Agentic AI Runs on Context. Feed It the Wrong Kind and Decisions Go Sideways Fast.
The core vulnerability in agentic AI systems isn't the model, it's the context window. Bad inputs, machine-speed outputs.
Key points
- Agentic AI systems plan and act across multiple steps, multiplying the damage a bad input can cause.
- The attack surface has shifted from model-level weaknesses to the pipelines that supply context.
- A malicious document can convince an agent it has elevated permissions or that a prior step already completed.
- Defensive tooling, including context provenance tracking and sandboxed execution, has not kept pace with deployment.
- Pipelines feeding context deserve the same scrutiny as the model itself; right now they rarely get it.
Context is everything in intelligence work. You can have perfect signals collection and still produce a dangerously wrong assessment if the surrounding picture is off. Agentic AI has the same problem, and it operates without the friction of a human analyst pausing to sanity-check.
The premise is straightforward. Agentic AI systems, architectures where a model doesn't just respond but plans, acts, and chains decisions across multiple steps, depend on context to determine what to do next. Corrupt or incomplete context doesn't produce a polite refusal. It produces a confident wrong answer, executed at machine speed.
What shifted the attack surface?
Traditional AI security concerns tended to focus on model-level issues: training data poisoning, adversarial inputs, output manipulation. Agentic deployments move the exposure elsewhere. An agent pulling context from an email inbox or a document store is inheriting whatever trust lives in those sources. A malicious document claiming the agent has elevated permissions, or that a prior step already completed when it hasn't, can redirect the entire task chain. Our June coverage of agentjacking via poisoned Sentry error reports showed exactly that class of exploit reaching production developer tooling.
Security teams have started calling this class of problem prompt injection at scale, but that framing undersells it. It's closer to a targeting error that propagates downstream before anyone notices.
Does a capable model fix the problem?
No. A well-trained model may be coherent, broadly knowledgeable, and reliable with tools. None of that helps if the context it receives has been tampered with or is simply wrong. Capability and correctness are orthogonal. Agentic systems maximize the blast radius of that gap.
Should you worry?
For defenders, the practical question isn't whether an agentic system can be useful. It clearly can. The question is whether the pipelines feeding it context are treated with the same scrutiny as the model itself. Right now, frequently, they are not.
Mitigation approaches circulating in CTI and AI-security communities include context provenance tracking, sandboxed execution environments that limit what an agent can affect per step, and human-in-the-loop checkpoints for irreversible actions. None are fully mature. Deployment has outpaced the defensive tooling, which is a sentence the security industry has typed before.
The part worth watching: Estonia's proposal to issue AI agents government-backed digital identities with explicit permission scopes is one of the few structural attempts to constrain what an agent is allowed to touch before it acts. Whether anything like that reaches enterprise tooling at speed is the open question for the rest of this year.
