Somewhere in your organization right now, an AI agent is reading emails. It runs on a cron job - every fifteen minutes, it pulls unread messages from a shared inbox, summarizes them, extracts action items, drafts responses, and routes requests to the right team. It’s connected to your calendar API, your ticketing system, your internal knowledge base. It was deployed by an engineering team that needed to automate the support queue, and it works beautifully.

Here’s how it gets owned.

The Attack Chain

The agent processed 47 other emails in the same batch. Nothing in the logs distinguishes the malicious email from the legitimate ones.

The Hidden Payload

Pages 1-3 of the PDF contain a plausible contract amendment. Page 2 also contains 400 words of white-on-white text - invisible to any human who opens the document, fully visible to the text extraction pipeline. Hover over the document to see what the agent sees:

Why This Attack Works

This isn’t a novel technique. Prompt injection via document embedding has been demonstrated in research since 2023. What makes this scenario devastating is the operational context in which the injection executes.

The agent has standing permissions. Unlike a chatbot that generates text and forgets, this agent maintains persistent access to infrastructure. It holds service credentials. It can make authenticated API calls. It has filesystem access on whatever machine it runs on. These permissions exist because the agent needs them to function.

The agent operates autonomously. There’s no human in the loop reviewing each action. That’s the entire point of a cron job. The agent processes hundreds of emails per day. No one is watching email #238 at 8:48 AM on a Tuesday.

The attack is semantically invisible. The injected instructions don’t contain malware signatures or known exploit patterns. They’re natural language instructions that tell the agent to use its existing capabilities in a way its designers didn’t intend. The agent isn’t executing arbitrary code - it’s following instructions, which is exactly what it was built to do.

OWASP Top 10 for Agentic Applications

OWASP released its Top 10 for Agentic Applications in 2026 - a framework built for autonomous AI systems, not retrofitted from the chatbot era. Our PDF attack hits four of ten categories simultaneously:

ASI01: Agent Goal Hijack. The hidden PDF text is textbook indirect prompt injection - the agent’s objective shifts from “summarize this email” to “exfiltrate credentials and user data.” The attacker never touches the agent directly. They manipulate its input stream through a document the agent is designed to ingest.

ASI02: Tool Misuse & Exploitation. The agent’s file I/O, HTTP client, and shell execution tools are legitimate capabilities. The attack doesn’t introduce new tools - it causes the agent to misuse existing ones. The tools work exactly as designed. The intent behind their invocation is what changed.

ASI05: Unexpected Code Execution. The injected instructions achieve remote code execution - not through a buffer overflow, but by convincing the agent to execute shell commands on the attacker’s behalf. When an agent has shell access, every prompt injection is a potential RCE.

ASI06: Memory & Context Poisoning. The moment the PDF text enters the context window, the agent’s working memory is compromised. Every subsequent reasoning step operates on poisoned context. If this agent maintains persistent memory across runs, the corruption can persist beyond the current execution cycle.

What Didn’t Catch It

Prompt firewalls scan for known injection patterns - “ignore previous instructions,” “you are now in DAN mode.” Sophisticated attackers don’t use these patterns. The injection uses authoritative language and frames malicious actions as diagnostic steps. There’s no universal signature for “natural language instructions that redirect an agent.”

Even if the filter catches it, it introduces a deeper problem: latency. A prompt firewall adds 300-500ms per evaluation. Apply that across a batch of 50 emails with multiple tool calls each and you’ve broken your SLAs. Engineering teams will either accept broken SLAs or disable the firewall. In practice, they disable the firewall.

LLM-based judges run a second large model to evaluate the first model’s behavior. This doubles the latency problem and is fundamentally fragile: the judge model is susceptible to the same semantic manipulation as the primary model.

The Behavioral Gap

Every security tool in the stack above operates on the same principle: inspect content, match patterns, block bad stuff. Agentic attacks don’t have identifiable content signatures.

The attack is only visible at the behavioral level. Why is the agent accessing environment variables - something it never does during email processing? Why is it POSTing to an external domain not on its known API list? Why did its action sequence deviate from the established pattern of parse → summarize → route?

Detecting this requires a system that understands what the agent normally does, maintains a model of expected behavior, and flags deviations in real time - before the exfiltration request completes, not after.

This is runtime behavioral validation: security that operates inside the agent’s execution flow, evaluating every action against behavioral baselines, identity context, and intent inference. Purpose-built small language models (SLMs) - trained specifically on security classification rather than general reasoning - hit the <5ms latency target. They answer narrow, deterministic questions: Is this tool call consistent with this agent’s role? Has this action pattern been observed before? Does this data destination match the agent’s known integration set?

Beyond Injection: The Full Threat Surface

The PDF attack is dramatic, but it’s a single-agent, single-vector scenario. The OWASP Agentic Top 10 maps a much wider surface:

ASI04: Agentic Supply Chain Vulnerabilities. Compromise an upstream tool definition - the PDF parser plugin - and you get code execution inside every agent that uses it. Dependency confusion applied to agentic systems.

ASI07: Insecure Inter-Agent Communication. When the email agent passes its summary to a downstream planning agent, what authenticates the message? What ensures integrity? Agent-to-agent channels are the new unsigned API endpoints - trusted by default, verified by no one.

ASI08: Cascading Failures. A poisoned summary cascades through the swarm. The system reaches consensus on a false reality - an echo-chamber failure - and every downstream action compounds the original corruption.

ASI10: Rogue Agents. An agent persistently compromised via memory poisoning doesn’t crash. It continues operating within its expected envelope while serving the attacker’s objectives. It looks healthy on every dashboard. It passes every health check.

An Immune System, Not a Wall

The firewall metaphor breaks down when the threat operates inside the perimeter - when the agent is your infrastructure, and the attack is a subtle behavioral deviation rather than an identifiable payload.

The Window Is Now

The email agent scenario described here is not sophisticated. The white-text-in-PDF technique is years old. The prompt injection is straightforward. A moderately skilled attacker could execute this today against any enterprise running an autonomous email processing agent without runtime behavioral monitoring.

The harder attacks - state poisoning over weeks, Byzantine manipulation of multi-agent consensus, slow role dilution - are coming. They’ll be harder to detect, harder to attribute, and harder to explain to a board.

Every enterprise deploying autonomous agents needs to answer one question: What is watching the agent while it runs? Not what scanned it before deployment. Not what filters its inputs. What is continuously validating its behavior, in real time, at every decision point?

If the answer is “nothing,” the only thing between your infrastructure and a weaponized PDF is the agent’s own judgment. And the agent, by design, follows instructions.

Rogue Security builds runtime behavioral security for agentic AI - embedded SLMs, continuous red-teaming, and sub-5ms enforcement for autonomous systems. Learn more at rogue.security.