Autonomous AI agents are vulnerable to Indirect Prompt Injection (IPI), where adversarial instructions embedded in third-party data—such as emails or web content—bypass probabilistic guardrails to execute unauthorized tool calls. This leads to "excessive agency," enabling credential theft, unauthorized data exfiltration, and lateral movement. Mitigation requires transitioning from linguistic constraints to deterministic Zero Trust architectures. By treating agents as Non-Human Identities (NHI), organizations can enforce granular OAuth scopes, utilize short-lived OIDC tokens, and implement hard Access Control Lists (ACLs) to isolate agentic workloads and prevent unauthorized API interaction.

• Threat Landscape: The Agentic Shift

  • Transition from passive LLM interfaces to autonomous agents capable of executing active enterprise workflows.
  • Proliferation of Indirect Prompt Injection (IPI) where payloads are hidden in external datasets processed by the agent.
  • Failure of probabilistic "soft" guardrails and content filters to prevent deterministic execution of adversarial commands.

• Exploitation Vectors: Hijacking Intent

  • Instruction Hijacking: Burying malicious commands deep within large context windows to override system prompts.
  • Credential Exfiltration: Coercing agents into leaking session tokens or API keys during automated tool-to-service communication.
  • Excessive Agency: Exploiting over-privileged identity tokens that allow agents to access resources beyond their intended task scope.

• Defense Strategy: NHI and Zero Trust

  • Non-Human Identity (NHI) Lifecycle Management: Replacing static, long-lived API keys with traceable, managed identities for every agent.
  • Zero Trust Agent Architecture (ZTAA): Implementing continuous verification of identity and intent for every agent-initiated request.
  • Dynamic Credentialing: Utilizing short-lived tokens and OpenID Connect (OIDC) to minimize the window for intercepted credential reuse.

• Technical Hardening: Deterministic Controls

  • Principle of Least Privilege (PoLP): Enforcing granular authorization via strict OAuth scope definitions for all integrated tools.
  • Deterministic Access Control: Augmenting system prompts with hard-coded Access Control Lists (ACLs) to govern tool usage.
  • Secret Management: Deploying robust credential vaulting to isolate authentication data from the LLM's accessible context.

• Industry Standards and Frameworks

  • Coalition for Secure AI: Developing standardized frameworks for agentic identity and access control.
  • Zscaler and Okta Research: Demonstrating that identity-centric perimeters are the only reliable defense against guardrail bypasses.
  • Microsoft ZTAA Blueprints: Providing implementation patterns for securing communication paths between agents and enterprise services.