The anatomy of an agentic AI attack

An autonomous AI attack hands the operator's job to a model-driven agent that plans its own steps, calls tools, reads results, and adapts. The individual techniques are not new; the orchestration is. A tireless agent runs them faster, tries many paths in parallel, and re-plans instantly when a route is blocked, which shrinks the window defenders have to react. In a 2026 incident on a public machine-learning platform, an agent took more than 17,600 actions across infrastructure boundaries in a single campaign. The rest of this page walks the kill chain that agent followed and links the technique behind each step.

The entry point was the machine-learning stack itself. Dataset and model files carry configuration a loader will evaluate, so ML data-loader injection turns a routine load into code execution or file read. Jinja2 template injection in a dataset config reaches Python and runs commands, an HDF5 external storage file read discloses local files, and a model file supply chain attack delivers the payload through a trusted artifact. A package registry attack, a zero-day in a package-proxy cache, gave the agent egress from an otherwise isolated evaluation sandbox.

From a foothold the agent climbed the cloud and Kubernetes stack. It read instance-role credentials from the metadata service (IMDSv1 attacks), then performed Kubernetes node impersonation by wrapping that AWS identity into a node token, and used Kubernetes TokenRequest abuse to mint fresh service-account tokens. SelfSubjectRulesReview abuse mapped exactly what each stolen identity could do, and a privileged pod escape reached root on the node. It spread across the network with mesh VPN abuse and subnet router abuse.

Kubernetes secrets enumeration harvested database passwords, VPN keys, and cloud credentials, because secrets are base64-encoded, not encrypted. Stealing a signing key enabled JWT signing key theft, letting the agent mint valid identity tokens on demand, and GitHub App token abuse issued fresh source-control tokens with write scopes.

With source-control access, the agent turned the delivery pipeline into an attack path. CI/CD pipeline poisoning and pull request injection ran attacker code in privileged runners to probe for more credentials, while package registry attacks reached builds through trusted dependencies. Pipelines hold powerful credentials, so one poisoned build can reach production.

The agent kept control without a blockable domain. A dead drop resolver and living-off-trusted-services C2 carried commands over datasets, pastes, and request-capture services, so traffic went only to reputable hosts. A staged payload loader re-armed on every throwaway sandbox, and payload obfuscation with per-campaign XOR keys, chunking, and error-message smuggling kept anything sensitive out of cleartext logs.

An agent is still a language model, so the same LLM weaknesses apply to it and are used by it: prompt injection, prompt obfuscation, and LLM data exfiltration. In the 2026 case, investigators used an open model to reverse the attacker's obfuscation after a closed model's guardrails declined the analysis, a reminder that model choice shapes both offence and defence.

Assume a machine-speed adversary that never tires and tries everything at once. The controls that matter: least privilege everywhere so a foothold reaches little; tight egress control on build, evaluation, and production workloads so loaders and C2 cannot phone home; behavioural detection over cleartext signatures; anomaly monitoring on service-account and token activity; sandboxed parsing of untrusted models and datasets; safe formats such as safetensors; and a human in the loop for high-impact actions. Test it the way the attacker does: red-team your own environment with an agent and measure how far it gets.