Prompt, Plan, Pwn: The Agentic Kill Chain

About this session

Autonomous agents don't just answer — they plan and act, carrying your authority as they call tools and invoke other agents. That loop is what attackers exploit: a single poisoned prompt becomes a multi-step plan, and that plan becomes real action using the agent's own privileges. Drawing on red-team work against production agentic systems, I'll walk real attack paths — indirect injection, tool poisoning, reasoning-chain manipulation, and cross-agent exfiltration — and show why the autonomy that makes agents useful is what makes them exploitable. Then, the controls that break the chain: agent identity and non-human authentication, delegation-scoped tokens, taint tracking across tool calls, hardware-bound attestation, and least-privilege containment that assumes any agent can be turned against you.