Short answer
- An attack path has four parts: an entry identity (agent, token, service account), the credentials it holds, the permissions those credentials grant, and the data or system at the end.
- Most 2026 agent incidents did not need a new vulnerability. They needed a credential the agent could read and a permission nobody had reviewed end to end.
- You do not need to fix every step. One well chosen breakpoint closes the whole path.
#What is an AI agent attack path?
A classic attack path describes how an attacker moves from an entry point to a target. An AI agent attack path is the same idea with an agent at the start. The agent may be manipulated through prompt injection, compromised through its runtime, or simply do something nobody expected. In every case, what it can do next depends on the identities and credentials it holds.
That is why the useful question is not only "is this agent safe" but "from this agent, what can someone eventually reach". We call the answer agent data reach, and the number of steps to a destructive production action the distance to production.
#The anatomy of an attack path
| Part | Examples | Question to ask |
|---|---|---|
| Entry identity | Coding agent, MCP server, AI tool with an OAuth grant, CI job | Who or what starts the chain? |
| Credential | API token in a file, OAuth token, cloud profile, session token | What does it authenticate as? |
| Permission | Deploy role, domain admin group, CRM export scope, delete rights | What does that identity allow? |
| Target | Customer database, backups, secrets, source code, production | What is lost if this is reached? |
#Six real attack paths from 2026
Each of these incidents is written up as a teardown on our blog. Read side by side, they show one pattern.
| Incident | Path |
|---|---|
| Vercel | AI tool OAuth token → Workspace account → internal systems → customer secrets |
| PocketOS on Railway | Coding agent → root API token in a file → delete endpoint → production volume |
| PaperCut | Exploited print server → domain-admin service account → Domain Admins |
| Salesloft Drift | Stolen OAuth token → Salesforce export → embedded AWS and Snowflake keys |
| AEPD notification | Agent login → application flaw → personal data and invoices |
| GitSpawn | Repository setting → coding agent startup → developer credentials |
In every row, the credential or identity in the middle decided the impact. That is the part defenders control.
#How to find attack paths in your environment
- Inventory agents and non-human identities. Include coding agents, MCP servers, OAuth apps, service accounts and keys. Mark the ones nobody registered.
- Map the credentials each one can use. Not only what it was given, also what it can read: files, environment variables, shared vaults.
- Expand permissions into reach. Follow roles, group memberships and grants until you reach data stores and production actions.
- Rank by target. Paths to customer data, secrets, backups and production come first.
- Pick the breakpoint. The single change that closes the most risk with the least disruption.
- Watch for new paths. A new OAuth grant, a wider role or a new agent can open a path overnight.
#How this maps to OWASP
The OWASP Top 10 for Agentic Applications lists Identity and Privilege Abuse as ASI03: whoever takes over or tricks an agent inherits the identities it holds. The OWASP Top 10 for LLM Applications 2026 moved Excessive Agency up to third place. Attack path analysis is the practical way to measure both, because it shows what an agent's identities actually allow, not only what the agent was meant to do. The principle behind the fix is least agency.
#FAQ
What is an AI agent attack path?
An AI agent attack path is the chain of access steps from an AI agent, or the credentials it holds, to sensitive data or production systems. Each step can look legitimate on its own. The risk is the chain.
How is an attack path different from a vulnerability?
A vulnerability is a single flaw. An attack path can consist entirely of legitimate access, such as a token, a role and a data store, that together lead somewhere nobody intended.
How do you break an AI agent attack path?
Find the breakpoint: the one change, such as scoping a role, rotating a key or revoking a grant, that closes the path with the least disruption. You rarely need to fix every step.
Which frameworks cover AI agent attack paths?
The OWASP Top 10 for Agentic Applications covers it as ASI03, Identity and Privilege Abuse, and the OWASP Top 10 for LLM Applications 2026 lists Excessive Agency in third place.
See where your agents and machine identities can reach. Book a demo or read the attack path guide.