Emerging Threats Targeting AI Agents and Shadow AI Adoption

As organizations rapidly adopt AI tools and deploy AI agents, they introduce new attack surfaces that traditional security controls are ill-equipped to protect. A key concern is the prompt and agentic interaction layer, vulnerable to indirect prompt injection and agentic tool chain attacks. The proliferation of shadow AI, where employees adopt AI tools without oversight, amplifies these challenges. CrowdStrike is addressing this visibility and governance gap by extending its Falcon platform with AI Detection and Response (AIDR) capabilities across endpoints, SaaS environments, and cloud environments, securing AI workforce adoption and development. This includes securing personal AI agents like OpenClaw against living off the AI land (LOTAIL) attacks.

Attack Chain

1. Initial Access: An attacker gains initial access to a developer's machine, potentially through social engineering or exploiting a vulnerability in a commonly used development tool. (T1204.002)
2. Agent Deployment: The developer, unaware of the compromise, deploys an AI agent (e.g., OpenClaw, ChatGPT, Gemini, Claude, DeepSeek, Microsoft Copilot, O365 Copilot, GitHub Copilot, Cursor) on their endpoint with elevated privileges.
3. Prompt Injection: The attacker leverages prompt injection techniques to manipulate the AI agent's behavior, feeding it malicious prompts or instructions.
4. Data Exfiltration: The compromised AI agent, now under the attacker's control, begins exfiltrating sensitive data from the endpoint or network to a remote server.
5. Lateral Movement: The attacker uses the AI agent's access to pivot and move laterally within the organization's network, targeting other systems and resources.
6. Credential Access: The attacker exploits the AI agent's privileges to access sensitive credentials stored on the endpoint or network, further compromising the environment.
7. Privilege Escalation: Using the stolen credentials, the attacker escalates their privileges to gain administrative control over critical systems.
8. Impact: The attacker achieves their objective, which could include data theft, system disruption, or financial gain.

Impact

Successful attacks targeting AI agents and shadow AI can lead to significant data breaches, financial losses, and reputational damage. The lack of visibility and governance over AI tool deployments creates a blind spot for security teams, allowing attackers to operate undetected for extended periods. The increasing autonomy and system permissions granted to AI agents make them attractive targets for adversaries seeking to gain a foothold within an organization's network. The scale of the impact is potentially large, affecting numerous organizations across various sectors, particularly those heavily invested in AI development and deployment.

Recommendation

• Enable process creation logging on endpoints to monitor the execution of AI applications and agents, and deploy the provided Sigma rule "Detect Suspicious AI Application Execution" to identify anomalous processes (logsource: process_creation, rules).
• Enable network connection logging to monitor AI applications and agents for malicious prompt activity, potential data leaks, and policy violations. Deploy the provided Sigma rule "Detect Outbound Connections from AI Applications" to identify anomalous network connections originating from these applications (logsource: network_connection, rules).
• Utilize AI Discovery capabilities within your security platform (CrowdStrike Falcon® Exposure Management, CrowdStrike Falcon® for IT telemetry) to gain visibility into AI-related components running across endpoints in real time, including AI apps and agents, LLM runtimes, MCP servers, and IDE extensions.