The Overconfident Intern With Root Access: New Attack Chains and Security Models for Agentic AI

The Overconfident Intern With Root Access: New Attack Chains and Security Models for Agentic AI by David Girvin Autonomous AI agents represent a fundamental shift in the attack surface. Unlike LLMs, agents can independently execute multi-step actions: file operations, database queries, API calls, credential usage, email generation, system changes, and recursive workflows. Today’s enterprise AI deployments treat these systems as if they were chatbots. They are not. They behave far more like unmonitored junior employees with access to production systems, and yet no existing security architecture is designed to handle their failure modes. This talk defines the emerging threat landscape of agentic AI systems and presents seven new attack chains, demonstrated through practical experiments: 1. Intent–Action Mismatch Exploitation 2. Autonomy Zone Escalation (AI sudo abuse) 3. Workflow Drift Injection 4. Multi-Tool Lateral Movement 5. Recursive Agent Spawn Abuse 6. Cross-Service Exfiltration Chains 7. Tool-Specific Privilege Abuse (JIT credential misuse) We introduce the AI Agent Kill Chain, the first structured attacker model for autonomous systems, and provide defenders with: • Behavioral detection signatures • Telemetry schemas for agent event logging • Prevention strategies using autonomy bounding • A blueprint for building an “Agent EDR” pipeline All demonstrations are built using publicly available frameworks, without proprietary vendor tooling. Attendees will leave with a practical, technically enforceable understanding of how to secure agentic AI systems.