AgentOps Intelligence #5: When the Attacker Gets an Agent¶

Published: July 21, 2026
By RunAgents

Previous issue: When Agents Get Login IDs

The Signal¶

An agent can be correctly authenticated and still be doing the wrong thing.

It may be working for an attacker, compromised through an integration, manipulated by untrusted data, or simply operating beyond its assigned purpose. In every case, authentication can succeed while control fails.

This matters because agents are appearing on both sides of the enterprise security boundary. Companies are giving them legitimate access to applications, credentials, data, and business systems. Attackers are using the same capabilities to accelerate reconnaissance, credential theft, lateral movement, and destructive action.

The next control problem is not only proving which agent acted. It is determining whether the action matched an authorized purpose when it executed.

Forward This Line¶

A valid identity can tell you who acted. It cannot tell you whether the action was authorized.

RunAgents AgentOps Index - This Week¶

Dimension	Status	Direction
Autonomy	High	Up
Access	Critical	Up
Control	Medium	Up
Observability	Medium	Stable
Enterprise Pull	High	Up

Readout: Agent identities are becoming more formal, but access and autonomy are expanding faster than the controls that evaluate intent at the moment of action.

The One Story That Matters¶

On July 20, Sysdig published new findings about JADEPUFFER, an operation it describes as an agentic threat actor.

The operator entered through a vulnerable Langflow deployment. Sysdig observed an AI agent perform reconnaissance, harvest credentials, move between systems, and adapt when individual steps failed. In one sequence, it diagnosed and corrected a failed login in 31 seconds.

The same operator later returned with purpose-built ransomware targeting approximately 180 types of AI and machine-learning files, including model checkpoints, vector databases, datasets, and embedding indexes.

This was not a fully autonomous cyberattack. A human chose the objective and directed the operation, while the agent handled much of the technical execution. Researchers also could not identify the model behind it.

That distinction is important. So is the new division of labor.

The agent did not replace the attacker. It compressed the attack loop by executing, observing failures, and trying another path at software speed. A failed step was no longer a natural pause or an opportunity for reconsideration.

For enterprise leaders, the lesson extends beyond cybercrime. A production agent can be manipulated by external content, inherit an excessive credential, misinterpret an ambiguous instruction, or use a legitimate tool in an unintended way. The activity may look authenticated and technically permitted while producing an outcome the organization never approved.

Why It Matters¶

Traditional identity systems were designed to determine who authenticated and which resources that identity could access. Agent risk unfolds after that decision, across a sequence of tool selections, data retrievals, credential use, retries, and business writes.

Production control must therefore account for the purpose of the run, the user who requested it, the tool being selected, the credential required, the effect of the proposed action, and whether that effect can be reversed.

Identity establishes attribution. Policy establishes authority. Runtime enforcement determines whether the action should proceed now.

Human approval remains important for sensitive or irreversible decisions, but it cannot sit in front of every step. A system operating on a 31-second adaptation cycle also needs scoped credentials, deterministic action policies, bounded retries, immediate revocation, and a complete history of how the run reached its outcome.

The Control Question¶

Could your controls stop a correctly authenticated agent when its actions no longer match its assigned purpose?

Answering that requires more than a login record or permission list. The organization must be able to connect the requesting user, agent identity, assigned purpose, selected tool, policy decision, credential use, and expected business effect.

Boardroom Readout¶

For CIOs: Agents create new execution paths through the enterprise. Each one needs an owner, a defined purpose, access boundaries, and a containment plan.

For CISOs: A legitimate credential can still carry a malicious or unintended action. Monitoring must connect identity with application behavior, tool calls, data access, and outcomes.

For business leaders: Sponsoring an agent means owning what it is permitted to change, which exceptions require review, and how the organization responds when its behavior departs from the intended workflow.

For platform teams: Enforce policy before consequential tool calls and business writes, inject credentials only when allowed, preserve approval context, and make suspension immediate.

Market Moves¶

Sysdig: JADEPUFFER returned with ransomware designed around model assets, vector stores, datasets, and other AI infrastructure.
CrowdStrike: Its Field CTO warned that compromised agents could make living-off-the-land attacks more dangerous because agents may already possess legitimate access across multiple enterprise systems.
Security researchers: A new paper on agent data injection demonstrated that attacker-controlled data disguised as trusted context can cause unintended actions in browser and coding agents, bypassing defenses focused only on malicious instructions.
NIST: Large-scale agent-hijacking tests produced at least one successful attack against every model evaluated, reinforcing that current defenses remain incomplete.

Field Notes¶

Most organizations will not first encounter this problem as a sophisticated cyberattack. They will encounter it as a legitimate agent doing something unexpected.

The agent may read an external document that changes how it interprets the task, select a tool with a larger blast radius than intended, or retry an action until one variation succeeds. The resulting activity may appear normal because the identity, credential, and application are all legitimate.

The failure will not look like unauthorized access. It will look like authorized access used for the wrong purpose.

From runagents.io Lab¶

One pattern we are watching is the separation between agent identity and action context.

Teams may know which agent initiated a tool call but still struggle to explain why the action was permitted, whose request it served, and what changed afterward.

A useful run record should preserve that context from request to outcome. The practical test is not simply whether the organization can identify the agent, but whether it can explain and control the action while it is happening.

Visit runagents.io

Operator Question¶

If one of your legitimate agents began operating outside its assigned purpose, where would your organization detect it, and what could stop it before the next tool call?

Reply with what you are seeing. We read every response.