Unauthorised AI Agents and Prompt Injection Create Enterprise Security Risks

New research reveals that 82% of IT and security professionals have discovered unauthorised AI agents within their organisations over the past year.

The findings, from a survey of 418 professionals commissioned by Token Security from the Cloud Security Alliance (CSA), highlight a growing “shadow AI” problem. While 68% of respondents reported having strong visibility into their AI agents, the high percentage of undiscovered agents suggests that autonomous tools are being deployed outside the oversight of security teams.

These agents are often created by non-technical staff using no-code builders to automate routine tasks, such as invoice processing or Slack summaries. However, this rapid deployment introduces several critical security gaps that can be exploited by malicious actors.

Prompt Injection and Financial Manipulation

One significant vulnerability is prompt injection, where an attacker provides malicious instructions through the data an agent is designed to read. In one demonstrated scenario, an AI agent tasked with matching invoices against an Enterprise Resource Planning (ERP) system could be manipulated via a malicious email.

By embedding instructions in hidden text—such as white text on a white background—an attacker can command the agent to update vendor bank details within the ERP. Because the agent is an authorised tool using valid credentials, the unauthorised change may appear as legitimate activity in standard security logs.

The Rule of Two for Secure Design

To prevent such incidents, security experts recommend a “Secure by Design” approach for AI implementation. Based on principles published by Meta’s AI security team, practitioners suggest that an agent should not possess more than two of the following capabilities in a single session:

• Processing untrusted input;
• Reaching sensitive systems or private data;
• The ability to change state or communicate externally.

An agent that combines all three capabilities poses a high risk of being compromised through external input, and such tools should undergo rigorous security review before being switched on.

Identity and Detection Challenges

The way AI agents access enterprise systems further complicates incident response. Agents frequently use a mix of OAuth grants, personal API keys, and session riding, which can obscure the audit trail. For instance, an ERP log might record an action under a user’s personal API key, while the identity provider may show no record of the specific agent involved.

Detection remains another major hurdle. Traditional security monitoring that looks for permission violations may fail to flag a compromised agent, as the agent operates within its existing, authorised grants. Security teams must instead baseline the actual behaviour of the agent, monitoring for unusual sequences of actions, such as an agent that typically only reads data suddenly attempting to write or edit records.

Finally, accountability is difficult to maintain once an agent is in production. Auditors often struggle to link an automated action back to the specific human who authorised the initial delegation of authority, particularly if the original creator has left the organisation or the OAuth grants have not been revoked.