00Executive summary
Enterprise AI is rarely a single product. "We deployed Claude for our developers" is, underneath, a stack: an identity provider minting tokens, a reverse proxy brokering API calls, a cloud backend hosting the models, and a command-line agent on every laptop that can read files, run shell commands and call tools. Each layer has its own trust boundary, and each boundary is a place an attacker can stand.
This article is not a finding-by-finding report. It sets out the methodology used to red-team one such deployment end to end: the attacker goals, the trust-boundary model, and the full catalogue of attack vectors exercised against an agentic AI platform. The individual results appear only as a findings overview, one line each. The engagement covered the enterprise SSO integration, the LLM proxy's API surface, the cloud AI backend, and the agent (Claude Code CLI) on a developer workstation.
Across those vectors the assessment produced thirteen findings: two Critical, four High, five Medium, two Low.
The AI platform inherited excessive trust at every layer, and exported almost no visibility.
01Methodology followed
The engagement was run as adversary emulation, not a checklist audit. The guiding question at every step was "what would an attacker do next with what they just obtained?" The phases below map a general AI-red-team methodology onto this stack, and each lists the attack vectors exercised. A conventional application and cloud security method underpins the whole thing; the AI-specific vectors sit on top of it, not instead of it.
The starting assumption was the weakest realistic foothold: a single valid employee identity (phishing, a compromised contractor, a malicious insider) and, separately, a piece of untrusted content the agent might ingest (a cloned repo, a shared skill, an MCP server). Everything chains forward from there.
P0Scoping & adversary-goal definition
Vectors framed · attacker objectives, abuse cases, in-scope trust boundaries
Define concrete adversary goals rather than generic "try to break it": exfiltrate another identity's data, obtain a durable credential, achieve code execution on an endpoint, reach models the user is not entitled to, or operate without being logged. Agree scope, sensitive-data handling, and which boundaries are live. Every later vector traces back to one of these goals.
P1Threat modelling & trust-boundary mapping
Vectors mapped · data-flow analysis, trust-boundary enumeration, confused-deputy paths
- Enumerate every boundary where authority changes hands: user to agent, agent to tool, tool to proxy, proxy to backend, identity provider to cloud.
- Map where untrusted input can enter the model's context: prompts, retrieved documents, web content, tool results, memory, file contents, MCP tool descriptions.
- Identify confused-deputy conditions, where a low-privilege input can make a higher-privilege component act on its behalf.
P2Identity & access testing
Vectors · authn bypass, authz gaps, token theft, SSO bypass, RBAC abuse, privilege escalation
- Acquire tokens for the gateway and the cloud management API; inspect JWT claims, scopes and audiences.
- Test for an authorisation gate between "authenticated tenant user" and "authorised AI user": app-role assignment, group checks, roles claims.
- Review the app registration for token-theft primitives: implicit grant, loose or loopback redirect URIs, mapped-claims acceptance, long-lived client secrets, over-broad group claims.
- Probe for SSO-bypass paths: header-based auth, fallback credential logins, static keys honoured in place of a token.
- Hunt for privilege escalation, especially a low-privilege identity obtaining a durable, high-privilege, identity-less credential.
P3Cloud & infrastructure assessment
Vectors · RBAC over-provisioning, key-listing actions, metadata enumeration, secret sprawl
- Enumerate subscriptions, resource groups, the AI backend resource and its model deployments through normal cloud RBAC.
- Inspect role definitions for dangerous actions (key listing, data-action wildcards) available to ordinary roles.
- Check resource and subscription tags for exposed owner or organisational information useful for targeting.
- Look for undisclosed or high-capacity model deployments reachable despite not being advertised.
P4Gateway, application & API security
Vectors · unauthenticated management surfaces, API-spec disclosure, input-validation gaps, rate-limit and model-allowlist bypass
- Map the proxy's exposed HTTP surface; probe admin, documentation, routing and health endpoints for missing authentication.
- Test server-side validation of caller-supplied parameters, especially the tools and tool-result fields.
- Check for a model allowlist: can a caller name a model or deployment they were never meant to reach, or exceed the intended rate limit.
- Apply standard web and API fundamentals: broken access control, injection, SSRF, information disclosure through errors.
P5Model & prompt-layer attacks
Vectors · direct & indirect prompt injection, RAG/memory poisoning, tool-result injection, system-prompt extraction, jailbreak, context forgery
- Direct prompt injection and jailbreaks against the model's instruction hierarchy and safety controls.
- Indirect prompt injection: hostile instructions planted in content the agent ingests, retrieved documents, web pages, file contents, repository files, tool output, so the untrusted data becomes instructions.
- RAG and memory poisoning: corrupting retrieved or stored context so the model treats attacker data as authoritative history.
- Tool-result injection: forging the output of a tool call so the model acts on fabricated state.
- System-prompt and context extraction: coaxing the model to reveal its instructions, tool definitions or other callers' context in shared or replayed sessions.
P6Tool, connector & MCP integration abuse
Vectors · tool-description poisoning, MCP rug-pull, excessive agency, confused deputy, integration supply chain
- Tool-description poisoning: hidden instructions inside an integration's tool metadata that the model reads as trusted context.
- Rug-pull: an integration that behaves during review and swaps in a malicious description later, tested for any integrity check, hash or change detection between sessions.
- Excessive agency: tools exposed with more capability or reach than the task needs, including credential-adjacent file access.
- Supply chain: shared skills and MCP servers as a delivery vector, and whether installation is constrained to an approved allowlist.
P7Agent endpoint & permission-boundary testing
Vectors · policy-enforcement gaps, settings-hierarchy override, hook abuse, TOCTOU, permission bypass, persistence
- Audit the agent's layered settings hierarchy for an enforcing managed policy above user and project settings, and test whether dangerous constructs are accepted without validation.
- Test permission-model bypasses: skip-permission flags, wildcard command allow-lists, blanket auto-approve hooks.
- Test hook-based abuse: argument rewriting after approval (TOCTOU), pre-conversation execution via skill frontmatter, detached async beaconing, and persistence across the memory-compaction boundary.
- Confirm whether a single prompt injection can reach shell execution with no human interaction.
P8Sensitive-data exposure & secrets at rest
Vectors · credential sprawl, plaintext transcripts, local artefact retention, data-governance inversion
- Inspect what the agent persists locally: transcripts, state snapshots, cached tokens and keys.
- Grep local artefacts for secrets, and check whether extracted credentials survive rotation on disk.
- Assess the inverted data-governance problem: not only what goes into the model, but the rich local record it leaves behind.
P9Living-off-the-land & reconnaissance abuse
Vectors · agent-driven recon, LOLBin generation, skill compression, detection evasion by legitimacy
- Test whether plain-language instructions are translated into working reconnaissance across on-premises directory, cloud tenant and internal applications.
- Confirm whether that activity runs within the invoking user's standing privileges through signed, expected binaries that blend into normal developer behaviour.
- Assess the force-multiplier effect: lowered skill floor for an attacker, and evasion of monitoring tuned for unsigned or anomalous tooling.
P10Detection, telemetry & logging review
Vectors · telemetry gaps, no SIEM/OTel export, retention shortfall, IR blind spots
- Check whether agent and backend activity streams to a central collector and SIEM, or lives only on the endpoint.
- Test retention against policy, and map incident-response scenarios to what evidence would actually survive.
- Identify where behavioural detection must replace signature or binary-reputation detection.
P11Reproducibility, regression & retest
Vectors validated · reliability vs one-off behaviour, regression suite, fix verification
- Because model behaviour is non-deterministic, re-run each candidate finding enough times to separate a reliable failure from a lucky one-off, and record the success rate.
- Capture each confirmed vector as a small, re-runnable test so recurring failure modes become a regression suite.
- Retest alongside the owning engineers after remediation, and confirm the fix holds rather than merely moving the symptom.
02Findings overview
One line per finding: what the vector achieved, not how. Detailed proof-of-concept material stays in the private report.
| # | What was achieved | Severity |
|---|---|---|
| 1 | Extracted live backend API keys using a standard cloud role, and replayed one to bypass enterprise SSO entirely on the test gateway | Critical |
| 2 | Obtained a valid gateway token as an ordinary tenant user, with no role or group authorisation check | High |
| 3 | Confirmed a token-theft path from implicit grant and a loopback redirect, alongside long-lived unmanaged client secrets | High |
| 4 | Enumerated the full cloud tenant and backend blueprint, including undisclosed high-capacity model deployments reachable through the proxy | Medium |
| 5 | Forged the model's stored "memory" by injecting unvalidated tool results into the session context | Medium |
| 6 | Reached admin, API-specification and health surfaces, plus an SSO-bypassing fallback login, without authentication | Low |
| 7 | Demonstrated an MCP rug-pull: a trusted tool silently served a poisoned description between sessions, with no change detection | High |
| 8 | Overwrote the agent's permission model (skip-permissions, wildcard allow, auto-approve and TOCTOU hooks) because no managed policy enforced it, and read credential files with no prompt | Critical |
| 9 | Recovered secrets from full-fidelity local transcripts and confirmed no central export or SIEM visibility | High |
| 10 | Turned plain-English instructions into working AD, cloud and network reconnaissance through signed binaries, within the user's privileges | Medium |
The ten rows are the parent findings. The count of thirteen includes sub-findings folded into findings 3 and 8 (the implicit-grant sub-finding, and the four bypass techniques under the agent-policy root cause).
Affected components
| Component | Role in the stack | Headline exposure |
|---|---|---|
| Enterprise identity / SSO | Issues tokens and gates access | No gate between "authenticated" and "authorised"; implicit-grant and redirect weaknesses enabling token theft |
| LLM proxy / gateway | Brokers model access, holds the backend credential | Management surfaces without authentication; caller-supplied tool results trusted; no model allowlist |
| Cloud AI backend | Hosts the models, governed by cloud RBAC | A standard role can list keys; broad read access; static keys that bypass SSO on one environment |
| Agent endpoint | Reads files, runs commands, calls tools | No enforced policy; trusted integrations can turn malicious; recon through signed binaries |
| Telemetry & monitoring | Cross-cutting detection and IR evidence | No central logging or SIEM; full transcripts and secrets persist only on the endpoint |
03Headline priorities
The methodology points at a small number of leveraged fixes that close or blunt most of the surface above.
- Go keyless. Use managed-identity access to the backend and eliminate static keys, the single most dangerous artefact because they are durable, portable and identity-less.
- Enforce a managed agent policy via MDM. This converts advisory guardrails into enforced ones and neutralises most endpoint findings at once: skip-permissions disabled, base URL pinned, deny-rules for credential reads, wildcard shell and elevation, and hooks sourced only from managed settings.
- Separate authenticated from authorised. Require app-role assignment, disable implicit grant, and prove SSO is the sole path with no header or fallback bypass, in every environment.
- Least-privilege the cloud roles. Remove key-listing from routine roles, restrict resource read to admins, and enforce a model allowlist at the proxy.
- Wire the stack into a SIEM. Stream agent and backend telemetry centrally, cap local transcript retention, and alert on behavioural reconnaissance patterns rather than binary reputation.
- Review the supply chain. Allowlist skills and MCP servers, and hash tool descriptions at approval with change detection on every subsequent fetch.