chain, HIGH): An MCP package shipped 15 clean releases, then added silent email-exfiltration code in an update that inherited existing trust.
- LiteLLM Backdoor (supply chain, HIGH): Backdoored builds were downloaded roughly 47,000 times during the three hours they were live on the package index.
- Step Finance Drain (January 2026, CRITICAL): An over-privileged trading agent held wallet, oracle, and endpoint rights simultaneously. One device compromise cascaded into a $40 million loss.
Note: CVSS scores as published in the National Vulnerability Database and vendor advisories. Breach details from public disclosures and vendor threat reports.
How to Defend AI Coding Agents: 5 Principles
If the model will not respect the boundary, the boundary must live outside it, in the path every request travels. Five principles separate governance built for agents from controls retrofitted onto them.
- Govern the input, not the output. Decide what a request may reach before it runs. Data that never enters the prompt cannot leak from it.
- Treat every context channel as a boundary. A tool description is code. Structured metadata fetched at boot is code. Scan all of it, not just user text.
- Bind the agent to a real identity. Least privilege applies to non-human actors too. The agent inherits the permissions of the person it acts for, nothing more.
- Establish provenance for every MCP server. Scan and isolate before connection, then re-check behavior after, so a server that turns malicious post-approval is caught.
- Make every decision provable. Timestamp and attribute each redaction, block, and action, so an audit is a query rather than an archaeology project.
These principles converge on a single architectural move: a control point between every agent and everything it can reach, one that decides by identity and policy rather than by guessing at the model's output. It is the pattern the standards bodies are circling and the one common denominator across every incident in this briefing.
DAXA's Safe Agent is built on this premise, sitting between the agent and everything it touches to classify what is sensitive, filter what context the agent can see, and monitor behavior in real time.
Why Do Existing Enterprise Security Controls Miss the Context Layer?
The layer in question is the context layer: everything that reaches the model between a request being made and an action being taken. The prompt. The retrieved documents. The tool descriptions. The MCP server responses. The instructions the agent assembles from all of it before deciding what to do.
Every enterprise control in wide deployment sits either before that layer or after it. None sit inside it. The instinct is to reach for the stack already in place, but each tool misses for a specific structural reason, not because it is misconfigured.
- Firewall and SWG operate before the request reaches the model. They govern network destinations, so they can block an agent from calling an unapproved endpoint. They cannot read what is inside an inference request or determine the intent behind a tool call, because by their model that traffic is just an approved connection to an approved service.
- Pattern-based DLP operates on the wire and matches known strings. A poisoned tool description contains no known string. Neither does an injected instruction sitting in a support ticket. The payload is meaning, not signature, and meaning is what pattern matching cannot see.
- IAM operates at the identity boundary and authenticates people. The agent acting on a person's behalf inherits that authentication and then makes hundreds of autonomous decisions inside it. IAM has no model for a non-human actor that holds a human's credential and decides on its own what to do with it.
- Output filters operate after the fact. They inspect the answer. By the time an answer exists, the untrusted content was already read, the tool was already called, and the action already ran. Filtering the output of an action that has completed is documentation, not control.
The pattern is consistent: the existing stack governs the network, the identity, and the response. The attack happens in the space between them, in the context the model assembles before it acts.
This is not a coverage problem to be solved with tuning. It is a category problem, and it is the same structural argument set out in our examination of why protocol-only solutions fall short.
Why AI Agent Attacks Escalated in 2026
None of these attacks are new. Prompt injection was documented in 2023, and supply chain compromise predates AI entirely. What changed in 2026 is that three forces compounded to make old techniques far more effective.
- Adoption went vertical. Coding agents moved from developer laptops into CI/CD pipelines and shared infrastructure. A compromise that once reached one machine now reaches every artifact the pipeline produces.
- The connector layer exploded. Thousands of MCP servers appeared with no provenance, no signing, and no review. Each is a new channel into the model's context, and most enterprises cannot list the ones their agents can reach. See our analysis of MCP security.
- The attackers noticed. One supply chain tracker recorded more than twice the campaign volume in the first half of 2026 than in all of 2025, with AI coding agents named as a documented accelerant.
Each force alone would have been manageable. Together they turned a category of known attacks into a reliable path into production, and defensive spend did not move with any of it.
How to Secure AI Coding Agents Before Buying a Platform
Three actions close most of the gap before any platform decision is made.
- Inventory the surface. List every agent, coding tool, and MCP connection running in the environment today, and what each one can read and write. Governance is impossible without a count.
- Audit connector provenance. Treat every MCP server as a third-party dependency: who published it, when it was last reviewed, and whether it holds write or execute access it does not need. Re-check after approval, since the rug pull attack only works when nobody is looking on day seven.
- Scope credentials to the agent, not the operator. Most agents run with the standing permissions of whoever launched them. Replace those with scoped, time-limited credentials tied to the specific task, so a compromised agent inherits a job rather than a person.
None of this requires a platform decision. It requires knowing what is running, what it is connected to, and what it is allowed to touch. The control layer that governs the cognitive enterprise is a separate conversation, and one worth having, but it is not a prerequisite for the three steps above.
Why the AI Agent Security Boundary Has to Move?
Every incident in this briefing looks, in isolation, like a distinct failure. A misconfigured server. A careless approval. An unpatched dependency. An over-scoped credential. Read as a set, they describe one thing: an entire class of systems deployed on the assumption that whatever reads untrusted content will know not to act on it.
It does not know that, and it cannot. The boundary is not something the model failed to enforce. It is something the model was never built to have.
Which means the organizations that adopt agents safely will not be the ones with the fewest agents. They will be the ones that stopped asking the model to be the control, and can name at any moment exactly what each agent is permitted to touch.
The boundary that secured computing for fifty years did not disappear. It moved. The work now is to rebuild it where the agent cannot argue with it.
