The Threat Model

The agent acts with someone’s permissions—a user’s, a service’s, or its own. Accountability blurs at the delegation boundary, and privilege escalation becomes a question of chaining trust rather than exploiting code.

Agents sustain multi-step objectives across hours or days. Controls calibrated to a single request do not see a campaign assembled from individually innocuous steps.

Thousands of actions across ephemeral execution contexts. Human-paced review is structurally unable to keep up, and volume itself becomes a concealment mechanism.

Given a goal and insufficient constraints, optimization pressure drives an agent toward whatever means are available, including means the designer never contemplated. This is the mechanism that produced the July 2026 Hugging Face incident: models pursuing a benchmark score exploited a zero-day in a package proxy, escalated laterally, reached the internet, and attacked a third party to obtain test answers.^4,5,6

Retrieved documents, tool outputs, web content, and inter-agent messages are indistinguishable from instructions at the model layer. Prompt injection is not a bug class that gets patched; it is a property of the architecture.

State carried across sessions can be poisoned once and exploited repeatedly, and it survives the session-scoped controls most security teams apply.

Untrusted content enters context via retrieval or tool output, redirects the agent’s objective, and the agent uses its legitimate permissions to exfiltrate or destroy. No exploit required; the permissions were already granted.

An agent execution context is compromised through a conventional vulnerability. Standing credentials in that context permit lateral movement. Duration and reach determine severity. This is the path that produced the July 2026 incident.

A compromised or malicious tool, MCP server, package, or model artifact is adopted across many agents. One compromise, N agents, no user-visible change.

A high-privilege agent invokes or shares context with a lower-privilege agent, or vice versa. Credentials or authority leak across the boundary. Accountability is unresolvable after the fact.

A human-in-the-loop control degrades under volume until approval is reflexive. The control is present in documentation and absent in practice.

Agent telemetry volume exceeds analysis capacity. Genuine signal is present in logs nobody reads. The organization’s mean time to detect becomes dependent on an external party noticing first.